Posts

Dzhokhar’s Four Phones

/4 Comments/in /by

A month ago, the government argued in Dzhokhar Tsarnaev’s case it had no discovery obligations under Section 215, which top government officials have said they used to achieve piece of mind.

Yesterday, Dzhokhar’s college buddies challenged their confession based on a claim the government didn’t have a warrant when it surrounded their apartment with 60 cops. The government’s excuse is that Tsarnaev received the bills for four AT&T phones at that address, and one of the phones had recently been used to call Russia.

Tsarnaev was receiving AT&T bills for four phones at that address. One of the phones had called Russia from near the UMass-Dartmouth campus, which led investigators to think he might be nearby – perhaps at his friends’ apartment.

“I proceeded with all haste and with blue lights flashing” to where the phones suggested Tsarnaev might be, Walker said.

Soon about 60 officers had the New Bedford home surrounded.
Tsarnaev wasn’t inside, but his two friends were, along with Kadyrbayev’s girlfriend.

What happened next could affect the outcome of the cases against Tsarnaev’s friends. Walker said the FBI had not obtained a search warrant. Agents took the two men from the apartment, handcuffed them and questioned them in unmarked cars, Walker said, before they agreed to go to the State Police barracks for further questioning.

Kadyrbayev’s attorney Robert Stahl said that amounted to “uncounseled, unwarranted seizures of these individuals.” If the FBI violated the defendants’ rights, then their statements, which prosecutors are calling “confessions,” could be excluded from their trials.

This all occurred while Dzhokhar was bleeding out in a boat in Watertown.

There are multiple ways the FBI could have gotten these phone records. They may well have a database of subscriber information for major providers, meaning they could learn which carrier he used quickly within FBI. The could have gotten the call records just with NSLs. (NSA’s phone dragnet wouldn’t be all that useful at that stage, though it might have provided interesting information on the Russia call.) The FBI might even have used Hemisphere, which provides geolocation. (Remember, though, that MA’s Supreme Court just ruled the police need a warrant for cell location.)

The defendants have already received some of Dzhokhar’s texts in discovery, so I assume there are no evidentiary problems with those.

In other words, we should assume this data came from normal FBI sources, not NSA ones. (If so, it’s another strike against the claim the NSA needs the phone dragnet for quickness, because this would have happened quickly if the FBI’s narrative is true.)

But it does raise interesting questions about dual sources for the data at hand.

Also remember, these are the same phones that the same buddies had limited discovery on texts from, because Dhokhar had destroyed the one he was using.

Dzhokhar Tsarnaev’s Search Motion: the Reddish-Brown Powder and the Pizza Papers

/9 Comments/in /by

In addition to his motion challenging his confession, Dzhokhar Tsarnaev also submitted at least one more motion to suppress on Wednesday (there’s a third motion to suppress the search of his laptop; that appears to be sealed document 284 in the docket), challenging the scope of and in one case the legality of the searches done on the Tsarnaev’s residences.

I’ll leave it to the lawyers to argue about the merits of the challenge. I’m primarily interested in what they show about the development of the investigation. They appear to show an evolution in FBI’s understanding of where and whether the explosives used in the attack were made.

The motion describes the following searches of the two residences associated with Dzhokhar Tsarnaev:

April 15, 2013: The attack

April 19, 2013: After IDing Tamerlan via fingerprints, FBI obtained a warrant for 410 Norfolk Street in Cambridge; that search lasted from 1 AM on April 20 until 1PM on April 20; this warrant included “Property, records, or other information related to the ordering, purchasing, manufacturing, storage, and transportation of firearms;”

Overnight April 20 to 21: FBI’s High Value Interrogation Team conducts first interrogation of Tsarnaev

3AM to 9AM April 22: FBI conducts search of Tsarnaev’s UMASS dorm room based on warrant issued at midnight that day

May 5: FBI conducts a second search on 410 Norfolk apartment, based off warrant issued on May 3; this search appears based on evidence obtained from surveillance video of people — including potentially a female — purchasing pressure cookers at Macys, but also included further search for low-explosive powder residue; no residue was found

June 27: On invitation from UMASS cops, FBI observes Dzhokhar’s dorm room again; UMASS cops obtain sample of reddish-brown powder; this is the search Dzhokhar claims was illegal

July 26: FBI searches Dzhokhar’s dorm room based on warrant issued July 24, claiming to have observed reddish-brown powder on previous April 21 warranted search; this warrant includes explosives and BBs

It appears that the FBI did initial broad-brush searches on both Norfolk and the dorm room after they caught the brothers (though I am intrigued that it took FBI 2 days to get to the dorm room, which is significant given issues of who tried to tamper evidence there). Then on May 5, FBI went back Norfolk Street to try to tie the purchase of pressure cookers to the Tsarnaevs, and obtain more evidence that the pressure cooker bombs were made at the Cambridge apartment. They didn’t, apparently, find any residue to support the latter claim.

