By Mark Gutglueck
In what was perhaps the most dynamic round of testimony so far in the Charles Merritt murder trial, an expert witness brought in by the defense severely undercut a crucial element of the prosecution’s case, casting considerable doubt upon, if not outright obliterating, what has been offered by the district attorney’s office as the motive in the brutal McStay family killings.
Moreover, testimony by that witness, computer forensic analyst Bryan LaRock, taken in conjunction with testimony by PayPal custodian of records Sarah Kane, definitively established that the individual the defense team alleges is the actual murderer had obtained fraudulent access to one of the victim’s business accounts and the funds therein after the homicides occurred.
In addition to solidifying the defense’s assertion that this alternate perpetrator, Dan Kavanaugh, had motive for killing the family, LaRock offered a compelling indication that Kavanaugh was actually in the San Diego area when the murders occurred. That controverts the alibi that Kavanaugh had previously asserted and which law enforcement officials heretofore have accepted, consisting of his claim that he was in Hawaii when the McStay family was killed.
According to the prosecution’s version of events, Charles “Chase” Merritt, driven by financial desperation that grew out of his unbridled gambling addiction and utter lack of fiscal discipline, engaged in a series of thefts from Earth Inspired Products, the company owned and operated by his business associate, Joseph McStay. Through that company, Joseph was selling high end decorative water features – artificial waterfalls and fountains – which he and Merritt designed and which Merritt manufactured out of steel, glass, rock and other components based upon the specifications outlined by the company’s customers and passed along to Merritt by McStay. The prosecution’s theory, presented during the initial nine weeks of the trial that began on January 7 of this year, is that Merritt fraudulently obtained access to the QuickBooks accounting system McStay had set up for the Earth Inspired Products enterprise and on February 1 and February 2, 2010 wrote himself $7,495 worth of checks.
When he learned of what Merritt was up to, either shortly before or perhaps even on February 4, 2010, Joseph McStay traveled to Rancho Cucamonga, where Merritt was then living, and confronted him about his larceny, threatening to alert authorities, prosecutors allege. After Joseph McStay returned home to north San Diego County, the prosecution’s theory continues, Merritt that evening drove to the McStay residence in Fallbrook where he killed Joseph McStay, his wife Summer and their two sons, four-year-old Gianni and three-year-old Joseph, Jr.
Merritt then secreted the bodies for two days, in the meantime again fraudulently accessing Joseph McStay’s QuickBooks account for Earth Inspired Products, the prosecution maintains, and on February 4, 2010, February 5, 2010 and again on February 8, 2010 issued himself checks made out to himself for a total of $23,855.
Merritt then transported the corpses up into San Bernardino County’s High Desert, an area with which Merritt was familiar from having grown up in Hesperia where he attended Apple Valley High School for three years in the 1970s, according to prosecutors. There, in a remote area between Victorville and Oro Grande on February 6, 2010 he buried all four of his victims along with the three-pound sledge hammer he had used to bludgeon them in shallow graves he dug in a wash off a rarely-traveled dirt road, according to the prosecution. To confuse the situation, throw authorities off his track and delay a serious investigation into the matter, the prosecution maintains, Merritt then drove the McStay family’s 1996 Isuzu Trooper, which yet contained the child seats for Gianni and Joseph, to San Ysidro, where he left the vehicle in a shopping center parking lot roughly a quarter of a mile from the Mexican border.
The case against Merritt is a largely circumstantial one. What physical evidence does exist in the case is not in and of itself implicative but must be tied into and intricately connected with other equally slender evidence and assembled into a conclusion contexted within a set of assumptions. As with all murders and crimes in general, the three factors that investigators must satisfy in order to establish the viability of an individual as a confirmed suspect consist of assigning to him motive, means and opportunity. If investigators determine that someone had a realistic reason to engage in the crime – motive – together with the tools, effects and ability to carry it out – means – and if they cannot rule out that the suspect was present at the scene of the crime when it occurred and thus had the opportunity to commit the crime, they will then collect and catalog all evidence supporting those determinations. The investigative case file is then turned over to prosecutors, who upon their discretion and based upon further determinations can potentially elevate the suspect to the status of a defendant by lodging charges against him and utilizing the facts in the investigative file to inform the narrative of guilt presented against him in court.
In the case of People vs. Merritt, many of the facts are vulnerable to divergent, varying or even contradictory interpretation, and the prosecution since the onset of the trial has labored to illustrate that its interpretation of those facts and the cascade of events surrounding the murders and their aftermath are more reasonable and therefore compelling and convincing than the competing constructions and alternative theories of the defense.
With regard to the motive, the prosecution maintains that it was Joseph McStay’s confrontation of Charles Merritt on February 4, 2010 about checks Merritt had surreptitiously written against the Earth Inspired Products business account accompanied by McStay’s stated intention to contact law enforcement authorities over the matter that threw the defendant into a panic, prompting him to murder his business associate to keep his larceny under wraps. The circumstances of Joseph McStay’s murder which included the presence or proximity of his family or at least their knowledge of Merritt being with Joseph at the time, the prosecution has implied, were such that Merritt had no other choice but to dispose of them as well.
