Europol expert that unlocked Yorgen Fenech's mobile phone cross-examined

Europol expert testifies on how it took 'a few months' to crack the code to unlock Yorgen Fenech's mobile device as the compilation of evidence against him continues • Fenech is accused of masterminding Daphne Caruana Galizia's murder

16 June 2021, 10:01am
by Matthew Agius

4 min read

Alleged mastermind: Yorgen Fenech

It took “a few months” to crack the code and be able to unlock Yorgen Fenech’s mobile phone, a Europol expert has testified.

Cypriot expert Yulia Toma, who is seconded with Europol, said the unlocking process was autonomous and the system tries millions of password combinations.

“In the worst-case scenario, it can take up to 30 years… We succeeded after a few months,” she testified in court on Wednesday.

Toma was cross-examined by Fenech’s defence lawyers as the compilation of evidence hearings continued in front of Magistrate Rachel Montebello.

Toma had been tasked by her superiors to carry out the initial extraction and unlocking process at Europol headquarters in The Hague, Netherlands, on Fenech’s mobile phone.

She also carried out the same process on a mobile phone belonging to a ‘captain’, believed to be the captain of Fenech’s yacht.

Fenech was arrested on the Gio in November 2019 just after the yacht departed Portomaso Marina.

Toma told the court the devices were kept in a Faraday room, which isolates them from radio frequencies. The Faraday room is accessible to several staff members at Europol, the witness said.

She explained that a forensic image is taken of a device, which is a bit by bit copy of the exhibit. This copy is used for analysis purposes, she added, so that the original exhibit can be preserved.

Asked by defence lawyer Charles Mercieca why the analysis is not done on the original device, Toma said it is best practice to work on the image. “It is to preserve the integrity of the device. That is why we were working on the forensic image,” she replied.

Earlier, the court heard the testimony of retired police officers who had been involved in Fenech’s arrest and on the day of the murder.

A former officer who formed part of the Drugs Squad testified that he had been assigned to arrest two men on board a vessel that had been stopped by the AFM at Portomaso Marina.

The witness said Fenech and the yacht captain were on board. Fenech was informed that he was arrested.

The officer testified that when he identified himself as part of the drugs squad, Fenech replied: “It’s better because we won’t take long.”

The police then told him he was being arrested in connection with the homicide of Daphne Caruana Galizia.

Background

Fenech is charged with masterminding the Daphne Caruana Galizia murder.

The evidence against Fenech primarily rests on the testimony of Melvin Theuma, the middleman in the murder. Theuma, who had secretly recorded various conversations between himself, Fenech and others, was given a presidential pardon in 2019 to tell all.

Daphne Caruana Galizia, an investigative journalist, died in a car bomb explosion outside her home in Bidnija in October 2017.

Theuma has testified that Fenech told him to make arrangements with the Degiorgio brothers to get rid of Caruana Galizia because of information she was going to publish about his uncle Ray. However, Theuma said that he later understood that the information was related to Fenech and not his uncle. Theuma told investigators he did not know what this information was.

Theuma got in touch with Alfred Degiorgio and a price of €150,000 was agreed for Caruana Galizia's murder. Theuma gave the go-ahead for the murder after the 2017 general election result when Fenech told him to "get on with it".

Alfred, his brother George, and their associate Vince Muscat were arrested in December 2017 and charged with carrying out the murder.

In February this year, Muscat admitted guilt and was sentenced to 15 years in prison after a plea bargain agreement. Proceedings against the Degiorgio brothers are continuing.

Magistrate Rachel Montebello is hearing the compilation of evidence against Fenech.

The prosecution is being led by Superintendent Keith Arnaud and Inspector Kurt Zahra, assisted by the Attorney General.

The defence lawyers are Marion Camilleri, Gianluca Caruana Curran and Charles Mercieca.

Lawyers Jason Azzopardi and Therese Comodini Cachia are appearing parte civile for the Caruana Galizia family.

