Yorgen Fenech compilation: A wifi camera disguised as an air freshener and 4 terabytes of data extracted in Operation Blue Elephant

The compilation of evidence against Yorgen Fenech sees Europol experts present hard drives with data extracted from electronic devices belonging to the murder suspect

Daphne Caruana Galizia murder suspect Yorgen Fenech
Daphne Caruana Galizia murder suspect Yorgen Fenech

Four terabytes of data were extracted from electronic devices belonging to Yorgen Fenech by Europol experts, the court heard today.

The data was extracted from mobile phones, laptops, SIM cards and other devices lifted from the Portomaso business tower and Fenech’s yacht, the Gio.

One of the devices analysed by the experts was a wifi camera disguised as an air freshener. Investigators also found new SIM cards belonging to Monaco Telecom.

Three Europol experts testified in the compilation of evidence against Fenech, who stands accused of masterminding the murder of journalist Daphne Caruana Galizia.

They presented hard drives and reports with their findings and testified about the work they did to extract the information, an operation code named Blue Elephant.

However, the content of the data remained under wraps for today.

The court heard how Europol experts were divided into two teams – one carrying out the data extraction, and another analysing the content.

The court ruled that the parties cannot publish any parts of the data and warned it would be a prosecutable offence if they shared the contents with third parties.

Previous sitting

During the previous sitting, the chief investigator in the Caruana Galizia murder case, Superintendent Keith Arnaud, had testified behind closed doors in relation to a pardon request by Fenech.

READ MORE: Daphne murder: Chief investigator testifies behind closed doors on Yorgen Fenech pardon request

The evidence against Fenech primarily rests on the testimony of Melvin Theuma, the middleman in the murder. Theuma, who had secretly recorded various conversations between himself, Fenech and others, was given a presidential pardon to tell all last year.

Magistrate Rachel Montebello is hearing the compilation of evidence against Fenech.

The defence lawyers are Marion Camilleri, Gianluca Caruana Curran and Charles Mercieca.

The prosecution is being led by Superintendent Keith Arnaud and Inspector Kurt Zahra, assisted by the Attorney General.

Lawyers Jason Azzopardi and Therese Comodini Cachia are appearing parte civile for the Caruana Galizia family.