That element of the prosecution’s theory, however, hinges upon Merritt having actually forged the checks in question. In seeking to establish Merritt did just that, the prosecution has relied upon peculiarities in the way the February 1 and February 2 checks were drafted. Of note is that Joseph McStay for several years had two QuickBooks accounts for the Earth Inspired Products enterprise, each of which was tied to separate email accounts. The most frequently used of these accounts prior to and up until early 2010 was that associated with the email address contact@earthinspiredproducts.com. In drafting checks pertaining to his business, Joseph McStay’s demonstrated pattern with only a single exception going back to 2007 was that when he generated checks on a computer printer for the account associated with contact@earthinspiredproducts.com he would capitalize the first letter of the first and last names of the payee, capitalize the first letter of each word in the memo line and capitalize the first letter of the payment amount. For virtually all of Earth Inspired Products’ operations from 2007 until 2010, according to the prosecution and sheriff’s department investigators, the contact@earthinspiredproducts.com account was used to keep track of the income flowing into the company and the payments going out, consisting primarily of payments to vendors and suppliers as well as payments to Merritt for his participation in the operation, which consisted of designing, fabricating, shipping and installing the water features. The list of entities either making payments to or receiving payments from the contact@earthinspiredproducts.com numbered in the scores.
After years in which the QuickBooks account associated with contact@earthinspiredproducts.com was used to handle accounting and check drafting for the company’s income and expenditures, on February 1, 2010, just three days before the family’s disappearance, Joseph McStay’s other QuickBooks account, the one associated with the email address custom@earthinspiredproducts.com which had long lain dormant, abruptly transitioned into the platform from which the financial activity relating to the company was handled. That account had far fewer entities listed in its customer and vendor list. The sudden onset of activity included the issuance of two checks made out to Charles Merritt created on February 1, 2010 bearing February 1 dates, each for $2,500; another check to Charles Merritt created February 2 and bearing the date of February 2, 2010 for $2,495, another check made out to Charles Merritt created February 4, 2010, bearing the date of February 4, for $4,000; another check to Charles Merritt created on February 5, 2010, backdated to February 4, for $4,500; a check to Metro Sheet Metal created on February 5, 2010 and backdated to February 4 for $1,650; another check to Metro Sheet Metal created on February 5 and backdated to February 4, for $250; another check to Charles Merritt created on February 5 and backdated to February 4, 2010, for $6,505; a check to Charles Merritt created on February 5, 2010 and backdated to February 4 and bearing a different check number than was indicated in the QuickBooks history, for $2,350; and another check made out to Charles Merritt created on February 8 and backdated to February 4 for $6,500.
Metro Sheet Metal is an Azusa-based metal fabricating concern which included a foundry out of which Charles Merritt operated in manufacturing the waterfalls and fountains for Earth Inspired Products.
Those ten checks created on February 1, February 2, February 4, February 5 and February 8, the prosecution alleges, were not created by Joseph McStay but rather were forgeries by Merritt. Supporting that contention, according to the district attorney’s office, is that the checks were all created using the QuickBooks account tied to the email address custom@earthinspiredproducts.com rather than the account associated with the email address contact@earthinspiredproducts.com, as was previously Joseph McStay’s consistent practice. Even more damning evidence that the checks are forgeries done at Merritt’s hand consists, the prosecution maintains, of the consideration that the checks themselves do not utilize the capitalization scheme Joseph McStay previously incorporated with virtually all of the checks generated on the Earth Inspired Products account.
On each of the February 1, February 2, February 4, February 5 and February 8 checks the first letter of the names of the payees are not uppercased. Thus, the checks to Merritt are made out to “charles merritt.” The checks to Metro Sheet Metal are made out to “metro sheet metal.” This is a telltale indication that Joseph McStay did not issue the checks, the prosecution maintains, and a giveaway that Merritt, whom the prosecution has sought to portray as unfamiliar with the use of QuickBooks and the process for issuing and printing checks using that system, botched the format for the checks he was writing to himself during his embezzling caper.
It is a central tenet of the case against Merritt that McStay became aware of the thefts from his business account and confronted Merritt about it at an early afternoon meeting they had at a Chick-fil-A fast food restaurant after Joseph left his Fallbrook home late in the morning of February 4, 2010 to drive to Rancho Cucamonga, where Merritt lived at the time. It is the prosecution’s contention that at that meeting Joseph McStay threatened to report the thefts to authorities, and that because Merritt had previous convictions for nonviolent offenses that were nevertheless felonies, his arrest, prosecution and conviction on charges relating to the fraud would subject him to a substantial prison term and California’s Three Strikes Law. This prospect threw Merritt into a panic, and to avoid that eventuality, the prosecution avers, he resolved to silence Joseph McStay, and he sojourned to Fallbrook that evening, where he carried out the heinous deed, along with the collateral killings of the rest of the family.
Bryan LaRock, whose pedigree as a forensic computer analyst includes both a bachelor of science and master’s degree in computer science from USC and full credentials as a certified computer examiner granted him by the International Society of Forensic Computer Examiners, was recruited to work on Merritt’s legal defense in 2015, predating the hiring of the legal team representing Merritt during the trial, which consists of James McGee, Raj Maline and Jacob Guerard.
LaRock’s testimony, coming as it did at an advanced stage of the trial, in the 14th week of testimony, the fifth week into the defense’s presentation of its side of the case after nine weeks of the prosecution’s exposition of its evidence and witnesses and on the 40th, 41st and 42nd day of the trial, had the effect of recontexting significant elements of the proceedings.