12:27 That's it for today. Thank you for following. A summary of proceedings will follow shortly. Kurt Sansone

12:25 The next sitting is 27 July between 10:30am and 3pm. Kurt Sansone

12:25 The court tells the witness to provide a copy of the code of conduct. Arnaud asks the court to order the witness to write down the passcode to the devices, behind closed doors. The defence objects, but is overruled. Kurt Sansone

12:24 Mercieca says he has no further questions for the witness at this stage. Kurt Sansone

12:24 The witness is shown a document, which she says is the previous authorisation, signed by the executive director of Europol. Mercieca points out that at the top, there is a Sienna message. “It was the Sienna that the Maltese police used to ask her to testify in this sitting,” she replies. Kurt Sansone

12:13 Mercieca accuses the witness of keeping the devices for 10 months when she was not authorised by a Maltese court. “You are not correct,” says the witness, adding that she had been added to the list of experts some weeks after the first list was issued. Kurt Sansone

12:12 Toma says she cannot just do this in the middle of a court sitting. She will be asked to provide her copy of the code of conduct in the next sitting. Kurt Sansone

12:12 Mercieca asks her for a copy of the code of conduct for Europol officers. She doesn't have one on her and so is shown Mercieca's copy. The code is in the public domain on the Europol website. The witness is asked to confirm that it is the code which binds seconded national experts. Kurt Sansone

12:04 Toma says her superiors had told her to stop working on the devices because she was not mentioned in a Maltese court decree, authorising the experts to analyse them. Kurt Sansone

12:03 The sitting's allotted time has run out, but Mercieca hasn't finished his cross-examination. The lawyers and court discuss the issue. The sitting continues. Kurt Sansone

11:54 Toma explains that after the unlocking and before the extraction, the phones were always in the Faraday room. Up to that point she managed to perform the partial and SIM card extractions. Kurt Sansone

11:53 Toma had been asked to stop at a point during the extraction and hand over to another colleague, the lawyer says. He is referring to what Toma had testified in a previous sitting. Kurt Sansone

11:52 Toma: “I told it to my line manager.” Kurt Sansone

11:52 Mercieca: “When you got the code, who did you tell?” Kurt Sansone

11:52 Mercieca asks her to give him the password used on the phone. The court says this will not be published. “I can write it if you like, but I will not say it,” Toma says. Mercieca says it is enough for him to hear that she obtained it herself. Kurt Sansone

11:51 Toma says that after the phone was unlocked, she tried to make the full extractions of the data. Kurt Sansone

11:50 Mercieca says that it is not possible for her to confirm that aside from the moments when she was inside the Faraday room, the phone was not moved. Kurt Sansone

11:40 Mercieca asks how the exhibits were moved. She says that the items were placed in an exhibit bag. Kurt Sansone

11:38 The exhibits were handed to her colleague Giuseppe Totaro in her office, in the same way she had received them. The Faraday room was three floors away, explains the witness. Kurt Sansone

11:38 Toma says that she checked the exhibits every day. “When I am available, I go and check my exhibits. The unlocking process needs to be observed every day because it could stop for unknown reasons,” she explains. Kurt Sansone

11:34 “It is not possible to be in the Faraday room for more than 24 hours,” she says. Kurt Sansone

11:34 The lawyer asks about an illegible part of the notes, but she says it refers to a forensic tool and so she cannot tell the court this. The lawyer attempts to get her to explain how the unblocking process works, but is rebuffed by the witness, who explains that she cannot do this. Kurt Sansone

11:33 Mercieca asks about some details which she had written in shorthand, in Greek. They deal with the time taken to carry out extraction - 50min, she says. This dealt with preliminary stages, not the entire process, Toma elaborates. Kurt Sansone

11:23 Mercieca asks if her previous stay in Malta could have helped her identify devices as ‘businessman’ and ‘captain’. “No, they are not connected,” she replies. Kurt Sansone

11:22 Toma is brought back inside the courtroom. “I think it was not related,” she says. Kurt Sansone