17:55 That's it for today. Thank you for following. Kurt Sansone
17:55 The case continues on Wednesday at 10am. Kurt Sansone
17:54 The court says it prohibits the parties from publishing any of the contents of the hard drives, aside from the information which emerges in open court. It also prohibits the parties from giving this information to third parties unless required by a criminal investigation. Failure to do so would be a prosecutable offence, the magistrate decrees. Kurt Sansone
17:51 Mercieca says that in view of the fact that the data could contain information unrelated to the charges and about the private life of Fenech he is asking for a ban on the publication of the data. “Without doubt,” says the court, adding it was going to order it anyway. Kurt Sansone
17:42 The Europol experts are called back in to exhibit their third copy. Kurt Sansone
17:41 As the debate continues on what to do with copies of the hard drives, the magistrate appears frustrated: “These are problems created all the time, for everything… The court tries to accommodate everyone but there are limits.” Kurt Sansone
17:38 Court expert Alvin Cardona is appointed to make copies of the drives and exhibit them later. Kurt Sansone
17:36 A further copy will be made and be given to the inquiring magistrate at a later date. Kurt Sansone
17:34 The court orders that the third copy of the Europol exhibits handed in today be handed to the defence. This was meant to be given to the inquiring magistrate. Kurt Sansone
17:32 The court notes that the prosecution request the appointment of an expert to make a copy of the data on the hard drives and the defence's objection to this request. The parte civile submits that it needn't be a Europol expert to make the copies but that a Maltese expert could do this in a couple of days without having to fly to The Hague and back with all the expenses and time this involves. The AG agrees. The court appears to have heard enough. Kurt Sansone
17:23 Azzopardi: “We don't need Europol to make a copy of a hard drive, a Maltese expert can be appointed to do this.” Kurt Sansone
17:23 The experts have a spare copy to be exhibited in the inquiry, but this would still not be enough. Kurt Sansone
17:21 “It is four terabytes of data,” says Petrou. “It could take till past Wednesday,” he explains. Kurt Sansone
17:20 The court calls in the witnesses in again. It asks them to make another three copies of the information they exhibited today. Kurt Sansone
17:18 Arnaud suggests that the court could order the purchase of hard drives and the experts could work on them and provide copies tomorrow, to avoid delay. Kurt Sansone
17:17 The defence says that previous copies of data had been problematic. Kurt Sansone
17:16 Azzopardi: “Why is the defence playing for time?” Kurt Sansone
17:16 The defence are asking for copies of the extractions but insist the copies should not be “a copy of a copy”. They want the extraction to happen afresh. “This will cause long delays,” Deputy AG Philip Galea Farrugia says, arguing that the copies were made from data extracted. “The court can distribute copies of it at will,” he says. Kurt Sansone
17:12 It's been a long few hours and everyone in the courtroom is hungry. The court tells Mercieca off for eating in court, saying “it's very bad manners”. Kurt Sansone
17:12 Arnaud asks the court to appoint someone to make copies of the drives for the parties. Kurt Sansone
17:11 The cross-examination is suspended. At the suggestion of the defence the cross-examination will continue on Wednesday. Kurt Sansone
17:11 Mercieca asks the witness what software was used to create images of the devices and hard drives. “FTK imager and others,” he replies. Kurt Sansone
17:06 He is asked about other devices involved in other cases. The court reforms the question but the witness says he had not been asked to prepare for this. Kurt Sansone
17:05 Petrou: “The documentation contains this information but I wasn't managing the case.” Kurt Sansone
17:04 Mercieca: “Which ones took part in the investigation?” Kurt Sansone
17:03 Asked who is on the digital forensic team, the witness rattles off a list of names. Kurt Sansone
17:02 The lawyer probes the witness on whether he was the team leader, but the witness says he wasn't. Kurt Sansone
17:02 Petrou: “Yes.” Kurt Sansone
17:01 Mercieca says that Europol's structure was “broadly teams that extract data and others that analyse it”. Kurt Sansone
17:01 He offers to check his email to confirm the names of the people. Kurt Sansone
17:00 Petrou: “I don't remember how many, I'm sorry... They were working in another room.” Kurt Sansone
16:59 Mercieca: “Do you remember how many they were?” Kurt Sansone
16:59 The expert says he cannot recall their names as he worked with them last year in Malta. “Europol is a big organisation. Our job was to extract data and their job was to analyse data,” Petrou explains. Kurt Sansone
16:56 Mercieca: “Are you aware of any other Europol personnel who worked with you?” Kurt Sansone
16:55 Petrou says he had no contact with the person indicated by the lawyer, explaining that he got the exhibits from his team leader, a certain Sami. Kurt Sansone
16:54 Mercieca asks if a Gerth Duwee works with the team. Petrous says he is not familiar with the name. “He might be a colleague with AP weapons and explosives,” he says. Kurt Sansone
16:53 The witness says he worked as part of a team with his team leader, who was not in Malta. He clarifies that his team is the other two experts and the team leader. Kurt Sansone
16:48 Petrous: “No. The only hard copy was made for the court. The other is at Europol.” Kurt Sansone
16:48 Mercieca asks the witness whether he had passed on a copy of the report to anyone else. Kurt Sansone
16:47 Mercieca asks Petrous who asked him to extract the data. “Keith Arnaud,” says the witness. Mercieca asks whether Petrous had spoken to Arnaud before. “We have been working on this case for several years,” replies the witness. Kurt Sansone