LaRock said while he had not been entrusted with the actual items, he had been provided with the “forensic images” extracted from something close to 30 electronic devices that were seized by law enforcement personnel in the course of their investigation into what was initially considered to be the disappearance of the McStay family and which subsequently was learned to have been their murders. He said those devices included “eight or nine” computers, as well as hard drives, thumb drives, mobile phones and other items. LaRock said it was his intent to look at the electronic data contained within those devices and their history to extract as many pieces of evidence relating to the disappearance as he could find and thereby “basically add some context as to what happened.”
He said that of those devices and items “some stood out in terms of relevance” in relation to the effort “to figure out what had happened at the time of the disappearance.” LaRock indicated directly, and his testimony bore out, that the device containing the most illustrative information was an Emachine desktop computer that was one of the home computers in the McStay household.
LaRock was also provided with access to other information deemed relevant to his investigation, including phone records, which he considered in conjunction with the activity on the digital devices he was able to trace. LaRock said that where it was appropriate he had cross-referenced information gleaned from the different electronic devices, in some cases comparing activity on two of the devices at the same time. In this way, LaRock said, he had unearthed indications that ran counter to the prosecution’s theory of the case.
One example of this, he testified, is the information extracted from Joseph McStay’s cell phone records for the late afternoon of February 4, 2010 and his simultaneous activity on the Emachine.
LaRock said his analysis of data on the Emachine demonstrated that on the afternoon and into the evening of February 4 Joseph McStay had been utilizing a three-dimensional drawing program on his computer known as Google Sketchup which had been accessed using the web browser from 4:10 pm. to around 5 pm.
February 4 is the day the prosecution maintains Merritt murdered the McStay family. According to LaRock, however, the electronic data indicates that McStay and Merritt were in a cooperative mode relating to their shared water feature manufacturing venture after McStay departed Rancho Cucamonga following the lunch meeting at the Chick-fil-A at which the prosecution claims Joseph was threatening to report Merritt’s alleged check forging activity to agents of the law.
“In the afternoon of February 4th [2010] there are several calls showed as being made to Chase Merritt’s phone number,” LaRock said in reference to Joseph McStay’s cell phone records.
Those calls occurred at 3:03 p.m. while Joseph McStay’s phone was in contact with a cell phone tower in Ontario and another call was placed to Merritt at 3:32 p.m. when McStay’s phone was in contact with a cell tower in Norco, LaRock pointed out. At 4:18 p.m. another call was made to Merritt with McStay’s cell phone pinging off of a cell tower in Fallbrook, an indication that Joseph McStay was back at his residence at that time. That call occurred some eight minutes after the data from the Emachine shows Joseph McStay had initiated his Google Sketchup activity, according to LaRock.
“This 4:18 p.m. call was made to Chase Merritt while the Google Sketchup activity is occurring,” LaRock testified.
“And why was that significant?” Maline asked.
“That’s of significance to me because… it looks like the user is traveling toward the Fallbrook house…” LaRock began.
”Objection, calls for speculation, lacks foundation,” Supervisng Deputy District Attorney Britt Imes interrupted him.
“Overruled,” Judge Michael A. Smith said.
“Simply taking the location information listed here,” LaRock went on, “over the different times we see Ontario, followed by Norco, followed by Fallbrook, and then working on design information, so the Sketchup design program looking at house information, design information, so it has the appearance to me of Joseph working on a drawing…’
“Objection, that calls for speculation,” said Imes, preventing LaRock from following through with his observation that it appeared that at that point McStay and Merritt were involved in a cooperative exchange relating to the designing of a water feature. Given the context, LaRock’s suggestion was that the activity seemed to contradict the assertion that McStay was on the verge of reporting Merritt to law enforcement authorities.
Judge Smith sustained the objection and instructed LaRock’s answer to be stricken from the record.
Maline, however, was able to get before the jurors LaRock’s testimony regarding the cooperative nature of the relationship between McStay and Merritt which followed as a consequence of the designing of the water features.
LaRock said that his forensic analysis of the Emachine showed that for approaching 40 minutes from 8:43 p.m. until 9:21 p.m. on January 31, 2004, Joseph McStay was engaged in using the Sketchup design program on a drafting project, the file name for which referenced both Merritt and a customer designated as “fred,” in lower case, presumably a water feature Merritt was working on, and that in the middle of that session at 8:59 p.m., Joseph called Merritt on his cell phone, and then sent him a text message with a photo, nearly an hour later, at 9:56 p.m.
The circumstances surrounding McStay’s design session on February 4 during which he was in telephonic contact with Merritt was in virtually all respects similar to the design session he was involved in on January 31 when he called Merritt.
According to LaRock, there was another phone contact between McStay and Merritt at 5:47 p.m. in the early evening of February 4. LaRock also referenced a last phone call placed from McStay to Merritt at 8:28 p.m. that evening, which Merritt did not answer.
Previous testimony in the trial established that the 8:28 p.m. call was the last call ever made from Joseph McStay’s cell phone. Prosecutors allege the murders occurred at some point that evening following that phone call.
With regard to that evening, Maline asked LaRock, “Was there internet activity after 5 o’clock that you documented and in your opinion was significant?”
“Yes,” said LaRock.
‘”And what was that?” Maline asked.
“There was additional internet activity around the hour of 8 p.m,” said LaRock.
“What specific internet activity are you talking about that was significant in your opinion?” Maline asked.
“A user on the computer logged onto QuickBooks online, and activity there,” responded LaRock.
