FBI pinned down convicted killers’ phone numbers a week after murder

FBI cellular analysis investigator Richard Fennern, who testified in court earlier on Saturday during the Daphne Caruana Galizia murder trial, described how the FBI was able to pin down the phone numbers used to detonate the car bomb that took the journalist’s life by 23 October, 2017 – a mere week after the attack.

Fennern’s testimony during the trial, in which the prosecution is seeking the conviction of Yorgen Fenech, allegedly complicit in the murder, delved into extensive detail about how the US government’s federal agency was roped into the police investigation from day one.

Last week, Assistant Commissioner and Head of Major Crimes Unit Keith Arnaud had already provided jurors with a broad outline of how the FBI’s Cellular Analysis Survey Team (CAST) was largely responsible for providing local police with the phone data that was used to trace the executors’ movements in and around the crime scene.

On Saturday, Fennern provided jurors with more details of how this critical breakthrough in the investigation was achieved.

He said the first task was to understand Malta’s cellular network, including the locations of the relevant cell towers and the coverage provided by each mobile service provider. A cell site, he explained, is an antenna that provides coverage to a specific area, with each tower divided into sectors that cover a 360-degree range.

After mapping the cell towers around Bidnija, investigators began looking for activity around the time of the explosion.

Fennern said Vodafone provided the relevant data after the cell tower used by the bomb’s burner phone was identified. Fifty-three phone numbers were active in the few minutes around the time of the detonation, and the FBI managed to narrow it down after the service provider highlighted a number which was deactivated immediately after the bomb was triggered.

By 23 October, the FBI had narrowed down their search to the two SIM cards which were used to activate and detonate the bomb.

The FBI then obtained the full activity logs for those numbers, allowing investigators to determine when the SIM cards were activated, when they were used, and what activity occurred over their lifetime. The analysis also allowed investigators to identify the phones’ make and model using their IMEI numbers.

Fennern said the phones were active on only three relevant dates: 10 January, 21 August and 16 October 2017. In a separate testimony, court IT expert Martin Bajada explained that the maximum retention period for mobile data is up to 12 months.

After the 16 October activity, the devices were never used again, he said.

“They were never used for anything else other than communicating with each other,” Fennern added.

He explained that mobile phones constantly send signals to cell towers, allowing the network to know where the device is and where to route data. Even a phone that is not actively being used can still generate location updates.

The witness also explained that SIM cards are not limited to ordinary phones and may be integrated into devices capable of receiving basic commands, including the command module used to detonate the bomb.

The court also heard how the FBI analysed activity from the other burner phones used by the men who carried out the assassination. That analysis showed the locations of the executors in and around Bidnija, while separate data placed another phone on the Maya, George Degiorgio’s boat, in the Grand Harbour.

Degiorgio, alongside his brother Alfred and their co-conspirator, Vince Muscat, are already serving a prison sentence for executing the murder. Muscat was granted a pardon to tell investigators all he knew about the murder plot.

CCTV footage later obtained by the police further confirmed that Degiorgio sailed out into the harbour at the exact time the bomb was detonated.

Fennern said investigators also monitored the personal phones of the suspects once they had been identified as persons of interest.

By comparing personal and burner phone activity, investigators could match the men’s movements with their known locations, including near Caruana Galizia’s home and aboard the Maya at the time of the murder.

The data, he said, allowed investigators to build a pattern showing when and where the phones were active, and how those movements aligned with the assassination. Jurors were shown 88 slides containing detailed maps of their movements on different days during the time period under examination.

Under cross-examination, defence lawyer Giannella de Marco asked Fennern to clarify which phones were used for which purpose. Fennern answered the technical questions put to him and explained the analysis again for the benefit of the defence.

After a short break, court expert Martin Bajada also testified. Bajada, a lawyer and IT expert who said he had worked on more than 4,000 cases over 30 years, told the court that he compiled several reports for the inquiring magistrate and processed large volumes of extracted data in the acts of the case.

Bajada explained how police and inquiring magistrates can order data from service providers during criminal investigations, and how large datasets must then be sifted and analysed.

He was also asked about Caruana Galizia’s mobile phone, which had been recovered from the crime scene in an unusable condition.

“In this case, the condition of the victim’s mobile phone was unusable, so we needed to clone it,” Bajada told the court.

He said the cloned phone was used to access information from Caruana Galizia’s communications, including WhatsApp and Google accounts. In 2017, before two-factor authentication became more common, such data could only be accessed through the same SIM card number, he explained.

Besides working on the murder inquiry itself, Bajada was asked to explain a raft of other reports he authored in relation to parallel cases that emerged as a result of the murder inquiry.

Among the many data points Bajada parsed through, he was tasked with looking into the leaks of official secrets from the inquiry and the police investigation as well as exploring the connections between the executors and additional persons who were under investigation, specifically naming Chris Cardona as one of the individuals whose affiliation with the executors was identified.

The trial continues.