Yorgen Fenech compilation of evidence: Europol experts cross-examined

Europol experts are cross-examined by the defence in the compilation of evidence against Yorgen Fenech, the alleged mastermind of the Daphne Caruana Galizia murder

2 December 2020, 10:07am
by Matthew Agius

2 min read

Daphne Caruana Galizia murder suspect Yorgen Fenech

Two Europol officials were cross-examined by Yorgen Fenech's defence team in a sitting that focussed on procedural measures adopted by the foreign experts in extracting data from electronic devices.

The cross-examination came two days after the Europol experts submitted in court hard drives containing four terabytes of data extracted from various electronic devices confiscated by the police in November 2019.

Fenech's compilation of evidence is expected to continue on 12 January. He stands accused of masterminding the murder of Daphne Caruana Galizia.

The data was extracted from mobile phones, laptops, SIM cards and other devices lifted from the Portomaso business tower and Fenech’s yacht, the Gio when he was arrested in November 2019. A team from Europol had come to Malta and granted sole access to a room at the Malta Security Service quarters from where they worked to extract data from the devices.

Today's cross-examination revealed nothing new and so far, the contents lifted from the devices remain under wraps with the court warning all parties not to share the information with third parties unrelated to the case.

The evidence against Fenech primarily rests on the testimony of Melvin Theuma, the middleman in the murder. Theuma, who had secretly recorded various conversations between himself, Fenech and others, was given a presidential pardon to tell all last year.

Magistrate Rachel Montebello is hearing the compilation of evidence against Fenech.

The defence lawyers are Marion Camilleri, Gianluca Caruana Curran and Charles Mercieca.

The prosecution is being led by Superintendent Keith Arnaud and Inspector Kurt Zahra, assisted by the Attorney General.

Lawyers Jason Azzopardi and Therese Comodini Cachia are appearing parte civile for the Caruana Galizia family.

16:14 That's it for today. Thank you for following. Kurt Sansone

15:58 The next sitting is on 12 January at 10am. Kurt Sansone

15:54 A bail decree was not received by the parties, despite being in the system. Bail appears to have been rejected as the accused is still in custody. Kurt Sansone

15:48 The court and parties are thrashing out the next procedural steps. Kurt Sansone

15:47 “That's all,” Zahra says. Kurt Sansone

15:47 The witness replies in the negative. Kurt Sansone

15:47 The witness is shown exhibit delivery papers. Were there other exhibits he gave to the inquiring magistrate? Kurt Sansone

15:46 Meanwhile, Inspector Zahra is to ask a few questions. Kurt Sansone

15:46 Mercieca says the witness' deposition is suspended to avoid a repeat of what happened with the Schembri testimony, where the defence says, it was deprived of an opportunity for cross-examination. The court upholds the request and allows the prosecution to continue its questioning next time. Kurt Sansone

15:38 Mercieca is arguing that the data is not isolated, while the witness is insisting it is. Kurt Sansone

15:37 Petrou: “It is password protected and protected by log-on credentials.” Kurt Sansone

15:37 Mercieca: “How is access granted?” Kurt Sansone

15:37 Petrou: “I will check.” Kurt Sansone

15:37 Mercieca: “Who has access to the data from your team with regards to this case?” Kurt Sansone

15:27 Mercieca asks the witness to prepare the SIENA messages and a list of all the exhibits he has worked on concerning the explosion in Bidnija for the next time he is summoned. Also, the list of magistrates he has spoken to about the case. Kurt Sansone

15:25 The court says that today's sitting was about a different task for which the witness was appointed, not the one two years before. Kurt Sansone

15:22 Mercieca says the defence is finding difficulty in accessing evidence submitted by Petrou in other parts of the investigation. Kurt Sansone

15:22 An issue on whether the questioning is relevant emerges. Lawyers Marion Camilleri and Gianluca Caruana Curran say the recordings of Melvin Theuma are an integral part of these proceedings. Magistrate Montebello says that for Melvin Theuma, the inquiry is separate and the process verbal is not part of these acts. Kurt Sansone

15:10 Petrou: “I don't recall. I can't remember.” Kurt Sansone

15:10 Mercieca: “Did you extract any information from exhibits relating to Melvin Theuma?” Kurt Sansone

15:10 But the witness says he had not worked with her on this case. Kurt Sansone

15:09 Questions turn to Yulia. “She is a seconded national expert,” Petrou says. “We are on the same level, under the team leader.” Kurt Sansone