LaRock said there was data contained on the Emachine’s temporary internet files to show that someone had logged into the QuickBooks online site at 7:56 p.m. At the same time, Maline displayed on the courtroom’s overhead visual monitors the computer read-out of the activity being referenced.
“What is it we’re looking at here?” Maline asked.
“This appears to be a debit-input screen for entering information for a check.” said LaRock. “This is part of QuickBooks online.”
Thereafter another exhibit was displayed for the jury, a read-out from the Emachine’s activity registry. “This is another web page entitled ‘print checks,’” said LaRock. “The file name is ‘select print1.htm.’”
“Is there a time that is associated with this file?” Maline asked.
“7:59 p.m.,” said LaRock.
The next internet registry item on the Emachine, LaRock testified, over an objection by Imes, related to actuating the printing of the check.
“This is entitled ‘print checks set up,’” said LaRock. “It is a web page entitled ‘print checks,’ and it shows a payment listed, type of check, to Charles Merritt.”
By his testimony, LaRock refuted the prosecution contention that the February 4 check to Charles Merritt for $4,000 had been a forgery.
LaRock pointed out that there was an accompanying screen to the one relating to the one pertaining to the drafting of the check that showed the amount of money in the Earth Inspired Products bank account upon which the check was drawn.
“It reads current balance a little more than $89,000…[$89,724] nearly $90,000,” said LaRock.
Unlike the San Bernardino County Sheriff’s Department’s computer analyst, Detective Jason Schoeder, who said he could not access the print spool files that were triggered with the effort to print the check written near 8 p.m. on February 4, 2010 because they were garbled, LaRock said he succeeded in opening the file.
“I was able to open these spool files to see what the contents were,” said LaRock. Both were generic alignment pages for QuickBooks online to set up the printer, he said.
LaRock told the jury he was able to draw a broader parallel between McStay’s cell phone usage and his QuickBook and check drafting activity, a significant element of which controverted the prosecution’s narrative of guilt implicating Merritt. Joseph McStay made a consistent practice of phoning Merritt shortly after writing him a check, what LaRoock said was “a pattern that I noticed. There is absolutely a correlation between checks that are issued in the QuickBooks online records followed by calls from Joseph to Chase Merritt. I did compare the QuickBooks online records and the checks that were issued that were listed to Charles Merritt or Metro Sheet Metal. I compared that with the phone records of Joseph McStay because I wanted to see if what I noticed in terms of a call being made to Chase after a check was issued was consistent. What I found was, for the period of time for which I have the phone records, that a phone call was made to Chase every single time that a check was issued for the QuickBooks online records.”
This was true with regard to the checks issued to Merritt on February 1, February 2 and February 4, 2010, LaRock testified.
LaRock’s testimony in this regard ran counter to the prosecution’s assertion that the checks written to Merritt on those days were forgeries by Merritt and that the checks were not written by McStay.
LaRock’s forensic analysis of the Emachine turned up other evidence which cast further doubt on the prosecution’s allegation that Merritt forged the February 1, February 2 and February 4 checks, he said.
Maline displayed the activity log for the QuickBooks account associated with the email address custom@earthinspiredproducts.com, which showed that someone operating from McStay’s Emachine computer had added Charles Merritt as a vendor on February 1, 2010 at 12:24 p.m. Maline drew attention to the capitalization, or lack thereof, in that entry, as it was spelled “charles merritt.’
“You had indicated a vendor had been added, Charles Merritt, all lower case, correct?” Maline asked.
“At 12:24 p.m., correct,” LaRock said.
“What’s the next thing in progression that occurs?” Maline inquired.
“We see two additional sign-ins followed by two checks,” LaRock said.
“And those are at 12:34 and at 12:37,” Maline said.
“That’s right,” LaRock said. “I’d like to point out that at 12:34 p.m. user Joseph McStay added check to Charles Merritt, all in lower case, and at 12:37 p.m. user Joseph McStay added check to Charles Merritt, all in lower case.”
The incontrovertible computer-stamped date of those entries and the consideration that the checks were drafted on the McStay family’s household computer three days before the family’s disappearance would appear to indicate that it was indeed Joseph who drafted those checks, ruling out a central premise of the prosecution’s case against the defendant, that being the assertion that Merritt had forged the two February 1 checks and the February 2 check. If no such forgery occurred, the prosecution’s further contention that McStay had confronted him about those forgeries on the afternoon of February 4, precipitating Merritt’s sledgehammer-wielding, homicidal frenzy, collapses.
Further data LaRock was able to mine from the computer files subjected yet another prong of the prosecution’s case to question.
LaRock said there were “very detailed” records pertaining to Merritt’s work on features for Earth Inspired Products contained in an electronic folder within the Emachine. LaRock said that there was consistency between the QuickBooks entries that Joseph McStay made relating to the transactions Earth Inspired Products was engaged in with its customers and vendors and a separate ledger he kept in which those transactions were listed.
At least by inference, those books bring into question the prosecution’s suggestion that killing Joseph McStay was in any fashion in Merritt’s financial interest. Those books show that Joseph’s company, Earth Inspired Products, was more than just a meal ticket for Merritt, and that it represented a significant source of income, indeed one that if not offering him wealth, then significant comfort.
Earth Inspired Products was doing well, particularly before the full effects of the economic downturn that manifested during the first decade of the Third Millennium. According to information previously introduced during the trial, Merritt and Joseph divided the gross revenue between them along a roughly 60 percent to 65 percent/40 percent to 35 percent split, with the lion’s share going to Merritt, though with the proviso that the materials and equipment needed to manufacture the water features were paid for from Merritt’s share of the proceeds.