Then, it appears UMASS invited the FBI into the dorm room for one more looksie before they crated up Dzhokhar’s stuff on June 27. Presumably acting on FBI’s instructions, UMASS cops swabbed the reddish-brown powder, and presumably sent it out for testing. Again presumably, once that test came back, the FBI invented the story that they had observed the reddish-brown powder on their original search so as to legally obtain a sample of it.

At least, that’s the scenario laid out in Dzhokhar’s challenge to its collection.

The application for the second search warrant for Mr. Tsarnaev’s dorm room and for his personal property, taken from his dorm room, recites facts gleaned from the investigation of the Boston Marathon bombings, a search of Mr. Tsarnaev’s laptop computer (the subject of a separate motion to suppress), another search of material found in a backpack located in a landfill, and the observations made by FBI agents during the June 27 warrantless entry . Some of this information was available well before the June 27 entry, yet the FBI had not sought a second warrant.

It appears that the warrant was aimed in large part at seizing the “reddish-brown powder” observed on the window sill of the room. The warrant application’s claim that this was seen during the April search by agents, who inexplicably failed to seize it, strains credulity. Reports regarding the April 21 search do not mention the powder. Photographs taken of the pyrotechnic found on the window sill do not show it. And the Evidence Recovery Team casebook twice states that the room was reviewed by a chemist “for potential areas for swabbing. None were located.”

As a reminder, two of Dzhokhar’s buddies, Dias Kadyrbayev and Azamat Tazkayakov, along with an unnamed co-conspirator allegedly removed the laptop and other materials from the dorm room on April 18; it took the FBI 6 days of searching a landfill to find those things on April 25. So whatever was in them (including the computer the search of which Dzhokhar is also challenging) was not available before the April 21 search.

The FBI looksie visit on June 27 was likely nothing more than UMASS trying to give the FBI one more pass at the room before they cleared it; while they did search for clothes (which is how they were trying to tie the pressure cooker purchase in), it’s not clear they were in search of anything in particular. (Though on the subsequent search they may have been looking for DNA of still unidentified people.)

But that reddish-brown powder seems to have sparked their interest.

I raise all this, in part, because of a recent report that the pressure cooker bombs couldn’t have been based solely on the Inspire magazine instructions (and I had heard similar things almost immediately after the bombing).

ABC News has learned that many within the FBI, law enforcement and counter-terrorism strongly disagree they could have become good enough to make the improvised explosive devices (IEDs) from online how-to’s and suspect an expert taught or instructed Tamerlan on the craft of bombmaking while he was overseas in 2012.

[snip]

But an analysis of the bombs done by FBI technicians at the Terrorist Explosive Device Analytical Center (TEDAC) in Quantico, Virginia in late April 2013 found that the bombs in Boston had a much more sophisticated design that that in [Inspire], including differences in the initiators, power source and switch/trigger, which utilized a toy car remote control. Inspire never contained instructions for that type of switch/trigger used to remotely set off the IEDs but had directions for a different type using a motorcycle remote starter.

“While the RC concept is similar, TEDAC assesses INSPIRE  would not provide an individual with the appropriate details to translate these instructions for use with RC toy car components. Such construction would likely require previous knowledge of, or additional research into, RC toy car circuitry,” a TEDAC analysis document said.

That is, the understanding they had of how and where the bombs were made — based in part on Dzhokhar’s confession — seems to have evolved after the initial searches. The FBI appears not to have found evidence backing their public claims that the bombs were made in Cambridge. And now we find something — which admittedly could just as easily be pot residue as bomb residue — that focuses on the explosives found in the dorm room.

One more detail, that I only raise because of my continued obsession with the role of Gerry’s Italian Kitchen in this attack. The suppression motion also notes that the April searches included evidence relating to pizza.

Among the items seized from the Norfolk Street apartment was a paystub for Tamerlan from a 2010 job at a pizza restaurant. Agents seized a pizza box from Mr. Tsarnaev’s dorm room.

These were from the initial April searches. But particularly the seizure of Tamerlan’s paystub suggest they were interested in his ties to pizza joints in the area.

In Tsarnaev-Related Case, DOJ Suggests There Is No Dragnet

/31 Comments/in , /by

As a number of stories reported last week, two of Dzhokhar Tsarnaev’s college buddies charged with obstruction lost their bid to get the prosecution to turn over texts Dzhokhar sent. The AP has the most detailed account:

The defense requested all communications between Tsarnaev and the three men, as well as all communications between Tsarnaev and other people.

[snip]

Robert Stahl, [Dias] Kadyrbayev’s lawyer, said prosecutors told defense attorneys that Tsarnaev destroyed his cellphone before his arrest. Stahl said that in other cases he’s had, some text messages have been retrieved from cellphones through a service provider. He asked Judge Douglas Woodlock to ask prosecutors to seek those text messages and turn them over to the defense.

