In the fifth week of the Charles Merritt murder trial, the prosecution stole a march on the defense, presenting testimony prosecutors say shows the defendant masqueraded as the murder victim five days after he had killed him and his family in an attempt to loot the deceased’s business account. Without giving the defense respite, the prosecution further secured what it hopes will be another advantage by gaining clearance from the judge hearing the case to present evidence and testimony that the defendant’s vehicle was likely at the McStay family home the night the prosecution says the murders took place. The prosecution finished the week with testimony from one of the sheriff’s department’s in-house computer experts that someone, which the prosecution seemed to imply was Merritt, had returned to the McStay home in the wee hours of the morning a little more than three days after the murders and had accessed computers that were in their house.
Merritt is charged with the horrific bludgeoning deaths of the four members of the McStay family. According to prosecutors, while Merritt was participating with Joseph McStay in the manufacturing of high end decorative water fountains and artificial waterfalls, he was pilfering thousands of dollars from Joseph’s company, Earth Inspired Products, through fraud and embezzlement to feed his insatiable gambling addiction. When Joseph McStay learned of those thefts, prosecutors allege, he confronted Merritt on the afternoon of February 4, 2010. That evening, Merritt sojourned from his Rancho Cucamonga home to the McStay residence in Fallbrook, prosecutor’s theorize, where he slaughtered Joseph McStay, his wife Summer, their four-year-old son Gianni and their three-year-old son Joseph, Jr., using a three-pound sledge hammer to bash their skulls in.
Merritt then secreted the bodies for two days, in the meantime fraudulently accessing Joseph McStay’s QuickBooks account for Earth Inspired Products, the prosecution maintains, and on the following day, February 5, 2010, issued himself two checks, both backdated to February 4. He then embarked on a gambling binge at a number of casinos throughout Southern California, according to his accusers, breaking only to take the corpses up into San Bernardino County’s High Desert, an area with which Merritt was familiar, as he had grown up in Hesperia and attended Apple Valley High School for three years. Merritt buried all four along with the hammer he had used to bludgeon his victims in shallow graves he dug in a wash off a rarely-traveled dirt road, according to the prosecution. To throw authorities off his track, confuse the situation and delay a serious investigation into the matter, the prosecution maintains, Merritt drove the McStay family’s 1996 Isuzu Trooper, which yet contained the child seats for Gianni and Joseph, to San Ysidro, where he left the vehicle in a shopping center parking lot less than a half mile from the Mexican border.
The prosecution had energetic plans for the two days available for testimony this week, after the attorneys and judge were monopolized, on Monday and Tuesday, with meetings both in private and on the record outside the jury’s presence to discuss the upcoming presentation of witnesses and evidence. Judge Michael A. Smith, the judge hearing the case, has a normal practice of darkening his courtroom on Fridays.
The week began with what was for the prosecution a seeming victory in the hearing before Judge Smith with regard to getting expert testimony before the jury relating to placing Merritt’s utility truck at the McStay home on the night of February 4, 2010, but in the process of the evidentiary hearing it became more and more apparent that the evidence at issue is somewhat ambiguous and less than entirely convincing that the image of a vehicle caught on a neighbor’s security video matches Merritt’s truck.
The prosecution fared somewhat better on Wednesday morning, when it had the jury hear from a QuickBooks customer service representative, Ryan Baker, who fielded a call from an individual purporting to be Joseph McStay on February 9, 2010. Baker did not make a courtroom appearance but testified via Skype from Virginia, where he lives and has worked for QuickBooks’ parent company, Intuit. Baker, who is substantially blind, was scheduled to undergo retinal surgery the following day. On the day prior to the Wednesday court session, one of Merritt’s defense attorneys, James McGee, had lodged a protest with Judge Smith, objecting to permitting Baker’s testimony to occur outside the context of Baker being in the courtroom, which McGee said violated Merritt’s Sixth Amendment rights to confront his accusers and the witnesses against him in open court. Smith held that the defense’s opportunity to cross examination Baker by Skype was adequate protection of Merritt’s rights.