According to a spreadsheet that Joseph had created and which LaRock recovered, Earth Inspired Products in 2007 had a total income of $330,375.97, of which $204,666.98 was paid to Merritt.
In 2008, according to a spreadsheet that Joseph created and which LaRock recovered, Earth Inspired Products had a total income of $342,099, of which $224,615 was paid to Merritt.
The spreadsheet that Joseph prepared for 2009 that LaRock recovered from the computer was incomplete, running only as far as the end of January of that year. However, LaRock was able to find a spreadsheet that cataloged the company’s 2009 activity that Joseph McStay had uploaded to Google Documents. It showed total income of $297,954, with $158,210 going to Merritt.
LaRock offered testimony about an issue of considerable mystery and not-yet fully determined significance in the case, which had been brought up previously during the testimony of Detective Jason Schroeder, the San Bernardino County Sheriff’s Department’s forensic computer analyst.
LaRock said that in the early morning hours of February 8, someone had attempted to access the Emachine and another of the McStay family’s household computers, a Hewlett-Packard that was used primarily by Summer McStay.
According to LaRock, in between 2:05 a.m. and 2:07 a.m., Google searches were run on the Emachine which involved bringing up sites or activity that had previously been undertaken or visited on the computer, one of which included QuickBooks online.
“The user ran six of the searches.” LaRock said. “My opinion is that the user opened Internet Explorer and used most likely this drop down [menu] to click on the searches. Each of these six searches had been run in the past.” Neither QuickBooks online nor any of the other sites was fully accessed from the computer at that time, according to LaRock, although he indicated the computer’s history registry might have been looked over. At 2:09 the Hewlett-Packard was turned on and a search initiated, LaRock said.
Because the Hewlett-Packard computer had been factory reset on January 23, 2010, whoever was seeking to determine what internet activity had taken place on that computer probably did not glean much information, LaRock said, since the Google tool bar on it had been emptied.
Whoever intruded into the McStay home that hour of the morning most likely remained there for nearly two hours, LaRock said, as the user “affirmatively shut down” the Emachine at 3:55 a.m.
LaRock said that based upon his analysis of activity on computer programs, including entries into spreadsheets, it appeared that Joseph McStay was using a laptop which had been provided with the name “Josepe,” which was never recovered. Much of the accounting and design work that Joseph McStay did with regard to Earth Inspired Products was carried out on the Josepe laptop, according to LaRock.
The majority of the testimony LaRock offered under direct examination was oriented toward Maline’s efforts to undermine primary elements of the prosecution’s case pertaining to his client’s activities and alleged direct involvement in the murders. Maline did, however, guide LaRock along one tangent that bore no direct relationship to Merritt but rather propounded the defense’s alternative perpetrator theory involving Dan Kavanaugh.
According to Maline as well as the other two members of Merritt’s defense team, James McGee and Jacob Guerard, the individual best fitting the profile of the murderer of the McStay family is Dan Kavanaugh, and the investigators in the case wrongfully focused on their client early on and then failed to make a thorough investigation of other potential perpetrators, Kavanaugh foremost among them.
Kavanaugh, who has a level of computer literacy and facility with the internet such that he is known to many as “Dan the Hacker,” was assisting Joseph McStay in his promotion of his water feature business, essentially by assisting in marketing the water fountains and artificial waterfalls by means of the internet, which included ploys to move Earth Inspired Product’s website to the top of search engine listings. Kavanaugh’s efforts on Joseph’s behalf dated back to before Joseph’s arrangement with Merritt for the designing and completion of customized features. In large measure, before Merritt arrived on the scene, Joseph was essentially dealing in obtaining ready-made water fountains and water features available from wholesalers which he then packaged and delivered to interested customers. For the service Kavanaugh was providing, Joseph had agreed to provide Kavanaugh with a percentage of sales made over the internet.
With the initiation of the customized products line constructed by Merritt, McStay had continued to deal in prefabricated water features, paying Kavanaugh in accordance with whatever sales he made via the internet of those products. But he had not shared with Kavanaugh any of the revenue stream from the water features Merritt was delivering. When Kavanaugh learned of this in the spring of 2009, he grew resentful, and confronted Joseph over having been deprived of the percentage of the ongoing profits for Earth Inspired Products to which he felt he was entitled. There was some degree of back-and-forth between McStay and Kavanaugh over this, which included threats by Kavanaugh that he would ruin the business, and route internet traffic coming into the Earth Inspired Products website to porn sites, unless Joseph agreed to cut him in on the customized product end of the company’s activity. McStay at some point in mid-2009 agreed to buy whatever interest Kavanaugh claimed to have in Earth Inspired Products out, which was done by McStay signing over to Kavanaugh title to a BMW and making a series of payments to him, the last of which was due to be made at the time the family disappeared.
Subsequent to the family’s disappearance, Kavanaugh approached Joseph McStay’s mother, Susan Blake, and Merritt, and the three became involved in an effort, which also included Joseph McStay’s half-brother Mike McStay, in keeping Earth Inspired Products afloat until Joseph McStay made what was hoped would be Joseph’s eventual return. Ultimately, Kavanaugh took well over $100,000 out of the business for himself and then horned in on the ownership of the company, ultimately selling it in June 2011.