16:46 Yorgen Fenech says something to Mercieca. Kurt Sansone
16:46 The witnesses explain that they have a network storage system… The initial extraction was done individually and then placed on the network. From there it went to the hard drives. Kurt Sansone
16:43 Defence lawyer Charles Mercieca asks the experts whether the information they testified about is contained in these hard drives. Kurt Sansone
16:42 The court is back in session. The three experts are called back into the courtroom for cross-examination. Kurt Sansone
16:36 The court has taken a short break. Kurt Sansone
16:18 Torres is presenting documents relating to the delivery of exhibits and the chain of custody. The court asks the witness to wait outside while the defence prepares its cross-examination. Kurt Sansone
16:14 Lawyer Charles Mercieca asks for more time before cross-examining the witnesses as he has not been given time to digest the reports that have been presented. Kurt Sansone
16:13 A nano-SIM card is intended to provide phone service, communication and data to a device, says the expert. The pack is the format in which a SIM card is sold. The cards were still new, confirms the expert. Kurt Sansone
16:09 Azzopardi asks the expert to explain what a nano-SIM card is used in. Defence lawyer Charles Mercieca objects but the court rules that the witness is qualified to answer the question. Kurt Sansone
16:08 Lawyer Jason Azzopardi begins his questioning. He asks about the devices listed. He asks the expert his opinion on two SIM cards of Monaco Telecom and three SIM card packs of Monaco Telecom. The expert says they are SIM cards for ISP and service provider services for the phone. Kurt Sansone
16:04 The last report is regarding a single device seized at Portomaso. This was a Wifi camera which had one MicroSD slot but no card was placed inside. Kurt Sansone
15:58 The expert says he examined 21 devices that were recovered from the yacht Gio. Kurt Sansone
15:53 Torres says the iPhone was in a “system restored status” and didn't contain any personal information. No extraction was made of this device, he explains. Kurt Sansone
15:52 Torres is speaking about the devices he analysed: a PC, an iPhone, three USB devices and an envelope containing 17 DVDs. Kurt Sansone
15:50 He confirms the security setup and the locked room in which the devices were kept. “We only worked in this room. The exhibits I was working on were only in this room after being delivered by my colleague,” Torres says. Kurt Sansone
15:46 The next witness Israel Torres takes the stand. He was appointed as court expert in this case in 2019. His task was to support the Maltese authorities in the extraction of data from Yorgen Fenech's devices. Kurt Sansone
15:41 The court has ordered a ban on the address mentioned previously from where devices were elevated at the request of the defence. Kurt Sansone
15:40 The court is told that the air freshener was a camera and it had no memory card inside it at the time of examination. Kurt Sansone
15:39 Azzopardi: “One of the items recovered was a Wifi Air Freshener camera DVR. Am I to understand it was a spy camera?” Kurt Sansone
15:37 Lawyer Jason Azzopardi asks the expert about the devices found in a residence. Kurt Sansone
15:22 The going is tedious. Lots of document identifiers and numbers are being exchanged. Kurt Sansone
15:18 Arnaud asks for the IMEI numbers of the phones. They are read out in court. Kurt Sansone
15:13 He will exhibit two iPhones and 2 SIM cards which he examined. Kurt Sansone
15:09 Totaro starts to go through the report, page by page. Kurt Sansone
15:08 Totaro says he arrived in Malta on 20 November 2019, and received the devices the next day. The other senior Europol officer was on site when the devices were seized, he adds. Kurt Sansone
15:08 The questioning is taking some time due to the language barrier. Kurt Sansone
15:06 The report he presents, documents the process he carried out with regards to the exhibits recovered from the cabin cruiser Gio, which belongs to the accused. Kurt Sansone
15:05 The second Europol expert, Giuseppe Totaro takes the stand. He's a specialist forensic examiner at the digital forensics lab at Europol. Kurt Sansone
15:01 Lawyer Charles Mercieca says the defence wants to cross examine the three experts together first, and so will cross examine Petrou individually later. Kurt Sansone
15:00 Azzopardi asks who assigned the Blue Elephant terminology to the operation. “We assigned it in the lab,” Petrou says. Kurt Sansone
14:59 A microSD card and a Chromecast player were also examined by the experts, it emerges. Kurt Sansone
14:59 Azzopardi asks what type of data was extracted. Witness says he wasn't analysing the data. Kurt Sansone
14:54 Petrou says that over 580Gb of data were examined. Kurt Sansone
14:54 Jason Azzopardi, for the parte civile, stands to ask questions to Petrou. He asks him what Operation Blue Elephant was about. The name was assigned by AP Weapons and Explosives group, says the witness. Kurt Sansone
14:51 His colleagues will be presenting some other exhibits, digital copies of which had been examined abroad, Petrou says. Kurt Sansone
14:48 Petrou says he arrived in Malta on 20 November and left on the 23rd. He had carried out his work at “police premises”. The room allocated to them was locked and only they had the key, he says. Kurt Sansone
14:47 The witness is Konstantinos Petrou, an official from Europol. He is one of three experts testifying about the data analysis they performed on devices confiscated by the police from Yorgen Fenech. Kurt Sansone
14:46 A digital video recorder was also among the devices examined. More software is required to see it. The report submitted by the Europol expert also contains recommendations. It is not clear what the recommendations refer to without seeing the report. Kurt Sansone