After the Skype hook-up was made, a real time video of Baker in the side-by-side Skype format with that of the individual questioning him in direct examination, in this case San Bernardino County Deputy District Attorney Melissa Rodriguez, and the individual questioning him during cross examination, Merritt’s defense co-counsel Raj Maline, was patched through to be displayed on the courtroom’s overhead and sidewall viewing monitors so the jury and all of the courtroom’s observers could take the exchanges in. The audio from the Skype exchange was played on the courtroom’s sound system.
After getting from Baker rudimentary detail relating to his function as a “tier three support consultant” with Intuit/QuickBooks who worked from his residence along with the basic parameters of his function, including his estimation that he handled “anywhere between 25 and 50” service calls a day, Rodriguez delved into the information Baker possessed which the prosecution alleges is relevant to the McStay family murders.
Baker confirmed that he had taken a customer support call on February 9, 2010 at 8:06 a.m. Pacific Time “for” Joseph McStay. Rodriguez further extracted from Baker that he had spoken to San Bernardino County Sheriff’s Detective Dan Hankey in 2014. Rodriguez asked Baker if he had reviewed the notes he had made of the service call at the time and emails he had sent with regard to it and he said he had. She asked if he noted any errors in the notes or emails and Baker said he had not.
Baker testified the caller gave the name of Joseph McStay and a phone number that did not match the number on file for the Joseph McStay account, though the email address the caller used, custom@earhinspiredproducts.com, did match the account. The caller provided a phone number of 909 374-0102, which in previous testimony had been identified as the number for Merritt’s cell phone.
Rodriguez asked whether Baker would have made note of a name other than that of the account holder if the caller had not used the account holder’s name. He said he would have.
Rodriguez inquired about the nature of the call.
“The caller actually advised that they wanted the account deleted from our servers and removed from our system so all the details would be expunged from our system itself,” said Baker.
Baker’s statement lends support to a scenario consistent with a contention central to the prosecution’s case. Prosecutors maintain that on February 5, 2010, the day after the murders, Merritt accessed Joseph McStay’s QuickBooks account for Earth Inspired Products and issued four checks – two to himself and two to the company, Metro Sheet Metal, where the water fountains and waterfalls Merritt built and which McStay sold through Earth Inspired Products. Merritt then printed and deleted any record of the checks from the QuickBooks ledger, according to the prosecution. Prosecutors suggest that Merritt made the February 9 call in an effort to eradicate traces of his forging of the checks.
Rodriguez asked Baker about the “tone and tenor” of the caller’s request.
The caller “wanted to remove all of the business records from our system, wanted it purged directly from our QuickBooks servers so we had it removed altogether,” Baker said.
Rodriguez asked if the caller had given a reason for doing so.
“No,” responded Baker. “They were just very adamant they wanted it taken off of our servers.”
“Did the call appear to be unusual to you?” Rodriguez asked.
“Yes, ma’am,” said Baker. “It was very unusual.”
“Why was it unusual?” Rodriguez asked.
“Business owners are not trying to get rid of their records,” said Baker. “Business owners very much want to protect their data. And even when they are worried about other employees seeing things or having it removed for protection purposes, it is very very unlikely you are going to get a call where someone is very insisting of having it removed from the system itself.”
Rodriguez asked whether Baker had encountered that type of request previously. He said he had “three or four times, but most of the time it had to do with another business owner or someone not having access or someone who had been fired from the business. There was usually other circumstances that are explained during that time.”
As to what would happen to data contained in an online accounting system that was removed as the caller had requested, Baker said, “Once it is purged there is no way to retrieve it.”
“If the caller had asked you about wanting to make a copy of that information, or retaining that information, are there separate instructions you would provide to that caller?” Rodriguez asked.
In response, Baker said that the caller had asked for that in a previous call to another QuickBooks service representative.
Based upon the case information recorded relating to the account, Baker said the caller had wanted to use a different version of QuickBooks than the one that the account was then using. The accounts were password protected, according to Baker, and the account’s master administrator had to acknowledge any changes to the account. Since the caller could not be verified as being the administrator, Baker said he took the security caution of sending an email to the email address of the account’s master administrator, with the instructions or understanding that the account’s master administrator was to send to the QuickBooks customer service desk a return email that would contain the authorization for the requested change to the account.