15:08 Lawyer Gianluca Caruana Curran sits down next to the accused and exchanges some words with him. Kurt Sansone

15:08 “Sami and I are in the same team. Normally, we don't send SIENA messages in the same team,” Petrou says in response to a question as to why the information was transmitted verbally. Kurt Sansone

15:07 The Europol expert says he was told about the sitting about two weeks ago. The information was given verbally, he says. Kurt Sansone

15:06 The magistrate notes that the cross-examination is on the examination in chief. Kurt Sansone

15:06 The court has had enough of Mercieca, who says the defence didn't know if Europol was going to testify. “Come on, come on. This is an insult. The defence has known for a long time that the Europol experts were coming,” says the magistrate. She stops him from trying to extract information from the witness. Kurt Sansone

15:05 Petrou: “I do not remember because I was not asked to prepare for this.” Kurt Sansone

15:04 Mercieca: “Did you receive a SIENA message relating to the case in 2017?” Kurt Sansone

15:03 The lawyer now asks about the SIENA messages. “I receive only the messages pertinent to my job,” says the witness. Kurt Sansone

15:03 Petrou says that from 2019 he gave his report. Before that, he doesn't remember. The court points out that the man had not been asked to prepare for things which he didn't testify about himself. “If anything, summon the witness as a witness for the defence,” the magistrate says. Kurt Sansone

15:01 Mercieca: “With regards to this case what other exhibits did you examine from 2017 today?” Kurt Sansone

15:00 Mercieca asks if the Europol team had presented anything before Magistrate Neville Camilleri, who is leading the inquiry into the murder of Daphne Caruana Galizia. “No,” Petrou replies. Kurt Sansone

14:50 Petrou: “I am not aware if my colleagues reported to another court.” Kurt Sansone

14:49 Mercieca: “Are you aware if your colleagues reported to another court?” Kurt Sansone

14:42 Petrou: “This one.” Kurt Sansone

14:42 Mercieca: “How many courts did you report to?” Kurt Sansone

14:41 Petrou says that no one else from Europol arrived with him on the 29th. Kurt Sansone

14:40 Petrou: “To this court... If I'm not mistaken it was with Mr Camilleri.” Kurt Sansone

14:40 Mercieca: “Who did you report to with regards to courts?” Kurt Sansone

14:37 Petrou says Sami and he joined Europol on the same day… Sami was nominated as single point of contact with the Maltese authorities. Kurt Sansone

14:36 Mercieca asks how he knew what to bring with him to Malta. “I've been doing this job for 17 years... I know what will be needed,” he replies. Kurt Sansone

14:35 Before the SIENA message was received on 21 November, he was informed informally of the request for assistance. Petrou arrived on the 20th late in the evening in 2019. “I wasn't even present for the house searches, in fact,” he says. Kurt Sansone

14:31 Witness doesn't know if the SIENA messages are still in the system. It is not his area of expertise. Kurt Sansone

14:28 AP weapons and explosives received the Maltese request for assistance. IT was later assigned to his team, he says. Kurt Sansone

14:27 He started working with Europol in 2013. Petrou is a senior specialist, forensic examiner and investigator. “My job is to perform forensic actions on digital exhibits,” he says. Kurt Sansone

14:22 Petrou has been in law enforcement since 1996. He joined straight out of high school, he says. Kurt Sansone

14:21 Europol expert Constantinos Petrou is called to the stand next. He also testified in last Monday’s sitting. Kurt Sansone

14:21 Totaro's cross-examination is over. He leaves the courtroom. Kurt Sansone

14:21 Totaro: “Sami Armoyne, my colleague provided the exhibits. Apart from those provided by Yulia Toma.” Kurt Sansone

14:20 Totaro's deposition continues, with him confirming the corrections which he has just made. Mercieca's cross-examination of Totaro continues. He asks who provided the exhibits. Kurt Sansone

14:19 While the court is dictating a note to the registrar, Fenech stands up and huddles with his lawyers. “Don't forget,” are his closing words. Kurt Sansone

14:19 The request is granted and Inspector Zahra takes over. Kurt Sansone

14:15 Arnaud asks for permission to leave the hall as he is required elsewhere. The defence pretends to object, in jest. Kurt Sansone

14:14 Arnaud suggests that the witness correct the report today and sign. Defence says he should present an updated report. Court says expediency requires otherwise. Mercieca insists that the mislabelling of the hard drive “doesn't appear to be a lapsus calami” but a conscious decision by the Europol team. The defence lawyer is requesting that the hard drives having the serial numbers indicated in the report are presented in court. Meanwhile, Totaro is correcting his report. Kurt Sansone

