.png)
Yorgen Fenech compilation of evidence: Europol experts cross-examined
Europol experts are cross-examined by the defence in the compilation of evidence against Yorgen Fenech, the alleged mastermind of the Daphne Caruana Galizia murder
2 December 2020, 10:07am
Matthew Agius
Matthew Agius
2 min read
Daphne Caruana Galizia murder suspect Yorgen Fenech
Two Europol officials were cross-examined by Yorgen Fenech's defence team in a sitting that focussed on procedural measures adopted by the foreign experts in extracting data from electronic devices.
The cross-examination came two days after the Europol experts submitted in court hard drives containing four terabytes of data extracted from various electronic devices confiscated by the police in November 2019.
Fenech's compilation of evidence is expected to continue on 12 January. He stands accused of masterminding the murder of Daphne Caruana Galizia.
The data was extracted from mobile phones, laptops, SIM cards and other devices lifted from the Portomaso business tower and Fenech’s yacht, the Gio when he was arrested in November 2019. A team from Europol had come to Malta and granted sole access to a room at the Malta Security Service quarters from where they worked to extract data from the devices.
Today's cross-examination revealed nothing new and so far, the contents lifted from the devices remain under wraps with the court warning all parties not to share the information with third parties unrelated to the case.
The evidence against Fenech primarily rests on the testimony of Melvin Theuma, the middleman in the murder. Theuma, who had secretly recorded various conversations between himself, Fenech and others, was given a presidential pardon to tell all last year.
Magistrate Rachel Montebello is hearing the compilation of evidence against Fenech.
The defence lawyers are Marion Camilleri, Gianluca Caruana Curran and Charles Mercieca.
The prosecution is being led by Superintendent Keith Arnaud and Inspector Kurt Zahra, assisted by the Attorney General.
Lawyers Jason Azzopardi and Therese Comodini Cachia are appearing parte civile for the Caruana Galizia family.
16:14 That's it for today. Thank you for following.
Kurt Sansone
15:58 The next sitting is on 12 January at 10am.
Kurt Sansone
15:54 A bail decree was not received by the parties, despite being in the system. Bail appears to have been rejected as the accused is still in custody.
Kurt Sansone
15:48 The court and parties are thrashing out the next procedural steps.
Kurt Sansone
15:47 “That's all,” Zahra says.
Kurt Sansone
15:47 The witness replies in the negative.
Kurt Sansone
15:47 The witness is shown exhibit delivery papers. Were there other exhibits he gave to the inquiring magistrate?
Kurt Sansone
15:46 Meanwhile, Inspector Zahra is to ask a few questions.
Kurt Sansone
15:46 Mercieca says the witness' deposition is suspended to avoid a repeat of what happened with the Schembri testimony, where the defence says, it was deprived of an opportunity for cross-examination. The court upholds the request and allows the prosecution to continue its questioning next time.
Kurt Sansone
15:38 Mercieca is arguing that the data is not isolated, while the witness is insisting it is.
Kurt Sansone
15:37 Petrou: “It is password protected and protected by log-on credentials.”
Kurt Sansone
15:37 Mercieca: “How is access granted?”
Kurt Sansone
15:37 Petrou: “I will check.”
Kurt Sansone
15:37 Mercieca: “Who has access to the data from your team with regards to this case?”
Kurt Sansone
15:27 Mercieca asks the witness to prepare the SIENA messages and a list of all the exhibits he has worked on concerning the explosion in Bidnija for the next time he is summoned. Also, the list of magistrates he has spoken to about the case.
Kurt Sansone
15:25 The court says that today's sitting was about a different task for which the witness was appointed, not the one two years before.
Kurt Sansone
15:22 Mercieca says the defence is finding difficulty in accessing evidence submitted by Petrou in other parts of the investigation.
Kurt Sansone
15:22 An issue on whether the questioning is relevant emerges. Lawyers Marion Camilleri and Gianluca Caruana Curran say the recordings of Melvin Theuma are an integral part of these proceedings. Magistrate Montebello says that for Melvin Theuma, the inquiry is separate and the process verbal is not part of these acts.
Kurt Sansone
15:10 Petrou: “I don't recall. I can't remember.”
Kurt Sansone
15:10 Mercieca: “Did you extract any information from exhibits relating to Melvin Theuma?”
Kurt Sansone
15:10 But the witness says he had not worked with her on this case.
Kurt Sansone
15:09 Questions turn to Yulia. “She is a seconded national expert,” Petrou says. “We are on the same level, under the team leader.”
Kurt Sansone
15:08 Lawyer Gianluca Caruana Curran sits down next to the accused and exchanges some words with him.
Kurt Sansone
15:08 “Sami and I are in the same team. Normally, we don't send SIENA messages in the same team,” Petrou says in response to a question as to why the information was transmitted verbally.