Assistant U.S. Attorney Stephanie Siegmann said prosecutors have already given the defense text messages between Tsarnaev and the three friends taken from the cellphones of the friends.

“I believe the messages we’ve given them are all we could get,” Siegmann told the judge.

Woodlock said the defense was not entitled to get text messages between Tsarnaev and anyone else because they would not be relevant to the defendants’ cases.

The BoGlo describes the dispute slightly differently, suggesting the defense asked for texts involving the defendants, with the prosecution responding they had provided the texts between Tsarnaev and the defendants.

He asked Woodlock to ask prosecutors to seek any text messages involving the defendants and turn them over to the defense.

Siegmann said prosecutors have already given the defense text messages between Tsarnaev and the three friends taken from the cellphones of the friends.

Which would be rather interesting given the way NSA collects communications about people (though it’s unclear how quickly an emergency collection can be collected).

Here’s ABC on that dispute. Reuters and Boston Herald focused on other disputes, including that witnesses gave a statement and/or were videotaped by cops, but that this was suppressed.

Before getting too far into these competing claims (at least as presented without a transcript, which I’ll take a look at down the road), let me take a step back.

The docket in this case, like Dzhokhar’s docket, has a bunch of gaps which presumably reflect sealed filings. Part of that involves the protective order in this case, though it (plus a presumed sealed motion “taken under advisement” is referenced in the minutes for an October hearing).

According to a schedule set on January 15, defendants were supposed to submit motions to compel discovery by February 28. But on some date (the official file date is March 3, which can’t be right), defendants filed to extend the deadline to March 1, in part because of new discovery that week. The defense submitted their motion to compel on March 3, the prosecution responded on March 7; both those filings are still sealed. The hearing was on March 10. So it’s possible that some of these issues, including the question of what texts are accessible to prosecutors in a case related to the Boston Marathon attack, just came up in the last several weeks.

So.

In response to a defense demand that — in a case where the key physical evidence (the computer and firecracker casings Dzhokhar’s friends are accused of throwing away) yielded no DNA or fingerprint evidence, where Dzhokhar is accused of destroying his phone within a day of the time he texted his friends suggesting they “take” what they want — the defense get the other texts Dzhokhar may have sent during this period, the prosecution did not, apparently make the argument the judge ultimately adopted, that these texts weren’t relevant. Rather, AUSA Stephanie Siegmann seems to have suggested that the government had no ability to get any other texts.

Not only would that suggest Dzhokhar managed to destroy his cell phone in precisely the sweet spot between the time the cops admit to having IDed them (assuming that claim is credible) and when he lost the physical ability to do so as he bled out in the boat in Watertown. (Remember, according to some narratives he was using it during the car chase the night before.) But it would also suggest the NSA has no ability to get text messages from providers once a cell phone has been destroyed (nor was able to get the receiving end of those text messages based on the metadata of the texts).

Golly. It’s as if no dragnet exists, even in spite of NSA claims they used that very same dragnet to gain “peace of mind” after the attack.

We won’t learn any more of this claim unless and until the defense appeals this decision.

But FBI’s claimed inability to access Dzhokhar’s text messages in this case does seem remarkable.

Maybe Dzhokhar’s Buddies Just Wanted a Job at HSBC?

/9 Comments/in , /by

A lot of people on Twitter are talking about how dumb-as-shit Dzhokhar Tsarnaev’s college buddies, Azamat Tazhayakov, Dias Kadyrbayev, and Robel Phillipos were when they allegedly removed evidence relating to the Boston Marathon bombing and threw it in the trash or (in the case of Phillipos) lied about those activities.

I’m not convinced, though.

I’m not defending what the young men did. Nor am I vouching for their intelligence. Nor am I saying they shouldn’t be prosecuted — they should!

But I’m having a hard time distinguishing what they did from what, say, HSBC did, for years. Aside from the fact that HSBC affirmatively helped terrorists, rather than just covered up that help. And aside from the fact HSBC made a billion dollars doing so.

As a reminder, where’s what HSBC did — eliciting nary a blink of an eye from the same DOJ that is now (rightly) prosecuting these dumb-as-shit kids. They were a key — perhaps the key — bank providing Saudi al-Rajhi bank cash dollars. Details emerged in 2001 that the bank had been providing the dollars terrorists used in their plots, including the 9/11 plot. It took four years for HSBC to begin to get worried about it. But it still only halted the dollar trade for al-Rajhi while its US regulator, OCC, looked into its money laundering practices (it says something about HSBC’s awareness of the sensitivity of this issue that they didn’t halt their other abundant money laundering activities).

And then, once OCC was out of its hair, HSBC moved back into the cash dollar business with al-Rajhi, a bank reportedly involved with the most spectacular terrorist acts of recent years.

Just HSBC’s brief exit from the cash business with al Rajhi is similar to what Dzhokhar’s dumb-as-shit buddies did when they put his backpack in the public trash. Covering up terrorism.

Read more →