McGee, Maline and Guerard contend that Kavanaugh had motives for killing Joseph McStay in the form of revenge and greed, which Merritt did not possess. The two law enforcement agencies that dealt with Kavanaugh on issues relating to the McStay family – the San Diego Sheriff’s Department which was looking at the matter as a multiple missing persons case in 2010 and the San Bernardino County Sheriff’s Department which focused on it as a murder investigation after the family’s bodies were found in 2013 – satisfied themselves that Kavanaugh was not involved based upon his claim to have been in Hawaii at the time of the family’s disappearance.
In 2009 and 2010, Joseph McStay and Dan Kavanaugh had PayPal accounts, which they used for both receiving and making payments via the internet. LaRock was provided with the records of their transactions using the PayPal system, which contained data relating to each individual transaction, the amount, the entity being paid or paying, the amount of the transaction, the date and the internet protocol address, also known as an IP, from which the transactions are made. An IP address provides the location of the device using it to access the internet.
With Kavanaugh’s PayPal records for 2010 being displayed on the courtroom’s overhead display monitors, Maline asked LaRock about the IP address – 66.91.7.2 – of the computer Kavanaugh was using on January 14, 2010, when he made three contacts with PayPal.
“Is that IP address associated with a region?” Maliine asked.
“Yes,” said LaRock.
“And what is that?” Maline asked.
“That IP address is associated with Hawaii,” responded LaRock.
“What about the next entry?” asked Maline. “It looks like there is a 12-day gap.”
“That’s right,” La Rock said. “January 26 is the next entry.”
“The time is 4:47,” said Maline.
“4:47 a.m.,” said LaRock.
“And now we have a new address, 70.95.69.75,” Maline said. “What area is that IP address associated with?”
“The San Diego area,” LaRock said.
The document showed Kavanaugh having contact with PayPal using the 70.95.69.75 IP address nine times in total on January 26; once on January 27, 2010 using the 70.95.69.75 IP address; having contact with PayPal once on February 5, 2010 from the 70.95.69.75 IP address; once on February 6, 2010 from the 70.95.69.75 IP address; having contact with PayPal once on February 8, 2010 from the 70.95.69.75 address; having contact with PayPal once on February 10, 2010 from the 70.95.69.75 address; having contact with PayPal three times on February 11, 2010 from the 70.95.69.75 address; having contact with PayPal once on February 12, 2010 from the 70.95.69.75 address; having contact with PayPal three times on February 13, 2010 from the 70.95.69.75 address; having contact with PayPal twice on February 14, 2010 from the 70.95.69.75 address; having contact with PayPal three times on February 15, 2010 from the 70.95.69.75 address; having contact with PayPal four times on February 16, 2010 from the 70.95.69.75 address; and having contact with PayPal once on February 17, 2010 from the 70.95.69.75 address, after which point his contact with PayPal is made from a completely different IP address, 208.54.4.52, a T-Mobile address associated with Southern California in general.
Throughout the period from January 26 until April 17, when he begins using an IP address associated with an area in Washington State, Kavanaugh’s interaction with PayPal takes place from IP addresses in California.
Thus, in his testimony under direct examination by Maline, LaRock appeared to controvert the alibi Kavanaugh asserted, and which the law enforcement agencies dealing with the McStay family matter seemed to have accepted, which was that Dan Kavanaugh was not in Southern California or the San Diego area at the time of the murders.
In cross examining LaRock, Supervising Deputy District Attorney Britt Imes attempted to erase the impression that LaRock had provided relating to Kavanaugh’s presence in the San Diego area at the time of the murders. Projecting on the courtroom’s overhead display monitors Kavanaugh’s cell phone records from January and February 2010, he asked LaRock, “Are you familiar with what the 808 area code is?”
After LaRock said that he was not, Imes called upon LaRock to use his electronic device to ascertain the geographical region associated with the 808 area code. After defense objections, there followed a sidebar conference among the defense team and the prosecution with Judge Smith, after which Judge Smith agreed to take judicial notice that the 808 area code pertains to Hawaii. The page from Kavanaugh’s phone records which Imes displayed showed 19 phone calls, 15 outgoing and four incoming on the dates of January 31 and February 1, 2010, of which 16 had the 808 prefix. The three others reflected the 805 area code associated with San Luis Obisbo and its environs, the 949 area code associated with San Diego County and the 707 area code, associated with the San Francisco Bay area.
At another point in his cross examination of LaRock, Imes explored whether a VPN – a virtual private network – could obscure the actual location of a computer user logged onto the internet, in fact hiding the user’s IP address.
“A virtual private network will reflect an IP address for the network, not the device using the network, correct?” Imes asked.
“Generally speaking, that’s true,” LaRock said. “A virtual private network can be more complicated than that, but in general, yes.”
“And a virtual private network is commonly used by individuals to mask their IP address and location, correct?” Imes asked.
“It frequently is, yes,” responded LaRock.
Imes got LaRock to acknowledge that those logged into a virtual desktop environment or a VPN can use an IP address of a centralized network and not the IP address of the user’s individual device, and that there is a “plethora” of technologies to “mask” IP addresses and “spoof” IP addresses.
Imes suggested LaRock, a servant of the defense bar, has crossed over to the dark side, and is a tool of criminals and murderers, with whom he is on good terms. Imes said LaRock had lost his objectivity, which was reflected in LaRock referring to Merritt as “Chase.”
