FBI expert links burner phones to Daphne murder as forensic specialist details digital probe

The trial by jury of Yorgen Fenech entered its second weekend on Saturday with jurors hearing detailed technical testimony from an FBI cellular analysis expert and the court-appointed Maltese IT forensic specialist who worked on the magisterial inquiry into the assassination of journalist Daphne Caruana Galizia.The evidence focused on the analysis of burner phones allegedly used in the bombing, the examination of Caruana Galizia's mobile phone and the extensive digital investigation that followed her murder.Saturday's sitting included highly technical evidence as prosecutors continued to build their case through digital and telecommunications experts who traced the electronic footprint left behind in the execution of the plan to assassinate the journalist.Fenech has pleaded not guilty to complicity in the wilful homicide of Caruana Galizia and to criminal association to commit her murder.The morning began with the testimony by FBI cellular analysis specialist Richard Fennern, who walked jurors through his examination of mobile phone records linked to the murder.Fennern explained that his work started with an analysis of Malta's mobile telecommunications network, familiarising himself with the country's cell towers and how they provide coverage through sectors spanning 360 degrees.Investigators narrowed their search to activity recorded by the Bidnija cell tower around the time of the assassination on 16 October 2017. They identified 53 unique phone numbers connected to the relevant sector between 2.58pm and 3.16pm before examining which numbers later became inactive.According to Fennern, one number immediately stood out because it had only ever connected to the network on three occasions: 10 January 2017, 21 August 2017 and the day of the murder.The FBI expert testified that on 16 October the phone was switched on at 1.41am and continued generating routine network location updates throughout the day. At exactly 2.58.55pm, he said, it sent the SMS that detonated the bomb which killed Caruana Galizia before immediately disappearing from the network.Fennern said investigators were confident they had identified the two phone numbers used in the detonation process, together with three additional numbers believed to be connected to the plot.He presented maps showing overlapping cell sectors and highlighted a phone call lasting from 2.57pm until 2.59pm, coinciding with the sending of the fatal SMS.The call, he explained, was made between two numbers differing only in their final digit, suggesting they had been issued consecutively. More significantly, the two numbers had only ever communicated with each other.Fennern also compared data from the burner phones with Alfred Degiorgio's personal mobile phone. He told jurors that Alfred Degiorgio's phone was located in the same area as the burner phones on 15 October, around St Paul's Bay. On the day of the assassination, the device was active between 2.04am and 4.46am before disappearing from the network until after 3pm, when it reappeared in the same area and shortly afterwards received a text message from George Degiorgio.Alfred and George Degiorgio were sentenced to 40 years in jail in connection with the murder in separate court proceedings.During cross-examination, defence lawyer Gianella de Marco focused on the timeline of the SIM cards' use.Fennern confirmed that two SIM cards were involved, one used for communications and another for the detonation mechanism. He also testified that the SIM card used on 16 October was later inserted into a GSM module capable of remotely triggering external equipment.Asked when the SIM cards had originally been acquired, Fennern replied that he did not know, bringing his testimony to an end.Taking the witness stand, court-appointed IT expert Martin Bajada, who described himself as a lawyer and freelance IT expert with three decades of experience and involvement in more than 4,000 court cases, testified that he joined the magisterial inquiry on 17 October 2017, the day after the assassination.He said a dedicated team of digital forensic specialists was established inside the law courts to process what was expected to be a vast quantity of electronic evidence. By the third day of the inquiry, the team was already working closely with the FBI.Bajada explained that while FBI investigators concentrated on mobile phone antenna analysis, his team obtained telecommunications data from local service providers, stressing that every request was authorised by the inquiring magistrate.He described the technical challenges investigators faced, noting that telecommunications providers retained engineering data for only one month because of the enormous volume of information generated by mobile networks.The court also heard details about the recovery of Caruana Galizia's mobile phone, which was only found after her destroyed vehicle had been moved from the scene.Because the handset was extensively damaged, investigators decided to clone the device rather than remove its SIM card. Most of the data was successfully recovered, although part of the WhatsApp content stored on the damaged SD card could not be retrieved.Bajada also explained the team's examination of the journalist's phone, telling jurors investigators had to balance the search for evidence with the need to protect confidential journalistic sources.The story, yes. The sources, no, he said, explaining that while investigators looked for individuals who could theoretically have had a motive linked to Caruana Galizia's reporting, safeguarding source confidentiality remained a priority.After the phone's contents were extracted and analysed, the material was forwarded to Europol. Bajada said Europol's conclusions broadly reflected those reached by the Maltese investigators.The witness also referred to the separate DaphneLeaks investigation launched after confidential information from the inquiry appeared in the media in 2020, confirming that part of that investigation remains ongoing.The afternoon session was initially dominated by lengthy legal arguments over the admissibility and presentation of emails extracted from Daphne Caruana Galizia's electronic devices.Proceedings resumed with prosecuting lawyer Godwin Cini concluding his questioning of Bajada regarding digital extractions from Fenech's mobile phone. Bajada confirmed that the forensic extraction had been carried out in 2020 using the software available at the time and that no further software had since been used to re-examine the device.Turning to the material recovered from Caruana Galizia's phone, Bajada explained that investigators had been confronted with a substantial volume of emails. He said he had been instructed to preserve the contents of the emails while filtering out standard email footers, adding that many emails appeared blank because the sender had written the entire message in the subject line.That explanation immediately prompted an objection from the defence, leading Judge Edwina Grima to ask the jury to leave the courtroom while legal submissions were heard.Defence lawyer Charles Mercieca argued that if the prosecution intended relying on emails extracted from Caruana Galizia's account, it should present the original, unredacted versions rather than copies edited to protect journalistic sources. He maintained that the unredacted documents constituted the actual evidence, while the redactions had been introduced later at the request of the Caruana Galizia family's lawyers.The defence also questioned the evidential value of the emails themselves, arguing that, unless the authors of the messages were called to testify, the contents could not be taken as proof of the claims they contained. Instead, counsel argued, the emails merely established that communications had taken place at particular dates and times.Judge Grima ruled that should no author be called, jurors would be given appropriate directions on how they should assess that evidence.Bajada was then cross-examined, with defence lawyer Gianella de Marco requesting that a 2020 extraction of Keith Schembri's mobile phones be formally exhibited when the former chief of staff eventually testifies. The court heard that forensic clones had been created from two iPhones, identified as KS1 and KS2, and made available for use in several ongoing investigations.The defence broadened its requests to include additional phone extractions and call profiles relating to several other key figures connected to the investigation.Towards the end of the sitting, the defence questioned Bajada about the volume of material extracted from Caruana Galizia's emails, asking specifically how many times Keith Schembri and former minister Chris Cardona were mentioned.Bajada replied that the extracted material extended to more than 29,000 pages and said he could provide an exact figure if given more time to review the records. De Marco responded that, if necessary, the defence would identify the relevant passages itself and display them in court when proceedings resume on Monday.A minute-by-minute account of the sitting may be found here