14:05 More document serial numbers and corresponding exhibits are read out. Kurt Sansone

14:04 Totaro: “When I finished the extraction. It is in the log of the hard drive.” Kurt Sansone

14:03 Arnaud: “Do you know the date when you put the exhibit safe?” Kurt Sansone

14:03 Totaro: “In the same condition it is now. It was always separated from the iPhone.” Kurt Sansone

14:03 Arnaud: “With regards to the exhibits, can you tell us the condition of the SIM card when it was received and when it was placed inside the safe at Europol?” Kurt Sansone

14:02 More questions about the chain of custody follow. Kurt Sansone

14:01 Arnaud: “The witness is the provider.” Kurt Sansone

14:01 The court points out that the report also states that it cannot be used in judicial proceedings without the permission of the provider. Kurt Sansone

14:00 The prosecuting superintendent is asking about the code numbers on the report. “They are assigned to the SIENA report,” Totaro says. Kurt Sansone

13:58 Arnaud asks some questions now. Kurt Sansone

13:58 Totaro: “No… to the best of my knowledge only I and the team members had access to this room. The exhibits stayed in the room.” Kurt Sansone

13:57 Merceca: “Do you know the locality?” Kurt Sansone

13:57 He is asked about the room where he saw the evidence. “It is in the Malta Secret Services location,” he replies. Kurt Sansone

13:57 Totaro mentions his team members again. “I don't remember any other interaction. I remember there was an analyst from Europol but I didn't interact with him.” Kurt Sansone

13:56 Mercieca: “During your stay in Malta – two or three days - which other Europol members did you interact with?” Kurt Sansone

13:50 Totaro: “I arrived with Konstantinos. As far as I remember Sami was already in Malta. Yulia, I don't remember if she was already in Malta.” Kurt Sansone

13:50 Mercieca: “Who else did you arrive with from your colleagues?” Kurt Sansone

13:49 Totaro: “With regard the exhibits in question, no. I had them after 26 October 2020.” Kurt Sansone

13:48 Mercieca: “Did you, at any point before 26 October 2020, interact with the exhibit, being Fenech's mobile phone?” Kurt Sansone

13:47 The witness is shown two boxes containing hard drives. He looks at the hard drives and confirms that these are not the ones mentioned in the report. Set C 1 and 2 correspond to what is written in the report, he says. Kurt Sansone

13:47 The court session resumes and Magistrate Montebello emerges from her chambers. Kurt Sansone

13:25 Mercieca informs the court that they would like to suspend the cross-examination until the hard drives are brought back and rechecked by the expert. Kurt Sansone

13:18 There appears to be a mistake on the nomenclature used for the data sets, which has led the defence to question the existence of the devices on which they are. Kurt Sansone

13:14 Mercieca says that his question relates to the actual hard drives. Kurt Sansone

13:12 Totaro: “Yes, I confirm.” Kurt Sansone

13:12 Mercieca: “Do you confirm that set A and set B are the same, which you exhibited with your colleagues two days ago?” Kurt Sansone

13:07 Mercieca reforms his question. Does the witness confirm that he had exhibited certain, identified, exhibits? “It was getting lost in translation,” says Mercieca. Kurt Sansone

13:05 An argument erupts between the defence and prosecution after Mercieca tells Inspector Kurt Zahra not to interfere (tindaħalx), when he objects to a question made to the witness. Kurt Sansone

13:01 Mercieca asks for a copy of a set of data relating to a table in the report. The witness says he had submitted it in his report two days ago. Kurt Sansone

12:58 Mercieca asks who could give a list of people who accessed the device. The witness says according to the delivery paper, his team leader Sami and the other analyst. “It was kept in the safe, which is accessible to the digital forensic unit team,” he says, answering a question by Merciceca. Kurt Sansone

12:54 The bags are handed to the court registrar, who hands them to the expert witness. He confirms that the number of the evidence bag is correct. Kurt Sansone

12:53 Mercieca asks if he can open an evidence bag, making as if to open it. “Wait (stenna),” says Yorgen Fenech. Kurt Sansone

12:52 Totaro: “The exhibits are always at the Europol HQ. They cannot leave the HQ.” Kurt Sansone

12:52 Mercieca: “So you don't know what your colleague did with the phone.” Kurt Sansone