“So being that familiar with someone and referring to them by their nickname, that’s not very objective is it?” Imes asked LaRock.
“Actually I believe that is objective in this case,” responded LaRock.
Imes noted that LaRock used what he called “subjective” terminology in his reports, such as the word “notably” and the phrases “potentially very important” and “especially significant,” as well as “good business relationship” along with “significant source of income.”
“Using words like significant, especially and notably – those are subjective terms, aren’t they?” Imes asked.
“I suppose they can be defined that way,” said LaRock. “I think that in the context of my reports it was entirely proper to use those.”
In many of his questions, Imes implied or directly stated that LaRock had not done a thorough and complete analysis of all of the evidence. Imes also referred to a list of issues that LaRock had put together highlighting the areas he had investigated which he anticipated he would be questioned about as his “trial script.”
Imes explored the amount of money LaRock had made off of the case.
“How much are you getting paid for your services since 2015?” Imes asked.
“My company is charging $350 per hour,” LaRock answered.
“And how many hours have been billed since 2015?” Imes asked.
“I don’t have an exact number,” said LaRock. “It’s definitely more than 300. I believe it’s more than 350.”
“$122,000 since 2015,” said Imes, disgust welling in his voice.
“That’s correct,” said LaRock. “To my company.”
“In the world of criminal cases, you’ve handled how many cases?” Imes inquired.
“I’ll give an estimate,” LaRock said. “I’ve personally probably worked on I’d estimate between 75 and 100 criminal cases.”
“How many were for the Federal Public Defender?” Imes asked.
“I don’t know that as I sit here,” said LaRock. “I could try to estimate.”
“It’s important on your resume to list the scope of work you have done over the years,” Imes said. “Would that be fair to say?”
“I think it’s important to list examples of the work I’ve done,” LaRock said.
“And so in the criminal world you’ve worked for the Federal Public Defender, the Orange County Public Defender, the Riverside [County] Public Defender and several private defense firms,” said Imes. “Is that correct?”
“That’s a portion of the work I’ve done, yes” said LaRock.
“And has your firm ever been used or utilized by a law enforcement agency?” Imes asked.
“By a law enforcement agency? No,” LaRock said. “Not to my knowledge, at least.”
“Or a prosecutorial office?” Imes added.
“Same answer,” said LaRock.
LaRock’s testimony began late Tuesday and lasted through Wednesday and Thursday. There was no testimony on Monday because Merritt had been routed by the jail system to undergo a medical examination that day.
Early Tuesday Annette Dron, who had been a customer service representative supervisor for QuickBooks in 2010, was called to the witness stand by the defense. Her questioning by Maline was intended to attenuate the damage that had been done to his client by the testimony provided earlier in the trial by one of the QuickBooks customer service representatives Dron supervised, Ryan Baker. Baker had fielded a call from an individual purporting to be Joseph McStay on February 9, 2010, a day after the same individual, whom the prosecution has implied and the defense has all but conceded was Merritt, had made a call to another QuickBooks customer service representative, Sean Augustine, on February 8, 2010. Baker testified the caller had asked to have the account data deleted, which the prosecution maintains was an effort by Merritt to destroy evidence of the checks he had forged. The defense has countered that with suggestions that Merritt was merely acting on Joseph McStay’s desire to move the company’s account information off of QuickBooks’ online system, which McStay was concerned might be hacked by Kavanaugh, onto a more secure desktop program, which Kavanaugh would not be able to get access to. The defense maintains Merritt’s’ interaction with Augustine was a request to obtain the desktop program, known as QuickBooks Pro, and get it up and running and transfer the account data from the online program into it. His call to Augustine thus provided the proper context for the call to Baker and the request made of him, the defense contends.
Maline asked Dron if it was common for people to want to make the transition from the online version of QuickBooks to the desktop version.
“In the beginning people were very nervous about having their data somewhere else, and they were worried maybe someone would hack into it or the data would get deleted or corrupted, and so they would decide they wanted to go to QuickBooks Pro,” Dron said.
“Was it uncommon for somebody that had QuickBooks online to request QuickBooks Pro?” Maline asked.
“No,” said Dron.
“That happened all the time,” Maline said.
“Yes,” said Dron.
“Was it uncommon for a person who did that, who switched from QuickBooks online to QuickBooks Pro, to then cancel their QuickBooks online?” Maline asked.
“Objection, speculation,” Deputy District Attorney Melissa Rodriquez said.
“Overruled,” said Judge Smith.
“Yes,” said Dron.
“And why would that be?” Maline asked. “Why would that be not uncommon?”
“For the same reasons,” Dron said. “Where someone may be cancelling the subscription, they don’t want to pay for the subscription, they want to back up their data. QuickBooks online didn’t have all the features QuickBooks Pro had, so sometimes they found the online version wouldn’t work for them, and they wanted to go back and use something they were more comfortable with. There were many, many reasons.”
“And would customers not only cancel their QuickBooks online subscription, but ask that that information be deleted?” Maline asked.
“Objection, speculation,” protested Rodriguez.
“”Overruled,” Judge Smith said.
“Yes,” Dron answered.
“And why would that be?” Maline asked.
“I don’t remember a whole lot, but it was a pretty common thing,” Dron said. “Most of the time it was because they just didn’t feel comfortable with their data online at that time.”
“And what did you tell Detective [Troy] DuGal about this transaction?” Maline asked, referring to the San Diego County sheriff’s detective who was investigating the disappearance of the McStay family in 2010.