11:22 Deputy AG Philip Galea Farrugia says the question is far too open. The lawyers talk over each other. The matter is finally settled and she will only be asked whether the reason for her previous visit was related to the murder of Daphne Caruana Galizia. Kurt Sansone

11:21 The defence says it needs to establish the reason why the witness came to Malta and whether it was to do with the case. Kurt Sansone

11:20 Arnaud stands up to protest. The court says it will not allow the question. The witness is sent out until this is thrashed out. “Don't put words into the mouth of the witness,” says the court. Kurt Sansone

11:20 Toma explains that she had come to Malta previously on another case and thought they were similar. Mercieca asks her what the previous case was. “Was it to do with Caruana Galizia?” Kurt Sansone

11:19 Mercieca moves on, asking her about her notes which stated 'same case as my previous case'. Kurt Sansone

11:19 Toma labelled the exhibits as ‘businessman’ and ‘captain’. The court asks if apart from Sami, someone else had spoken to her about the phone. She says she cannot recall where she got the information from. She also cannot recall why she labelled them that way. Kurt Sansone

11:05 The forensic tools used by the lab are made by companies, points out Mercieca, which were not part of Europol. Kurt Sansone

11:03 The unlocking process is an autonomous process, which tries millions of password combinations, Toma says. “In the worst-case scenario, it can take up to 30 years,” she adds. They succeeded after a few months. Kurt Sansone

11:01 Toma was alone when the unlocking process was started. Nobody assisted her, she says. She was in the Faraday room. Kurt Sansone

10:59 Mercieca presses her on the dates. She says that she keeps notes of the examinations she performs and asks permission to check them. Permission is granted. Toma says she started at 11:30pm and finished at 3am the next day. Starting at 4am on the other one, she continued till lunchtime the day after receiving the items. The witness presents a copy of her personal notes after making sure that the software tools used are not revealed in them. Kurt Sansone

10:53 The partial extraction was successful and data was extracted from the phone, Toma explains. She had started working on the phone as soon as she received the exhibits at 11:30pm. The unlocking process began immediately after the partial extraction. Kurt Sansone

10:52 Asked if this timing is normal, she says it was because a colleague of hers was travelling from Malta to The Hague at that time. Kurt Sansone

10:52 She says that she received the item in her office in an evidence bag. Toma says that if the best practices are followed it will not affect the integrity of the phone. When she received the phone, she didn't know if it was in flight mode or not. Her colleague Sami had handed it over to her at 11:30pm. Kurt Sansone

10:50 Toma: “I received two exhibits. One was unsealed and one was not. The unsealed one was an iPhone XS Max A2101. The first thing I do is to physically examine the exhibits for external issues such as damage. The first exhibit was slightly damaged, locked with a 6-digit passcode and in flight mode. The second one was sealed and was in flight mode. The first item was switched on but locked.” Kurt Sansone

10:43 Mercieca asks about the condition of the device when she received it. Kurt Sansone

10:41 “You need a badge to access the room,” says the witness. “Around 10 people have a key card,” she adds, when asked about it. She was not aware of any logging procedures regarding visits to the Faraday room. Kurt Sansone

10:40 Mercieca asks how many Faraday rooms Europol had, but is overruled on the objection of the prosecution. Kurt Sansone

10:39 The exhibit was examined in a Faraday room, which isolates the device from radio frequencies. It is in Europol HQ and is accessible to several staff members, the witness says. Kurt Sansone

10:37 Mercieca asks if she had a way of verifying if anyone had accessed the device before she worked on it. Toma says she did not. Kurt Sansone

10:37 The expert explains that it is best practice to work on the image. “It is to preserve the integrity of the device. That is why we were working on the forensic image,” she says. Kurt Sansone

10:36 Mercieca: “Why not use the original device?” Kurt Sansone

10:35 Toma: “It is necessary because it is a bit by bit copy of the exhibit. Then when you want to analyse it you are not working on the original exhibit anymore, you are working on the image.” Kurt Sansone

