Cyber expert says software used to process cellphone recordings ‘safe’
THE digital forensics examiner who was the man tasked with validating the integrity of the cellular phone recordings made by a former gang member and handing them over to investigators probing the St Catherine-based Klansman gang on Tuesday insisted that the software used by cyber experts to carry out this process was foolproof.
The examiner, a corporal from the Communication Forensics and Cybercrime Division (CFCD) of the Jamaica Constabulary Force (JCF) and a certified digital forensics examiner took the stand on Monday to show the correlation between the recordings, the dates, and the calls, which involved conversations with incarcerated members revealing the inner workings of the gang as they plotted crimes and discussed issues.
On Tuesday, the cop, retaking the stand, told the court that he had examined the data for a total of 236 recordings from the handsets — a black Alcatel, black Vonino XY10Z, and a grey Samsung. The court was also shown the contact lists on the handsets with the aliases of several of the accused as well as the name of the lead investigator.
The Crown said analysis was done to examine the activities surrounding the numbers saved and the number of the former gang member turned State witness.
Under cross-examination from attorney Alexander Shaw who represents Stephanie Christie o/c Mumma — the sole female defendant on trial — regarding whether the data extracted with the software used could be manipulated by a user, the cop said, “I doubt the user can manipulate the data.”
Trial judge Chief Justice Bryan Sykes, probing further, asked the cop whether it was possible for the data to be manipulated by people within the CFCD itself. He also questioned what safeguards were in place to prevent that.
The lawman, in responding, said in the extraction process used by the CFCD lab, the SIM card is removed from the device as a first step to “prevent the phone from communicating with the telecommunication network any further”.
“Based on the instructions that the forensic software gives us to follow, the only thing we will do with the phone is connect it and initiate the extraction process. After the extraction is completed [the application] does what is called a hashing of the data, and once it is completed you can do a verification, and once the hash values [essentially thought of as fingerprints for files] are the same it indicates that no change has occurred. If you change any data art, all the hash values change drastically,” he told the court.
The chief justice, dissatisfied with that response, further queried, “What the attorney is trying to find out is whether the possibility exists that what is extracted from the phone, is it possible for someone to manipulate or alter the data? As to whether it is detectable or not is another matter.”
In responding, the cop said, “No, that is not possible. Each time you open the application it automatically rehashes the data, if there are any changes it will tell you there is a hash mismatch,” adding, “The software is safe.”
Earlier in his evidence the cop’s answers regarding a March 2019 recording for which the outgoing number was the same as the receiving number had prosecutors, the defence, and the judge alike questioning whether the application was as reliable as was being said.
Witness number one, a former gang member turned Crown witness, had testified that he turned over to the police three phones, two of which were given to him by the cops, with recordings of conversations between himself and members of the gang. The witness, who said he started working with the police undercover in 2018 while Bryan was incarcerated to help take down the gang, said the third handset was given to him by a member of the gang on Bryan’s orders. He said he downloaded a call recording app to automatically tape multiple cellphone conversations, which were also saved. He forwarded the recordings to cops when the memory became full.
The matter resumes at 10:00 am today in the Home Circuit Division of the Supreme Court in downtown Kingston where a witness from a telecommunications provider is expected to take the stand.