Caruana Galizia murder case: FBI agents tell court killer SMS read '#REL1=ON'

Compilation of evidence hearing has ended for today

Magistrate Claire Stafrace Zammit has allowed two FBI agents to testify in the compilation of evidence, despite objections by the defence.

The agents, Richard Fennern and William Shute, take the stand. They are specialists in historical cell site analysis.

“Essentially what we do is take records generated by cell phone usage, we combine those records with the list of locations of the cellular towers and the combination of the two allow us to create a mapped image of where a cell phone call was made,” Shute said, adding he has been with the FBI for 20 years and conducting historical cell site analysis for 18.

FBI agent William Shute (Photo: Joe Lamberti/Courier-Post)

Shute had set up the CAST Cellular analysis survey team and had been participating in court proceedings since 2005.

Police lead prosecutor Inspector Keith Arnaud asked the agents to explain their report.

Agent Fennern said they were notified of the case on 16 October last year and on the 18 they came to Malta to start the investigations.

He explained that typically, cell sites have three equal sectors covering 120 degrees each. If the bomb had been detonated by a cellular component, he could help identify the device which did so.

The agents met with the Inspector and the cellular service providers as a first step. 

They identified 53 different Vodafone devices used between 2.58 and 3.03pm on the Vodafone network.

They then asked which of these devices were used again. From that information, one of the 53 was never used again.

Every device has an IMSI – an international mobile subscriber identifier – it identifies the phone within the cellular network. “It’s a unique number, it identifies one specific card.”

The 16 October activity was an incoming text message from 99684366 at 2.58pm, he explained.

The position of the text message was consistent with the area of the explosion.

The text message was decoded and it showed that the mobile phone number 99684366 sent a text message to 99683752 at 2.58pm and that message was "#REL1=ON".

Trigger mobiles were at sea and in Bidnija

The agents explained that phone 99684366 and the corresponding SIM card was placed in a device, which was utilised to top up the phone, rendering it active.

Around 3pm on 16 October there were texts from 99684366 to 99683752. At 2.19pm there was an outgoing call, followed by two top up texts, in turn followed by a confirmation of the top up.

Agent Fennern said they concluded that the numbers 99684366 and 99683752 were those utilised to detonate the device.

One was the telephone that sent the text message and the receiving number was a GSM module.

The mobile’s position was consistent with being at sea, whilst the GSM module was in Bidnija.

“It is our belief that there was another device that sent a message to notify the person at sea to send the text message that detonated the bomb,” Fennern said.

The numbers consistent with being in the areas involved with the detonation only communicated with one another and 99088823, he added.

“It is our opinion that numbers ending 8820 8824 and 8823 were involved in the placing and detonation of the device, the bomb to which the GSM module was attached to," Fennern said.

The agent is showing the court diagrams of the cell tower coverage and how he triangulated the position of the mobile numbers.

The agents ended their testimony and cross-examination will be done in another sitting.

Which number did what?

• Based on the initial tower dump and the location of the bomb detonation, the FBI agents concluded that: Number 99683752 was connected to the bomb device and acted as a detonator.
• Based on the text message content, 99684366 sent the message to detonate the device.
• The mobile 99088820 acted as a lookout in Bidnija. He called 99088824 in order to execute the detonation.
• Based on a review of records, it is believed that number 99088820, 99088824 and 99088823 worked together to execute the placement and detonation of the device.
• Numbers 99684366 and 99088824 were co-located in the same areas on 16 October.
• Based on the tower dump information for number 99684366 on the 16 October it is believed that number 99623741 subscribed to George Degiorgio was also co-located to the numbers 99684366 and 99088824.
• Telephone number 99328493 believed to be associated with Alfred Degiorgio and number 99088820 were co-located throughout the usage period of number 99088820.

Europol explosives specialist testifies

Next on the witness stand was a Croatian explosives expert from Europol, who said his assistance was called for by the Maltese authorities on 14 November. 

“We had a joint meeting with police investigators, AFM representatives and the lead magistrate in the case. Magistrate Anthony Vella appointed me as a court expert,” he said.

The Croatian said he had 24 years of experience as a policeman and 22 years in explosive device specialisation. He has been with Europol since 2014.

He carried out post-blast examination of the vehicle and on debris collected from the scene.

The three men charged of Daphne Caruana Galizia's murder

“I just want to clarify that I was not involved in the crime scene investigation… we were involved almost a month after the event,” he said.

He said the main characteristic of the vehicle incident was that it was highly damaged by fire and the majority of the potential evidence was destroyed.

Explosive located underneath the driver's seat

“The damage was caused by a chemical explosion, not a fuel-air explosion… according to the findings, the explosion clearly took place inside the vehicle. Precisely, the explosive charge at the time of the explosion was located on the floorboard under the driver’s seat,” he said.