Since the caller “wanted to delete the accounts” Baker said, the email requesting the authorization was sent to custom@earthinspiredproducts.com and he had instructed the caller to “send it back to me and we would start the process of removing the information from the servers.” Baker said there was no response to the email.
Rodriguez asked what Baker did to follow up on the lack of a response. Baker said he sent a second email informing the customer that a response to the first email to allow the customer service division to comply with the request received over the phone had not been received. To Rodriguez’s further question, Baker indicated a third email had been sent out to custom@earthinspiredproducts.com telling the customer the case was being closed out without any alteration being made to the account.
Raj Maline, one of Merritt’s defense attorneys, cross examined Baker.
Maline inquired about the time Baker had spent preparing for this testimony and whether he had reviewed the notes in the QuickBooks customer service file relating to the file before he had lost his vision. Baker said that he had. Maline asked if the detectives working the case had expressed to him how important his testimony was and if they had told him he needed to provide certain answers. Baker said the importance of his testimony to the case had been expressed to him and that he had made no commitment to propound the prosecution’s version of events but rather, “I told him I wanted to be honest” and that he intended to tell the truth.
Baker said he did not know exactly how long the February 9, 2010 call was but said he remembered it as lasting ten or 15 minutes. He said he had not remembered the call when he was first contacted about it in 2014 by a sheriff’s detective, but that he had reviewed the customer service case file notes relating to it to be able to answer the detective’s questions. Baker said the service call was not recorded.
Maline then referenced a protocol document Baker had signed in 2004 upon becoming an Intuit/QuickBooks service representative, acknowledging that QuickBooks utilized “screen capturing software” which “once activated will record the audio portion of a telephone call until the call is disconnected.” Maline then stated more than asked that the company automatically recorded the customer service calls and that the customer service representative “didn’t have a choice” about them being recorded.
Baker, who has gone on to be a trainer of QuickBooks customer representatives, said, “They did, yes.”
“You knew these were recorded because you mentioned it in your interview with Detective Hankey that these calls are recorded,” Maline said. “Do you recall that?”
“The calls are recorded, yes sir,” said Baker.
“When you pick up a call it is recorded and you have no way of disengaging the recording feature, is that correct, Mr. Baker?” Maline asked.
“I’m not sure,” said Baker, but his answer was obscured by the interruption of Rodriguez’s objection, which was sustained by Judge Smith. Nevertheless, the defense was able to lodge with the jury the suggestion that despite a QuckBooks policy of recording customer service calls, the recording of the call with the individual represented as being Merritt was either not recorded or is not now available, and that Baker’s recollection of what was said during the course of the call, given that he routinely fielded in the neighborhood of 200 calls a week for more than a decade, may have been less than fully exact.
Maline then turned to the consideration that the call Baker fielded on February 9, 2010 was the second one from the caller, whom Maline did not openly acknowledge was Merritt, though such a conclusion seemed to flow from the circumstance. In her questioning of Baker, Rodriguez had made no mention of the call fielded by Baker being a follow-up to a call made the previous day. When Baker had referenced the previous call in response to Rodriguez’s question about whether the caller had wanted to make a copy of the account data that had been requested to be purged, she moved quickly away from the topic. Maline, however, was determined to pursue the implication of that.
“When calls come into customer support, you are supposed to get a history of the customer,” Maline said. “Did you have the previous request from the customer up on that screen from same number to a different support person?” the defense attorney asked.
Baker acknowledged that the caller he had spoken with had reached another customer service representative, who was identified as Sean Augustine, on February 8, 2010.
The original request of the caller had been to convert the account from the online version of QuickBooks into a desk top version of QuickBooks that would not be accessible, or constantly and automatically accessible, via the internet where it was vulnerable to hacking.
“The transfer from online to desktop is pretty normal,” Maline said.
“That is correct,” said Baker.