14:45 The witness is now explaining the methodology used to extract the data. The exhibits include a laptop. He asks whether he is supposed to read the list of all the devices examined, but is told this is not necessary. Specific software is needed to see the drive images, he says. The software is freeware. Kurt Sansone
14:32 Petru says he examined exhibits taken from the director's room and other offices at Portomaso. The four exhibits he examined had been handed to him when he arrived in Malta, he says. He also exhibits the submission forms which had been presented with the exhibits. Kurt Sansone
14:30 Arnaud asks Petru to guide them through his report. Mercieca says he expects a copy first. The court says it is waiting for its messenger to make copies. “As you can see the court isn't very well equipped in this case,” the magistrate says. Kurt Sansone
14:29 The defence says that the questions will be about the extraction. Arnaud says the hard drives contain the raw data as it was saved, but the extraction would be explained through his examination in chief. The court wants the witnesses to testify together but Arnaud says that the experts examined different devices. The court says the questions will be heard after the examination in chief is finished. Kurt Sansone
14:23 Mercieca wants to cross-examine the witness but Arnaud says that the examination in chief is not finished yet. Kurt Sansone
14:23 The other two experts swear to the court that they performed the extraction to the best of their ability. Kurt Sansone
14:23 Each expert has prepared a report based on the exhibits they examined. Mercieca says the defence would like a copy of the report too. “No doubt,” replies the magistrate. Kurt Sansone
14:22 The reason is that the police would make copies for the parties, Arnaud says. “We'll see about that,” says the magistrate. Kurt Sansone
14:22 He says the hard drives contain the data extracted by him and his colleagues. It contains images of the data extracted. Lawyer Charles Mercieca asks if there is a copy for the defence. Arnaud says no and will explain why shortly, he adds. Kurt Sansone
14:21 Petru says he examined exhibits seized from the Portomaso business tower from various offices there. He had been assigned a room in Malta to perform the extraction, to which only the experts had the key. The extractions have been stored on hard drives and copies of the data were brought by the experts. Asked where the hard drives were, he reaches into his satchel and brings out two boxes, containing the devices. A third copy was given to the inquiring magistrate, he adds. Kurt Sansone
14:14 They are administered the oath. Petru presents the report. He explains that he was appointed as a forensic examiner in order to support the Maltese authorities on exhibits seized from every property belonging to Fenech. He works with Europol as a senior specialist forensic examiner. Kurt Sansone
14:11 The third is Giuseppe Totaro from Italy. Kurt Sansone
14:11 Israel Torres from Spain is the second Europol expert. Kurt Sansone
14:10 He is the first Europol expert. Kurt Sansone
14:10 Amusingly, Greek witness Constantinos Petru is asked to write his name, father’s name and place of birth to avoid having to dictate it to the court. Kurt Sansone
14:09 Magistrate Rachel Montebello enters the court, which is now in session. Arnaud tells the court that Europol experts will testify. He explains that three experts will testify to explain how the data was extracted and analysed, and about their report. Kurt Sansone
13:59 Lawyer Charles Mercieca paces back and forth as Yorgen Fenech and Gianluca Caruana Curran talk and look over their shoulders every few seconds. The court messenger wheels the acts of the case into the courtroom in a large suitcase. Kurt Sansone
13:49 Superintendent Keith Arnaud and Inspector Kurt Zahra enter the courtroom. Kurt Sansone
13:43 The courtroom is silent as we wait for Magistrate Rachel Montebello to emerge from chambers. Kurt Sansone
13:33 Deputy Attorney General Philip Galea Farrugia walks into the courtroom and joins lawyer Jason Azzopardi, who was previously speaking with Paul Caruana Galizia, on the bench used by the prosecution. Kurt Sansone
13:32 Fenech is led into the courtroom and takes his seat in the dock. He is discussing something with his lawyers Gianluca Caruana Curran and Charles Mercieca. The other defence lawyer, Marion Camilleri sits nearby, on the defence bench. Kurt Sansone
13:28 QUICK REMINDER: Yorgen Fenech is charged with masterminding the murder of Daphne Caruana Galizia. He was arrested and arraigned in November last year. The compilation of evidence against him is ongoing. Fenech is represented by lawyers Gianluca Caruana Curran, Charles Mercieca and Marion Camilleri. The prosecution is led by Superintendent Keith Arnaud and Deputy Attorney General Philip Galea Farrugia. Lawyers Jason Azzopardi and Therese Comodini Cachia are appearing as parte civile for the Caruana Galizia family. Magistrate Rachel Montebello is presiding. Kurt Sansone
13:23 The doors to Hall 22 have opened and people are settling in. Kurt Sansone
13:22 In today's sitting we are expecting experts from Europol to submit the data extracted from Yorgen Fenech's electronic devices. The data was extracted by Europol and analysed by Maltese police together with Europol officials. Kurt Sansone
13:17 We have changed courtroom. The activity has now shifted to the criminal court, Hall 22. Kurt Sansone
12:58 Another sitting is still underway and so he is led out again. Kurt Sansone
12:56 Yorgen Fenech is led into the courtroom flanked by three guards. Kurt Sansone
12:41 The compilation of evidence against Yorgen Fenech is expected to start at 1pm. Kurt Sansone
12:40 Good afternoon. Kurt Sansone




More in Court & Police