Regarding the type of explosive used, he said, it was high explosive, causing “high blast shockwave and high blast overpressure in the surroundings, which had a high shattering effect. It is typical of a military explosive, such as TNT or hexogen.”

The expert said that between 300g and 400g of TNT equivalent explosive was used. “If it was TNT mixed with ammonium nitrate the explosive would be heavier,” he said.

The expert said the likelihood of death was almost 100% from the placement of the bomb. He could neither confirm nor exclude the possibility of other incendiary charges being used.

Bomb device crafted to direct blast upwards

Giving a detailed description of the explosive device, the Europol expert said three types of metal fragments were found.

The bomb had a 5mm metal plate as a base and no top plate. This was probably intended to direct the blast towards the target, who was sitting just above the bomb.

“A thick metal bar went around the edge of the metal plate and this showed evidence of welding and grinding or sanding of the face, itself an indication that it was made specifically for this device,” he added.

Bars were screwed into the base and metal bolts were found on the scene, which were assessed as being part of the improvised explosives device (IED). “They had brass insert nuts attached to the bottom.”

The expert said that parts of a plastic box were also found, likely to have held the activation system, or less likely the explosive charge.

“On the outer part of the device was an electronic relay – an on/off switch – controlled by a GSM module. We haven’t found an exact match with the type or model of the GSM module and a number of electronic parts could not be identified due to the blast destruction,” he said.

Ball bearings added to mislead

Three ball bearings were also found on the crime scene but the expert believes they were not intended to intensify the fragmentation of the device but added to mislead the investigation.

“This has happened in some bomb attacks. The device was an improvised explosive device, not ready to use device, like military ordinance. It was clearly designed and constructed by the bomb maker from various regularly available material or some restricted companies.” 

The expert concluded that the explosion was clearly intended to kill the driver and anyone else in the car. “It is criminal bomb attack. We can clearly exclude every type of suicidal or accidental explosion. Device design and placement was clearly to kill the driver and anyone else in the vehicle.”

Earlier

Lawyer Martin Fenech has requested the protection of the court after allegations made by Nationalist Party MP Jason Azzopardi, which he said could “impinge on his client’s rights”.

Fenech was referring to a parliamentary speech, Azzopardi delivered last month in which he alleged that a police officer informed the accused of the massive security operation last December in which they were arrested.

“It’s not fair that a criminal case is heard in Parliament so that he uses parliamentary privilege and nobody can speak to him. I’m not going into the merits of what he said, but I cannot rebut them due to parliamentary privilege,” Fenech told the court this morning.

The compilation of evidence against George Degiorgio, Alfred Degiorgio and Vince Muscat, is continuing today.

Fenech requested the protection of the court as he objected strongly to the fact that the MP, who is also a parte civile lawyer for the Caruana Galizia family, used parliamentary privilege to list facts of the case at the expense of the rights of the accused.

Azzopardi replied that in his speech, he had emphasised more than three times the presumption of innocence of the accused. “It was a political argument and not a legal one and the things said were confirmed in the acts of the case. That an MP speaks in parliament is not an abuse but a right and a duty,” he said.

The court will decree in chambers on the requests.

Mobile phone data can be used

Meanwhile, in a separate case, Judge Anna Felice this morning turned down the application filed by the accused for an interim measure so that the mobile phone data related to the case will not be used.

The accused argued that the data was collected under a law, which had been repealed at EU level. However, the judge turned down the request.

But during the compilation of evidence, lawyer William Cuschieri told the court that his client – Alfred Degiorgio – had made two requests for interim measures to the First Hall of the Civil Court in its Constitutional jurisdiction, both of which have been declined but which will be appealed. 

Apart from the use of mobile phone data, the second interim measure rejected by the constitutional court was a request not to have FBI officials testify before the court.

Cuschieri asked Magistrate Claire Stafrace Zammit not to proceed to hear the testimony of the FBI witnesses until the constitutional cases are definitively decided.

Should this not be accepted, he argued, the court would be breaching his client’s right to a fair hearing.

However, assistant attorney general Philip Galea Farrugia said the time had come for the court to put an end to this abuse of procedure.

“This is a systematic attempt to always, on the eve of the sitting, raise an obstacle. This sitting has been fixed for two months why file last Thursday?”

Prosecution accuses defence of delaying tactics

Galea Farrugia accused the defence of drawing out the proceedings.

After Judge Anna Felice’s decree this morning, Degiorgio did not give leave of appeal, the prosecutor said.

The request for a constitutional reference is frivolous and vexatious as this court was not one of judgment but one entrusted with the collection of evidence, he insisted.

The lawyers for the Caruana Galizia family also objected to the defence’s attempts to protract the case.

Lawyer Therese Comodini Cachia, appearing for the family, pointed out that the defence had an ordinary remedy, which it chose to ignore and instead immediately filed constitutional proceedings.