“If I want to transfer to QuickBooks Pro I can do that and still have all the data online exported to the desk top QuickBooks,” Maline stated, and Baker confirmed that was the case.
Maline in his exchange and questions with Baker suggested that the intent of the caller was simply to make the change from the online version of QuickBooks to the desk top version, at one point asking Baker, “Was the call to transfer from online to desk top?”
“That is correct,” said Baker, but he added later, “He didn’t ask me to do it. He asked me to remove the [account] information from our system. That is two different things.”
Maline, then returned to what the caller’s expressed intent had been on the previous day with Augustine. He read the notation Augustine had made relating to his exchange with the caller, which stated “Wants to transfer data from QuickBooks online to QuickBooks Pro 2010. Needs Help.”
Baker acknowledged that was what Augsitine had noted but said that he did not have those notes at the time he took the call on February 9, 2010.
“The customer just told me they wanted it deleted,” Baker said, emphasizing that the caller was “very adamant to remove it from our system.”
On redirect examination, Rodriguez again returned to how out of the ordinary the call was, asking Baker if it was unusual.
“Very,” said Baker, who then explained to Rodriguez that he found it odd “because business owners want to have their data… The real worry is protection. They don’t want anything to happen to their data.” Most customers, he said, are concerned about “What if something goes wrong? What kind of a backup? What kind of back up to the back up? This is my company information, my livelihood.”
Rodriguez asked if the desk top version of QuickBooks can be accessed online. Baker said it could.
Rodriguez noted that the caller had the custom@earthinspiredproducts.com email address and had “indicated he was Joseph McStay, correct?
“Ummhumm,” said Baker.
The previous day, Tuesday February 5, outside the presence of the jury, Judge Smith held a hearing on the defense’s motion to exclude the testimony of an expert witness, Dr. Leonid I. Rudin, the prosecution is seeking to call.
Rudin is the chief executive officer of Cognitech, Inc, a Pasadena-based business that involves itself in forensic media image processing, using software Rudin invented and patented which is applied to obtain image enhancement and three dimensional analysis of photographs and videos.
Rudin described his software as capable of making an “analysis of an image.” He said his devices “ingest data, analyze that data and produce measurements.”
Put in layman’s terms, Rudin’s invention is used to estimate the size of objects depicted in photographs.
His methodology, Rudin testified, utilizes “triangulation” as well as “forensic photo/videogrammetry” to “estimate the size of something from a single image.”
There are two differing ways of arriving at an estimation of a photographic image, Rudin maintained: classical photogrammetry and forensic superimposition.
In conjunction with the Merritt prosecution, Rudin’s technology was brought to bear on three images, those being the McStay family’s 1996 Isuzu Trooper, Merritt’s truck and that of the bottom portion of a vehicle which passed within the range of a security video camera at the home of Jennifer Mitchley, who live two doors up and across the street from the McStay Home in the 3400 block of Avocado Vista Lane in Fallbrook on the night of February 4, 2010. It appears from that video that the vehicle turned into the McStay home’s driveway, which is out of the range of the video’s field.
The exercise Rudin engaged in was intended to determine if the vehicle which was captured on Mitchley’s security video was Merritt’s truck, thus placing the defendant at the McStay home, where the prosecution alleges the murders took place, the night the prosecution alleges the murders occurred.
Rudin separately took the images of the Isuzu Trooper and Merritt’s truck captured by a sheriff’s department crime scene specialist operating a high resolution laser scanner, which were converted to three-dimensional models, and then superimposed them upon a three-dimensional rendering of that portion of the vehicle visible in the Mitchley security video. It was quickly and easily determined that the Isuzu Trooper was not a match to the vehicle on the security video.
The outcome of the examination with regard to Merritt’s truck, was less cut and dried, however. According to his findings, Rudin indicated, the image caught on Mitchley’s security camera could be that of Merritt’s truck, although there is a possibility it isn’t.
In this case what was your answer?” Supervising Deputy District Attorney Brit Imes asked.