“I couldn’t find anything that was out of the ordinary from the cases I had seen,” said Dron. “It was all normal behavior.”
On cross examination, Rodriguez asked, “When somebody would call into QuickBooks and get information, is it fair to say that only the master administrator could request that the company be deleted?”
“That’s correct,” said Dron.
“And so when somebody called in and gave the telephone number of Joseph McStay and said they were Joseph McStay, was able to provide specific company information, the person receiving that call would essentially take that at face value, right?” asked Rodriguez.
“Correct,” Dron said.“There was a call, then, on the 9th to delete some of the data, right?” Rodriguez asked.
“Correct,” Dron said.
“And you have no way of knowing whether that company had actually been transferred onto a desktop version when that call came in on the 9th, right?” Rodriquez asked.
Don acknowledged that was the case.
“And so if that data had not yet been transferred, would it be a little more unusual to have somebody requesting to delete an entire company without transferring the data?” Rodriguez asked.
“People didn’t always transfer their data and then delete, but it would be more unusual,” Dron said.
Sandwiched between the testimony of Dron and LaRock on Tuesday was that of Sarah Kane, a custodian of records and a law enforcement fulfillment analyst for PayPal.
Kane went through records pertaining to the PayPal accounts of both Joseph McStay and Dan Kavanaugh, consisting of both transaction logs and activity logs relating to those accounts, shedding light on what the data contained in those records demonstrated.
In a seemingly straightforward response to questions being put to her by Maline, Kane, like LaRock would do after she left the stand, brought one of the elements in the case that the prosecution is relying upon to impute Merritt’s guilt into doubt. She confirmed that when Joseph McStay sought to add his wife as a third party to the PayPal account on February 3, 2010 using the Italian-sounding last name Martelli, he had entered it as “summer martelli,” using lowercase letters entirely. This registered with at least some courtroom observers as another indication that the prosecution had overreached in assigning responsibility to Merritt for having written the February 1, February 2, February 4, February 5 and February 8 checks based upon the way in which the payee’s names were left uncapitalized.
Kane’s testimony ran in Merritt’s favor in an even more pointed way, however, in that she advanced, more than LaRock had, the defense’s alternate suspect theory.
During her testimony with regard to both the activity and transaction logs on Joseph McStay’s PayPal account, she explicated how on February 10, 2010, six days after the McStay family’s disappearance, there was a failed log-in attempt on Joseph McStay’s PayPal account. That was followed by the resetting of the password for Joseph McStay’s account, carried out from a device with the 70.95.69.75 IP address, that corresponding to Dan Kavanaugh, on February 12. Thereafter, Joseph McStay’s PayPal account sent an $800 payment to Dan Kavanaugh.
Kane’s testimony appeared to have gotten under Imes’ skin.
In cross examining her, he did not miss the opportunity to suggest that the defense team or its members might have altered evidence Kane had presented in their client’s favor.
“Do you know exactly how these records are prepared?” Imes asked.
“Yes,” said Kane.
“How?” Imes asked.
“We have a series of systems, passive systems, and when we get a request we process it by searching for the item as provided,” Kane said. “So we pull the records, we have to log into the transaction log and put it into the form of an Excel spreadsheet that is provided.”
“You provide some information in a secured PDF, correct?” Imes asked.
“Yes,” Kane said, “the subscriber information, that is provided.”
“But the transaction stuff is sent in a spreadsheet,” said Imes.
“An Excel spreadsheet,” said Kane.
“It’s not protected, is it?” Imes asked.
“When we send it, yes,” said Kane.
“It is?” Imes intoned incredulously. “The ones that were sent – the ones I see here aren’t protected, were they?”
“I do not know,” Kane said.
“So, if I hit delete, I can make transactions disappear,” Imes said, and then hit the delete button on his laptop computer, thereby deleting elements of the spreadsheet that was visible on the courtroom’s viewing monitors.
“You just did,” said Kane.
“Did you or Mr. McGee or Mr. Maline have to enter a password to get into that spreadsheet?” Imes asked.
“No,” Kane said.
“So then it could be altered in some way by anyone, correct?” Imes asked.
“Objection,” McGee protested. “Calls for speculation.”
“Overruled,” said Judge Smith.
“If it’s not password protected, that information could be corrupted, couldn’t it? Imes pressed.
“Potentially,” Kane said.
“Potentially?” said Imes. “Did you have an opportunity to go over line by line, sheet by sheet to make sure the information provided was exactly the same as was found in the exhibit?”
“Yes,” Kane said. “I reviewed all of the records.”
“Well, one is like 600 pages long,” said Imes. “You went through all 600 pages?”
“When I pulled the accounts, I made sure they were there, yeah,” Kane said.
“So you compared every line of transactions and every sheet of every document you sent to make sure they were the same as those that were transmitted by PayPal,” Imes said.
“Not in detail,” said Kane, “but when we pulled from our systems, it has all of the transactions and all of the activity between the dates we request.”
At one point, in a show of the utter disdain he had for the witness, Imes said, “At this point, Your Honor, I move to strike her testimony. She’s an incompetent custodian of records.”
“Overruled,” said Judge Smith.
Present for much of this week’s testimony was Joseph McStay’s mother, Susan Blake. When she was asked her reaction to the evidence and testimony relating to Kavanaugh, Blake told the Sentinel, “I don’t have a statement at this time.”