The defence could have filed an appeal and a stay of execution to the decrees handed down by judges Schembri Orland and Felice but it did not, she said, describing the requests as "completely frivolous and vexatious."

Comodini Cachia said the FBI testimony would not create irreparable prejudice, defined as “damage which cannot be addressed by a final remedy”.

FACTS OF THE CASE

Who are the accused

• George Degiorgio 55, unemployed, lives in St Paul's Bay, known as Ic-Ciniz
• Alfred Degiorgio, 53, unemployed lives in St Paul's Bay, known as il-Fulu
• Vincent Muscat, 55, unemployed lives in Msida, known as il-Kohhu

Who are the courtroom players

• Magistrate Claire Stafrace Zammit is presiding
• Inspectors Keith Arnaud and Kurt Zahra are prosecuting
• Deputy attorney general Philip Galea Farrugia is assiting the prosecution
• Martin Fenech is appearing for Vince Muscat
• William Cuschieri and Martha Mifsud are appearing for Alfred Degiorgio
• Josette Sultana is appearing for George Degiorgio
• Therese Comodini Cachia and Jason Azzopardi are appearing parte civile for the Caruana Galizia family

What we know so far

Caruana Galizia’s car

• The Peugeot car Daphne Caruana Galizia was driving at the time had been leased four months before
• Her son Matthew Caruana Galizia had occasionally used the car in the period
• Matthew was the last person to have parked the car outside the gate of the family’s Bidnija home
• Investigators dismantled a similar model of the car to determine whether any debris collected from the crime scene was extraneous
• This led the police to discover the presence of an electronic board, which was part of the SIM card dock on the explosive device

The ‘small white car’

• A person who spoke to the police had noticed a “small white car” frequenting a particular area at Tat-Targa Battery, part of the Victoria Lines
• On the day of the murder the white car was there but unlike previous occasions the driver was not inside
• Police noticed that next to where the car used to be parked part of a wall had collapsed and led to a place with a birds-eye view of Bidnija
• Forensic experts combed the area for any clues, including cigarette butts
• After the murder, the car was never seen again
• Given Caruana Galizia did not have a fixed pattern of movement, police believe someone was shadowing her movements

The detonator

• Location data from the Bidnija area led the police to home in on a number that received an SMS at 2.58pm and stopped broadcasting thereafter
• The number was linked to an electronic device normally found in appliances that can be activated remotely
• This device acted as the detonator of the car bomb
• The device was switched on in the Bidnija area at around 2am on 16 October
• It remained in a static location for the day until it received an SMS and disappeared

The killer SMS

• The SMS that triggered the bomb was sent from a Nokia 105 mobile phone connected to the cell tower near the YMCA in Valletta
• This phone was switched on, on the day of the explosion and started broadcasting from a cell ID near the Curia
• The signal moved to Paceville, Senglea, Rinella, Zabbar and Xghajra as it bounced from cell towers north and south of the country every hour
• The cell towers all faced seawards that led police to suspect the mobile phone was on a boat circling the island
• The number linked to the detonator and the number that sent the SMS had been set up in November 2016 and had only corresponded with each other on three occasions

The pleasure boats

• The Degiorgio brothers both own pleasure boats
• CCTV footage showed that one of them – the Maya – was spotted leaving the Grand Harbour at around 8am before turning north
• At the time the killer SMS was sent, the Maya was spotted under the Great Siege Bell area, where it stopped for a few minutes before heading towards Marsa

The top up call

• The Secret Service had intercepted a call from George Degiorgio’s phone, asking the recipient to top him up with €5
• The person was unable to and Degiorgio called another person, asking the same question “Don’t take long, if you can,” Degiorgio told the person
• The person complied and minutes later topped up the number identified by George Degiorgio
• Police obtained call profiles relating to George Degiorgio, Alfred Degiorgio and Vince Muscat
• All mobile numbers involved were activated within 20 minutes of each other – two were activated in Senglea and the third in Hamrun

Other points

• Alfred Degiorgio's DNA matched that found on a cigarette butt, which was picked up from the Victoria Lines
• Police say Alfred Degiorgio was the spotter monitoring the Caruana Galizia household and is believed to have remained all night at the vantage point
• Alfred called his brother George Degiorgio to inform him Caruana Galizia had left the house
• The call lasted 107 seconds, which is the time it takes to drive from the house to where the bomb exploded
• After detonating the bomb by SMS, George Degiorgio messaged his wife with the words: "Buy me wine, my love."
• George Degiorgio had been telling people the day before the murder that he was going fishing
• After the incident George was heard boasting "I've caught two big fish today"
• Though unemployed, the Degiorgio brothers each owned a boat and luxury cars
• Europol experts accompanied Malta police investigations and searches when the three men were arrested