“The answer was we could not reject it, but there was some guarded error that we derived,” said Rudin. “In this case we derived a certain error that I would say if it grew somewhat more I would be skeptical about this hypothesis, but it was sort of right on the border. So I could not reject. It was within the accepted error at the border of that.”
With the image of Merritt’s truck caught by the sheriff’s department’s laser scanner at the same angle as the angle of the Mitchley video camera to the subject vehicle serving as the background of an image projected on the courtroom’s video monitor, a transparency of the Mitchley video was projected across the background. When the moving vehicle’s image moved into position corresponding to the background image, the video was frozen, with that portion of the truck visible on the video superimposed over the three-dimensional model of the truck.
Rudin said, “I could not eliminate the model as corresponding to the vehicle captured on the video but could not make an identification that it was definitely the truck.”
To Judge Smith’s question of whether the underlying image of the truck was consistent with the superimposed image from the video, Rudin responded, “To say consistent, I would need a few more things. I would actually need processes I would try to do like measuring things. At this point I would not call it consistent or inconsistent.”
“The bottom line is you could not eliminate it,” said Judge Smith.
“I could not eliminate it, no,” said Rudin.
At one point, with the video image superimposed on the image of Merritt’s truck, Rudin used a device contained in the software system to move a cursor to points of correspondence in the images, and clicked on them to highlight them. McGee pointed out that Rudin had found points of correspondence with regard to the headlights and had “clicked” on them but had not shown the same match ups with the parking lights, which at varying points during the exchange were also referred to as running lights. McGee asked Rudin why this was. Rudin said, “Because I was not sure where they were. You have to zoom it and I don’t see them in enough detail to click it precisely.” When pressed, Rudin said he could not see the parking lights/running lights.
McGee asserted the inability to discern the running/parking lights on the security video image of the truck was an indication that the vehicle partially videoed by Mitchley’s security camera the night of February 4, 2010 was not Merritt’s truck.
Rudin said that there was no convincing indication that the images do not correspond, and that part of the process was to begin with the hypothesis that the images correspond and utilize any substantial difference between the images to discard the hypothesis.
“We try, when we can, to destroy the hypothesis,” said Rudin, starting with “whatever reasonable points we see. We started out with four points [of correspondence]. Then we went to six points. Then we went to seven points. And then we went to ten points. We were sure at some point we would break the hypothesis, but we were not able to.”
When asked about where the “errors” were that prevented him from declaring the images were perfect matches, Rudin indicated that when his software program and equipment were utilized to take readings of the truck’s wheelbase, he received conflicting results. Rudin said that the truck’s wheelbase was measured at 10.71 feet and that he had varying measurements of the wheel base of the vehicle depicted on the video of running close to 10.55 feet or 10.56 feet and as low as 10.15 feet. This was, Rudin said, a discrepancy of “up to six percent in the worst case scenario and roughly 3 percent in the average scenario. No matter how we used that truck, we were getting plus-minus. So, what concerned me was the larger error, which if it went beyond to seven-eight percent and it was consistent, I would say it is a test fail, but at this point I would say no test fail.”
McGee, in questioning Rudin, got him to say he had not been requested by the district attorney’s office to produce, nor had he on his own produced, a report of his findings beyond his presentation of the images he was prepared to use in his testimony. Rudin, who acknowledged that he was not accustomed to testifying in court nor in the business of doing so, also told McGee that he had assembled varying images at one time or another while he was preparing for his presentation in court, but had removed some of those and had limited the materials he had put together for final presentation before the jury to materials he considered relevant to what he was being asked to provide.
Over McGee’s protests, Judge Smith ruled that Rudin’s proposed testimony was worthy of the jury’s consideration and he gave the go-ahead for Rudin to testify the next morning, subject to the materials that Rudin would use in his presentation to the jury being provided to the defense team at that point so an analysis of the material could be made to prepare for his cross examination.