10:35 Mercieca asks why a forensic image is necessary. Kurt Sansone

10:34 Mercieca asks if she created a forensic image of the phone. She explains that it is called a “partial extraction”. Toma says she did not make any analysis. “After the partial extraction, I proceeded to the unlocking process. IT is a multi-task process,” she says. Kurt Sansone

10:33 She affirms this. Kurt Sansone

10:33 Mercieca: “In the last sitting you told us that you had been told to conduct an immediate forensic examination.” Kurt Sansone

10:30 Mercieca asks her to confirm the contents and that she had presented it herself. Toma confirms the document is the same she had submitted. Kurt Sansone

10:28 Defence lawyer Charles Mercieca cross-examines. He shows her documentation which she had exhibited to the court. Kurt Sansone

10:27 She tells the court that she is a seconded national expert in the digital forensic lab. Kurt Sansone

10:26 Next up is the Europol expert who testified in a previous sitting, Yulia Toma. Kurt Sansone

10:23 Another sergeant, stationed at Mosta, takes her place on the stand to exhibit her report on the murder. She had gone to the scene of the murder and the report details all of what she had seen. Kurt Sansone

10:22 The police officer steps off the witness stand. Kurt Sansone

10:21 The Maya was the vessel on which George Degiorgio was on when he detonated the bomb that killed Caruana Galizia. Kurt Sansone

10:21 He also exhibits surveillance footage of the Maya entering the harbour and docking near the potato shed in Marsa. This was taken after the murder, in November. The witness had created a timeline of the Maya's movements with the photographs. Kurt Sansone

10:20 After the murder, part of his duties was the collection of CCTV from court experts. Some of them were from the Grand Harbour. Stills of vessels of interest were taken. He presents a 31-page report of still frames from the footage. Kurt Sansone

10:19 Another former officer, a sergeant takes the stand. He retired from the police force in 2019. At the time, he was a CID sergeant with Arnaud. Kurt Sansone

10:17 Lawyer Gianluca Caruana Curran cross-examines him. The witness says that Fenech did not have a bad attitude during the arrest and searches. Kurt Sansone

10:15 The officer had helped in the search of Fenech's boat and his residence at Portomaso. Kurt Sansone

10:15 Yorgen Fenech was informed that he was arrested. The officers told him they were from the drugs squad and Fenech had said “it’s better because we won’t take long”. They then told him he was being arrested in connection with the homicide of Daphne Caruana Galizia. Kurt Sansone

10:13 A former police constable who worked at the Drugs Squad testifies. He left in 2020. His involvement in the case was in the arrest of Fenech. Inspector Kevin Pulis had informed the arresting officers that there was a vessel in Portomaso that had been stopped by the AFM and that the officers had to go make arrests. He says that there were two men on the vessel, Yorgen Fenech and the skipper. Kurt Sansone

10:12 Superintendent Keith Arnaud says he has two former officers to testify and then a Europol expert for cross-examination. After that, he says Matthew Caruana Galizia will take the stand. Kurt Sansone

10:09 Magistrate Rachel Montebello enters the courtroom and the sitting begins. Kurt Sansone

10:08 Yorgen Fenech steps into the courtroom accompanied by prison guards. While we wait for the magistrate to emerge from chambers, Caruana Curran and Mercieca move over to sit next to Fenech. Kurt Sansone

10:06 Our senior court reporter Matthew Agius tells us that Europol representatives are expected to testify in today’s sitting. Kurt Sansone

10:05 So far there is no sign of Yorgen Fenech but prosecuting Superintendent Keith Arnaud is inside the courtroom as are Caruana Galizia family lawyer Jason Azzopardi and defence lawyers Gianluca Caruana Curran and Charles Mercieca. Kurt Sansone

10:03 Good morning. Kurt Sansone

Matthew Agius is Senior Reporter on Law and Court Affairs at MaltaToday. He is also a Leg...