Kurt Sansone
15:07 The Europol expert says he was told about the sitting about two weeks ago. The information was given verbally, he says.
Kurt Sansone
15:06 The magistrate notes that the cross-examination is on the examination in chief.
Kurt Sansone
15:06 The court has had enough of Mercieca, who says the defence didn't know if Europol was going to testify. “Come on, come on. This is an insult. The defence has known for a long time that the Europol experts were coming,” says the magistrate. She stops him from trying to extract information from the witness.
Kurt Sansone
15:05 Petrou: “I do not remember because I was not asked to prepare for this.”
Kurt Sansone
15:04 Mercieca: “Did you receive a SIENA message relating to the case in 2017?”
Kurt Sansone
15:03 The lawyer now asks about the SIENA messages. “I receive only the messages pertinent to my job,” says the witness.
Kurt Sansone
15:03 Petrou says that from 2019 he gave his report. Before that, he doesn't remember. The court points out that the man had not been asked to prepare for things which he didn't testify about himself. “If anything, summon the witness as a witness for the defence,” the magistrate says.
Kurt Sansone
15:01 Mercieca: “With regards to this case what other exhibits did you examine from 2017 today?”
Kurt Sansone
15:00 Mercieca asks if the Europol team had presented anything before Magistrate Neville Camilleri, who is leading the inquiry into the murder of Daphne Caruana Galizia. “No,” Petrou replies.
Kurt Sansone
14:50 Petrou: “I am not aware if my colleagues reported to another court.”
Kurt Sansone
14:49 Mercieca: “Are you aware if your colleagues reported to another court?”
Kurt Sansone
14:42 Petrou: “This one.”
Kurt Sansone
14:42 Mercieca: “How many courts did you report to?”
Kurt Sansone
14:41 Petrou says that no one else from Europol arrived with him on the 29th.
Kurt Sansone
14:40 Petrou: “To this court... If I'm not mistaken it was with Mr Camilleri.”
Kurt Sansone
14:40 Mercieca: “Who did you report to with regards to courts?”
Kurt Sansone
14:37 Petrou says Sami and he joined Europol on the same day… Sami was nominated as single point of contact with the Maltese authorities.
Kurt Sansone
14:36 Mercieca asks how he knew what to bring with him to Malta. “I've been doing this job for 17 years... I know what will be needed,” he replies.
Kurt Sansone
14:35 Before the SIENA message was received on 21 November, he was informed informally of the request for assistance. Petrou arrived on the 20th late in the evening in 2019. “I wasn't even present for the house searches, in fact,” he says.
Kurt Sansone
14:31 Witness doesn't know if the SIENA messages are still in the system. It is not his area of expertise.
Kurt Sansone
14:28 AP weapons and explosives received the Maltese request for assistance. IT was later assigned to his team, he says.
Kurt Sansone
14:27 He started working with Europol in 2013. Petrou is a senior specialist, forensic examiner and investigator. “My job is to perform forensic actions on digital exhibits,” he says.
Kurt Sansone
14:22 Petrou has been in law enforcement since 1996. He joined straight out of high school, he says.
Kurt Sansone
14:21 Europol expert Constantinos Petrou is called to the stand next. He also testified in last Monday’s sitting.
Kurt Sansone
14:21 Totaro's cross-examination is over. He leaves the courtroom.
Kurt Sansone
14:21 Totaro: “Sami Armoyne, my colleague provided the exhibits. Apart from those provided by Yulia Toma.”
Kurt Sansone
14:20 Totaro's deposition continues, with him confirming the corrections which he has just made. Mercieca's cross-examination of Totaro continues. He asks who provided the exhibits.
Kurt Sansone
14:19 While the court is dictating a note to the registrar, Fenech stands up and huddles with his lawyers. “Don't forget,” are his closing words.
Kurt Sansone
14:19 The request is granted and Inspector Zahra takes over.
Kurt Sansone
14:15 Arnaud asks for permission to leave the hall as he is required elsewhere. The defence pretends to object, in jest.
Kurt Sansone
14:14 Arnaud suggests that the witness correct the report today and sign. Defence says he should present an updated report. Court says expediency requires otherwise. Mercieca insists that the mislabelling of the hard drive “doesn't appear to be a lapsus calami” but a conscious decision by the Europol team. The defence lawyer is requesting that the hard drives having the serial numbers indicated in the report are presented in court. Meanwhile, Totaro is correcting his report.
Kurt Sansone
14:05 More document serial numbers and corresponding exhibits are read out.
Kurt Sansone
14:04 Totaro: “When I finished the extraction. It is in the log of the hard drive.”
Kurt Sansone
14:03 Arnaud: “Do you know the date when you put the exhibit safe?”
Kurt Sansone
14:03 Totaro: “In the same condition it is now. It was always separated from the iPhone.”