On Wednesday morning, however, McGee arrived in the courtroom loaded for bear. Outside the presence of the jury, which was yet in the court hallway and out of earshot of the proceedings inside, McGee said he had been unable to access the documents forwarded to him the previous day by Imes and was thus unable to evaluate them himself or have the defense’s experts examine them as to there content. Incensed, and laboring to keep his voice from thundering, he decried the lack of a conventional report relating to Dr. Rudin’s findings, intimating that what was occurring bordered on, if not exactly constituting a violation of the rules of discovery, something that came damnably close. Discovery is the process by which the defense is to be provided with the materials the prosecution is to use in presenting its case far enough in advance so that the defense can evaluate the evidence, its integrity and prepare itself to react to it in the course of the trial, including cross examining the witnesses presenting it or explicating it for the jury.
McGee pointed out that the previous day Rudin had said there were materials relating to his examination of Merritt’s truck and the images captured on Mitchley’s security video he had “deleted because he found them not to be relevant. He didn’t write reports.” Rudin had derived, McGee said “differing measurements.”
If the prosecutors were going to use Rudin’s findings against his client, McGee said, there was a requirement that they “put it in writing and provide it to the defense so this is not a trial by ambush, but this is a search for the truth. That is what the duty of a trial is, to see what happened, and now we’re playing scramble, trying to figure out how we cross examine a witness without knowing what they’re going to say. This shakes the foundation of due process. I ask that the court enforce the discovery obligations the court has discretion over. This is information we don’t have” which McGee said was forcing him and Maline to “work on cross examination on the fly.” Offering the evidence in the way it is being provided, McGee said, “is creating land mines of due process violations and we stepped on one yesterday. They want to call a witness without giving us everything he did, all the findings he made and so we can properly cross examine him in front of our expert witness. So I think he should be excluded.”
Supervising Deputy District Attorney Brit Imes, who at various points throughout the trial has been bitingly dismissive of defense claims that the prosecution is not fisticuffing by the Marquis of Queensbury rules and has been aggressive not only in defending the prosecution’s sometimes mercurial presentation of witnesses but stingingly critical of tactics the defense has engaged in, was uncharacteristicly mild and perhaps even slightly apologetic in his response.
“The problem is, Dr. Rudin, being the quirky mathematician genius that he is, seems to obsess and continues working despite having what appears to be a completed project, keeps working, keeps working, keeps working, keeps working, trying to solve problems, so it created new data between that last data dump and yesterday’s hearing,” said Imes. “As to the nature of Dr. Rudin’s testimony and production, I’m not so sure that it is susceptible to being written in a narrative-type form report, other than the images he provides, the computer captures that he gives, the video overlays, the still photo overlays. That is his work product and that has been provided. I’m not sure how you right a report as to a mathematical equation. If there has been any form, whether intentional or unintentional, of violation of [the] discovery process, that exclusion of the evidence is the last remedy the court should entertain.”
Judge Smith said he believed the defense had “a very broad general idea of what Dr. Rudin was going to testify to, but certainly not all of the specifics and all of the details.” As such, Judge Smith said he would give the defense time to consult with their own expert, and he delayed Dr. Rudin’s testimony until February 19.
After Baker’s testimony Wednesday morning, Michael Russ, a lead crime scene specialist with the San Bernardino County Sheriff’s Department, testified.
It was Russ who had done, under the supervision and at the direction of Sergeant Ryan Smith, much of the technical collection and processing of evidence relating to Merritt’s truck. That included operating the high resolution laser scanner which provided a host of measurements of the truck as well as the images that were converted to three-dimensional models and then used in Dr. Rudin’s photogrammetric examination and forensic superimpositions with the partial images of the vehicle nearing the McStay family home on Avocado Vista Lane in Fallbrook captured by Mitchley’s security camera on the fateful night of February 4, 2010.
A good portion of Russ’s testimony was devoted to giving the jury a description of the laser scanner, how it is operated and its capabilities. Russ described the scanner as “simply an instrument that uses light detection and ranging to measure things using a laser from the point where the scanner is located out to some distance and back. It measures the distance between that object as returning the laser light to the scanner.” Using the term LiDAR, for Light Detection and Ranging, in reference to the device, Russ said that in the forensic arena, “We use LiDAR scanners to measure crime scenes, to measure objects, to capture, if you will, a 3-D view of a scene, of a location, of a vehicle, of pretty much anything that you want.” Among its various components, Russ said, are a camera, a mirror and a laser, which are used to effectuate and register the multiplicity of scans made from and returned to the device to map out a three dimensional projection of the item scanned, consisting of height, width and depth.