12:52 He says that for specific details his colleague would be able to answer better. Kurt Sansone

12:51 Totaro: “I can say that nobody accessed the phone after the 26 October.” Kurt Sansone

12:51 Mercieca suggests that he could not tell the court how many people had accessed the phone. Kurt Sansone

12:47 Totaro says he had but the phone was worked on at the Europol HQ over the span of two or three days. Kurt Sansone

12:44 Mercieca: “Did you work from home during the pandemic?” Kurt Sansone

12:44 The witness says he hadn't spoken about the phone or the case directly. Kurt Sansone

12:43 Mercieca: “Did you exchange words with your colleague when she handed you the phone in the open evidence bag?” Kurt Sansone

12:42 The Europol expert says the phone was kept isolated in flight mode. Kurt Sansone

12:40 The phone was not allowed to be turned off after that and would be continuously charged, Totaro explains. Kurt Sansone

12:39 Mercieca asks if the expert could determine whether it was the first time the phone was worked on when he saw it the first time. Totaro says he was told that the expert he got it from was going to work on it. He was not aware of any previous operation on it. “My colleague can report on her activities on it… Best practises dictated that once a phone is copied, it must be kept on and charged after isolation,” he says. Kurt Sansone

12:29 The defence continues to chip away, asking about the equipment and software. Superintendent Keith Arnaud objects, saying that these proceedings are not meant to be revealing Europol's operational capabilities. Meanwhile, the deputy registrar returns with the exhibited phones and hands them over to the defence. Kurt Sansone

12:24 Mercieca asks who else had worked on the phones besides him. Totaro names a colleague who handed them to him on 26 October. “These are two iPhones with the SIM detached, according to best practises in digital forensics,” he says. Kurt Sansone

12:22 Mercieca is essentially challenging the chain of custody of the exhibits. He asks the court for the mobile phones and SIM cards exhibited by the witness last Monday. He continues his cross-examination on other topics while the court messenger brings the items to the courtroom. Kurt Sansone

12:13 Totaro says it was not possible to unlock some of the exhibits so he took the decision to bring the devices back to Europol where larger computers would be used to crack the device security. Kurt Sansone

12:03 The defence is asking about everything linked to the report, from evidence bag numbers to data acquisition to data hash values. It makes for dreary following. Kurt Sansone

12:02 The witness asks to be allowed to sit down because of pain. This is granted. Kurt Sansone

12:02 A hash value is a unique number used as an identifier for data. Kurt Sansone

12:01 He is being asked about data hash values. Kurt Sansone

12:00 The witness confirms that the procedure was not filmed. Kurt Sansone

12:00 Totaro: “In the room provided by the Maltese authorities.” Kurt Sansone

11:59 Mercieca: “Where did you carry this out?” Kurt Sansone

11:59 Totaro: “Me.” Kurt Sansone

11:59 Mercieca: “Who physically analysed them?” Kurt Sansone

11:58 Totaro: “I photographed them. Fenech was not present.” Kurt Sansone

11:58 Mercieca: “Who photographed the exhibits? Was Fenech present?” Kurt Sansone

11:58 Totaro: “I can't say who sees then because I received it from my colleague Sam.” Kurt Sansone

11:57 Mercieca: “Your report refers to exhibits seized in 2019. Who sees the exhibits?” Kurt Sansone

11:57 Mercieca is chided by the court for not wearing his mask. Kurt Sansone

11:56 The reply is incomprehensible without having the report in front of you. Kurt Sansone

11:56 A second and third request are also mentioned in the report. Mercieca asks from whom did these requests come. He refers to the message in the requests. Kurt Sansone

11:55 Totaro: “It came from the Maltese police Europol Unit.” Kurt Sansone

11:54 The report mentions a request. “Who did it come from?” Mercieca asks. Kurt Sansone

11:54 Mercieca asks about the second SIENA message but the witness doesn't recall when it was received. It had information and referred to the first message, Totaro says. “It basically said what was reported in the report,” he adds. Kurt Sansone

11:53 Totaro: “I have access. I don't know who else has access to this message.” Kurt Sansone

11:53 The message was referring to SIENA messages on the background section of his report. It was sent on 21 November 2019. Mercieca asks who had access to it.  Kurt Sansone

11:52 Totaro: “I saw this message.” Kurt Sansone

11:52 Mercieca: “Did you see it?” Kurt Sansone

11:52 Weapons and explosives and digital forensics received the message in question, the witness continues. Kurt Sansone