Kurt Sansone
14:03 Arnaud: “With regards to the exhibits, can you tell us the condition of the SIM card when it was received and when it was placed inside the safe at Europol?”
Kurt Sansone
14:02 More questions about the chain of custody follow.
Kurt Sansone
14:01 Arnaud: “The witness is the provider.”
Kurt Sansone
14:01 The court points out that the report also states that it cannot be used in judicial proceedings without the permission of the provider.
Kurt Sansone
14:00 The prosecuting superintendent is asking about the code numbers on the report. “They are assigned to the SIENA report,” Totaro says.
Kurt Sansone
13:58 Arnaud asks some questions now.
Kurt Sansone
13:58 Totaro: “No… to the best of my knowledge only I and the team members had access to this room. The exhibits stayed in the room.”
Kurt Sansone
13:57 Merceca: “Do you know the locality?”
Kurt Sansone
13:57 He is asked about the room where he saw the evidence. “It is in the Malta Secret Services location,” he replies.
Kurt Sansone
13:57 Totaro mentions his team members again. “I don't remember any other interaction. I remember there was an analyst from Europol but I didn't interact with him.”
Kurt Sansone
13:56 Mercieca: “During your stay in Malta – two or three days - which other Europol members did you interact with?”
Kurt Sansone
13:50 Totaro: “I arrived with Konstantinos. As far as I remember Sami was already in Malta. Yulia, I don't remember if she was already in Malta.”
Kurt Sansone
13:50 Mercieca: “Who else did you arrive with from your colleagues?”
Kurt Sansone
13:49 Totaro: “With regard the exhibits in question, no. I had them after 26 October 2020.”
Kurt Sansone
13:48 Mercieca: “Did you, at any point before 26 October 2020, interact with the exhibit, being Fenech's mobile phone?”
Kurt Sansone
13:47 The witness is shown two boxes containing hard drives. He looks at the hard drives and confirms that these are not the ones mentioned in the report. Set C 1 and 2 correspond to what is written in the report, he says.
Kurt Sansone
13:47 The court session resumes and Magistrate Montebello emerges from her chambers.
Kurt Sansone
13:25 Mercieca informs the court that they would like to suspend the cross-examination until the hard drives are brought back and rechecked by the expert.
Kurt Sansone
13:18 There appears to be a mistake on the nomenclature used for the data sets, which has led the defence to question the existence of the devices on which they are.
Kurt Sansone
13:14 Mercieca says that his question relates to the actual hard drives.
Kurt Sansone
13:12 Totaro: “Yes, I confirm.”
Kurt Sansone
13:12 Mercieca: “Do you confirm that set A and set B are the same, which you exhibited with your colleagues two days ago?”
Kurt Sansone
13:07 Mercieca reforms his question. Does the witness confirm that he had exhibited certain, identified, exhibits? “It was getting lost in translation,” says Mercieca.
Kurt Sansone
13:05 An argument erupts between the defence and prosecution after Mercieca tells Inspector Kurt Zahra not to interfere (tindaħalx), when he objects to a question made to the witness.
Kurt Sansone
13:01 Mercieca asks for a copy of a set of data relating to a table in the report. The witness says he had submitted it in his report two days ago.
Kurt Sansone
12:58 Mercieca asks who could give a list of people who accessed the device. The witness says according to the delivery paper, his team leader Sami and the other analyst. “It was kept in the safe, which is accessible to the digital forensic unit team,” he says, answering a question by Merciceca.
Kurt Sansone
12:54 The bags are handed to the court registrar, who hands them to the expert witness. He confirms that the number of the evidence bag is correct.
Kurt Sansone
12:53 Mercieca asks if he can open an evidence bag, making as if to open it. “Wait (stenna),” says Yorgen Fenech.
Kurt Sansone
12:52 Totaro: “The exhibits are always at the Europol HQ. They cannot leave the HQ.”
Kurt Sansone
12:52 Mercieca: “So you don't know what your colleague did with the phone.”
Kurt Sansone
12:52 He says that for specific details his colleague would be able to answer better.
Kurt Sansone
12:51 Totaro: “I can say that nobody accessed the phone after the 26 October.”
Kurt Sansone
12:51 Mercieca suggests that he could not tell the court how many people had accessed the phone.
Kurt Sansone
12:47 Totaro says he had but the phone was worked on at the Europol HQ over the span of two or three days.
Kurt Sansone
12:44 Mercieca: “Did you work from home during the pandemic?”
Kurt Sansone
12:44 The witness says he hadn't spoken about the phone or the case directly.
Kurt Sansone
12:43 Mercieca: “Did you exchange words with your colleague when she handed you the phone in the open evidence bag?”
Kurt Sansone
12:42 The Europol expert says the phone was kept isolated in flight mode.
Kurt Sansone
12:40 The phone was not allowed to be turned off after that and would be continuously charged, Totaro explains.