Russ’s presentation with regard to the scanner’s capabilities, coming as it did without the accompanying input of Rudin’s testimony, perhaps did not have the punch for the jury that the prosecution intended and it otherwise would have had if it had been presented back-to-back with that of Rudin.
Under cross examination, McGee took up with Russ his processing of Merritt’s truck, which Merritt had sold in 2011 and was discovered by investigators to be in the possession of a resident of Riverside County. The truck was temporarily confiscated by investigators from the sheriff’s department in August 2014, pursuant to a search warrant.
McGee established that Russ had carried out an exhaustive effort, using alternative light sources and a reagent that glows upon coming into contact with blood or blood traces, in an effort to detect the presence of blood in the truck, both in its driver/passenger cab and in its cargo-carrying hold.
A visual inspection of the truck offered no indication of blood, according to Russ. He utilized the alternate light source and/or the reagent in inspecting the full range of the truck, including the floor board of the cab, the steering wheel, the gear shift, the pedals and the cab’s bench seat, Russ said. He also confirmed, in response to McGee’s inquiry, that he had folded the seat forward to inspect behind it.
Russ said a few false positives were produced in reaction to one of the reagents used. One spot in the cab on the back of the seat showed a presumptive indication of blood, which Russ said he swabbed. He then logged that extraction into the department’s evidence inventory with a registration number of 1442002146 for testing, he said, “should it be deemed to be needed to analyzed.”
On Thursday February 7, one of the alternate jurors was involved in a traffic accident on the way to the courthouse, resulting in proceedings not getting underway until 1:30 p.m.
At that point, Sergeant Ryan Smith, who had testified previously, was briefly on the stand to testify that on October 22, 2015, he and other members of the sheriff’s department had served a search warrant at Merritt’s residence at 1655 Butterfly Drive in Homeland in Riverside County, where they took possession of several electronic devices, including a white Iphone, and a laptop computer which they had found in a bag in the home’s master bedroom.
Thereafter, San Bernardino County Sheriff’s Department Corporal Jason Schroeder was brought in to testify. Currently a patrol supervisor at the Hesperia sheriff’s station, Schroeder was previously assigned as a detective in the investigation division for almost 15 years, including eight in the high tech crimes unit. He has a level of expertise, Schroeder said, in advanced computer forensics and audio and video enhancements.
Schroeder testified that in conjunction with the McStay family murder case he had been provided with a Hewlett Packard computer, which he had designated with the nomenclature “device 5,” and an Emachine T2040 computer, which he designated “device 4.”
The computers had been taken from the McStay residence, according to Schroeder.
He set about “carving out” data from those devices’ hard drives as part of the department’s investigation, which data he said extended to the “internet history and software applications” on the devices.
During his forensic work, Schroeder said, the hard drives were “imaged” and the function of the hard drive was “blocked” so the data contained thereon would not be altered while he was performing his analysis.
According to Schroeder, he detected, by pulling “artifacts” from the computer’s internet cache, that the Emachine had been used at 7:56:24 p.m. on February 4, 2010 to access the QuickBooks website homepage, followed by a related artifact accessed something over three minutes later at 7:59:42 p.m., which was apparently the page for Earth Inspired Products’ QuickBooks account.
Though Schroeder did not say so directly, the prosecution, in dwelling on that access to the QuickBooks account made on McStay’s Emachine computer just around 8 p.m. on February 4, 2010, seemed to be implying that was the last time that Joseph McStay had utilized the computer.
Images of the computer’s registry were shown on the courtroom’s display screens to illustrate the artifacts found to the jury and courtroom observers.