11:50 Mercieca asks if law enforcement has access. The witness explains that not all law enforcement because access is based on the role. Kurt Sansone

11:50 Mercieca asks who has access to the system. “Do I have access? No,” Totaro says, adding that his access is through his role at Europol. Kurt Sansone

11:48 Mercieca asks where the data was held. “The extraction of the data was done on hard drives I had with me,” the witness replies. He explains that a SIENA message is a secure information exchange between Europol and member states. Kurt Sansone

11:48 Totaro: “I remember that Konstantinos Petrou told us to go to the court… I only met the magistrate once, when I delivered the exhibits not the report.” Kurt Sansone

11:47 Mercieca: “Who told you to report to this magistrate?” Kurt Sansone

11:47 Totaro: “The only contact was when we delivered the exhibits, before leaving Malta in 2019. It was a male magistrate that I delivered the report to but I didn't remember his name.” Kurt Sansone

11:46 Mercieca: “When you were in Malta did you have any contact with the magistrate who nominated you?” Kurt Sansone

11:45 Totaro: “The last one was 26 November 2020, to finalise the report. So, the report was finalised on 27 November 2020.” Kurt Sansone

11:45 Mercieca: “When was the last extraction?” Kurt Sansone

11:45 Totaro: “Yes.” Kurt Sansone

11:44 “Let's talk about the extractions in your reports,” begins Mercieca. “You finalised the report after the extractions were carried out, correct?” Kurt Sansone

11:44 Torri is a former Europol employee. Totaro says he wasn't involved in the case. Kurt Sansone

11:44 Mercieca asks whether a Marco Torri was in the team. “No,” the witness replies. Kurt Sansone

11:43 Totaro says he liaised with Sammy Hermona who liaised with the Maltese police. In Malta, he worked with Petro and Torres. Kurt Sansone

11:42 “The office is in The Hague,” points out Mercieca. “Who did you liaise with in Malta?” Kurt Sansone

11:42 Totaro: “I don't recall the name. I just reported the nomination... I'm nominated to examine the exhibits that I received for this case 1292035461. It is related to the explosion mentioned in [the report]…” Kurt Sansone

11:41 The lawyer notes that on page 3 of the report it is indicated that he was nominated with the rest of the team by the inquiring magistrate. Kurt Sansone

11:40 Totaro: “It's when I finished compiling the report.” Kurt Sansone

11:39 Lawyer Charles Mercieca refers to Totaro's report, asking what the date on the cover refers to. Kurt Sansone

11:39 He is asked about his time in America. Totaro says he worked with NASA, the American space agency. He's been with Europol since 2018 and started on the Yorgen Fenech case in November 2019. Kurt Sansone

11:38 Europol expert Giuseppe Totaro is called to the stand. He is one of the Europol experts who testified in the last sitting. Totaro is asked about his background. He has a PhD in Computer Science and several masters in digital forensics plus a host of other certifications. He was a chief technology officer in the Italian police. Kurt Sansone

11:37 The court insists that the copies must be handed out in open court and not collected from the magistrate's chambers as suggested by Jason Azzopardi. The acts must be sent to the AG today, the magistrate says. “Nothing and nobody is going to change the procedure before this court. If need be we will wait till February,” she says. Kurt Sansone

11:36 There appears to have been a misunderstanding on the copies and who and when they are to be given out. Kurt Sansone

11:02 Lawyer Charles Mercieca says the defence didn't yet have the opportunity to see the content of the hard drives given to them by the experts. “We would like to have another opportunity to cross examine the experts as it is humanly impossible,” he says. Kurt Sansone

11:02 A knock on the door and the courtroom stands to attention. Magistrate Rachel Montebello emerges. Kurt Sansone

10:39 Yorgen Fenech has just entered the courtroom. He sits and converses with his lawyers as we wait for the magistrate to emerge from chambers. Kurt Sansone

10:19 In the last sitting on Monday, the court heard the testimony of three Europol experts, who also submitted hard drives with all the data extracted from Fenech's electronic devices. The acts of the case now contain 4 terabytes of data. Kurt Sansone

10:11 The lawyers and police investigators are already in Magistrate Rachel Montebello's courtroom. The court is currently tackling its scheduled cases first before the compilation of evidence begins. Kurt Sansone

10:09 Good morning. Kurt Sansone

Matthew Agius is Senior Reporter on Law and Court Affairs at MaltaToday. He is also a Leg...