Thereafter, Schroeder, at the guidance of Supervising Deputy District Attorney Sean Daugherty, gave a cursory description of other artifacts and the internet site registry carved out from the computer’s hard drive. Those included brief hits from February 8, 2010 at 2:06:24 when the Google server was accessed; February 8 at 2:06:27 a.m., when an effort at accessing the QuickBooks account was made; February 8 at 2:06:39 a,m. when a site containing Microsoft Office Templates was briefly hit or accessed; February 8 at 2:07:06 a.m. when Dinosaur Train PBS Kids was hit or accessed; February 8 at 2:07 17 a.m. when Stackstone Free Standing Walls For Gardens was hit or accessed; February 8 at 2:07:34 a.m when 17037 Brookhurst Fountain Valley, CA was hit or accessed; and February 8 at 2:07:36 when Capital One was hit or accessed.
Schroeder did not enlarge upon, and Daugherty did not ask him to decipher, those artifacts or registry hits. The reference to them, however, was that someone, perhaps Merritt, had been in the McStay home in the early morning hours of February 8, some three days and a few hours after the prosecution alleges the McStay family was murdered, and had accessed the computers there.
With regard to device 5, the Hewlett Packard computer at the McStay residence, Schroeder said the registry showed an artifact for a QuickBooks hit at 6:08:57 p.m. on February 4, 2010 and a Free Credit Report and Score hit at 6:16:26 p.m. February 5, 2010.
Schroeder also testified that in examining Merritt’s Iphone, he had extracted a photo stream data page that had apparently been accessed by the user at 6:55:53 p.m. on February 26, 2014 which related to an author of a book on the McStay family murders who had shared his theory about the case.
Merritt’s defense attorney Raj Maline had begun his cross examination of Schroeder, during which he was attempting to determine if the rapid series of hits on websites reflected in the registry for the Emachine on the morning of February 8 reflected whether the computer’s user at that point was working from a pull down menu of the sites previously accessed on the computer. That issue was not entirely resolved when the proceedings ended and the jury excused for the week because Judge Smith had to leave for a dental appointment.
On Wednesday afternoon, outside the presence of the jury, Deputy District Attorney Melissa Rodriguez made comments to the judge which reflect the prosecution’s wariness of the degree to which the defense has been focusing on Dan Kavanaugh in seeking to portray him as an alternate suspect in the murders of the McStay family. Rodriguez said she was alarmed by “some of the questions that are being asked of witnesses about Dan Kavanaugh. My concern is that the People are being prejudiced,” she said, by the prosecution continuously having to lodge objections to those questions. “A lot of the objections are being sustained because they [the defense] are asking for multiple levels of hearsay and things like that,” said Rodriguez. She said the prosecution was prepared to sustain references to Kavanaugh having owned his own business that was in some fashion associated with McStay’s business and that Kavanaugh had sold the business, but that the defense was seeking to place before the jurors more than those simple facts relating to Kavanaugh, such as tips made to law enforcement that alleged Kavanaugh had murdered the family and had even bragged about doing so. “My concern is we are getting into We Tips and things like that and multiple levels of hearsay. I have concern that because we are going to put a computer person on tomorrow, that [the defense is] going to be trying to get into Kavanaugh’s computer records and things of that nature. I guess what I would like the court to do is, if the defense would like to go into an area with a witness regarding Kavanaugh, that they offer proof of how it doesn’t violate the court’s 1101 ruling, because if we have to continually object, it looks to the jury like we’re hiding something when we’re compliant with what the court ordered, what the court allowed.”
Section 1101 of the California evidence code relates to the admissibility of information about an individual’s character.
“I made it clear that any dealing Mr. Kavanaugh had with Mr. McStay in Earth Inspired Products before and after his disappearance, any alleged taking of moneys authorized or not, the sale of the business, all of that is relevant,” said Judge Smith. “Obviously, the statement of a witness who said Mr. Kavanaugh confessed to the killings, I said, was admissible. Other areas of Mr. Kavanaugh’s background or comments he might have made in different contexts, I indicated, are not relevant, are not admissible. If counsel were to potentially attempt to go into any of those areas, that would be misconduct, and I would probably admonish the jury about it at the time.”
-Mark Gutglueck