Kurt Sansone
12:39 Mercieca asks if the expert could determine whether it was the first time the phone was worked on when he saw it the first time. Totaro says he was told that the expert he got it from was going to work on it. He was not aware of any previous operation on it. “My colleague can report on her activities on it… Best practises dictated that once a phone is copied, it must be kept on and charged after isolation,” he says.
Kurt Sansone
12:29 The defence continues to chip away, asking about the equipment and software. Superintendent Keith Arnaud objects, saying that these proceedings are not meant to be revealing Europol's operational capabilities. Meanwhile, the deputy registrar returns with the exhibited phones and hands them over to the defence.
Kurt Sansone
12:24 Mercieca asks who else had worked on the phones besides him. Totaro names a colleague who handed them to him on 26 October. “These are two iPhones with the SIM detached, according to best practises in digital forensics,” he says.
Kurt Sansone
12:22 Mercieca is essentially challenging the chain of custody of the exhibits. He asks the court for the mobile phones and SIM cards exhibited by the witness last Monday. He continues his cross-examination on other topics while the court messenger brings the items to the courtroom.
Kurt Sansone
12:13 Totaro says it was not possible to unlock some of the exhibits so he took the decision to bring the devices back to Europol where larger computers would be used to crack the device security.
Kurt Sansone
12:03 The defence is asking about everything linked to the report, from evidence bag numbers to data acquisition to data hash values. It makes for dreary following.
Kurt Sansone
12:02 The witness asks to be allowed to sit down because of pain. This is granted.
Kurt Sansone
12:02 A hash value is a unique number used as an identifier for data.
Kurt Sansone
12:01 He is being asked about data hash values.
Kurt Sansone
12:00 The witness confirms that the procedure was not filmed.
Kurt Sansone
12:00 Totaro: “In the room provided by the Maltese authorities.”
Kurt Sansone
11:59 Mercieca: “Where did you carry this out?”
Kurt Sansone
11:59 Totaro: “Me.”
Kurt Sansone
11:59 Mercieca: “Who physically analysed them?”
Kurt Sansone
11:58 Totaro: “I photographed them. Fenech was not present.”
Kurt Sansone
11:58 Mercieca: “Who photographed the exhibits? Was Fenech present?”
Kurt Sansone
11:58 Totaro: “I can't say who sees then because I received it from my colleague Sam.”
Kurt Sansone
11:57 Mercieca: “Your report refers to exhibits seized in 2019. Who sees the exhibits?”
Kurt Sansone
11:57 Mercieca is chided by the court for not wearing his mask.
Kurt Sansone
11:56 The reply is incomprehensible without having the report in front of you.
Kurt Sansone
11:56 A second and third request are also mentioned in the report. Mercieca asks from whom did these requests come. He refers to the message in the requests.
Kurt Sansone
11:55 Totaro: “It came from the Maltese police Europol Unit.”
Kurt Sansone
11:54 The report mentions a request. “Who did it come from?” Mercieca asks.
Kurt Sansone
11:54 Mercieca asks about the second SIENA message but the witness doesn't recall when it was received. It had information and referred to the first message, Totaro says. “It basically said what was reported in the report,” he adds.
Kurt Sansone
11:53 Totaro: “I have access. I don't know who else has access to this message.”
Kurt Sansone
11:53 The message was referring to SIENA messages on the background section of his report. It was sent on 21 November 2019. Mercieca asks who had access to it.
Kurt Sansone
11:52 Totaro: “I saw this message.”
Kurt Sansone
11:52 Mercieca: “Did you see it?”
Kurt Sansone
11:52 Weapons and explosives and digital forensics received the message in question, the witness continues.
Kurt Sansone
11:50 Mercieca asks if law enforcement has access. The witness explains that not all law enforcement because access is based on the role.
Kurt Sansone
11:50 Mercieca asks who has access to the system. “Do I have access? No,” Totaro says, adding that his access is through his role at Europol.
Kurt Sansone
11:48 Mercieca asks where the data was held. “The extraction of the data was done on hard drives I had with me,” the witness replies. He explains that a SIENA message is a secure information exchange between Europol and member states.
Kurt Sansone
11:48 Totaro: “I remember that Konstantinos Petrou told us to go to the court… I only met the magistrate once, when I delivered the exhibits not the report.”
Kurt Sansone
11:47 Mercieca: “Who told you to report to this magistrate?”
Kurt Sansone
11:47 Totaro: “The only contact was when we delivered the exhibits, before leaving Malta in 2019. It was a male magistrate that I delivered the report to but I didn't remember his name.”
Kurt Sansone
11:46 Mercieca: “When you were in Malta did you have any contact with the magistrate who nominated you?”
Kurt Sansone
11:45 Totaro: “The last one was 26 November 2020, to finalise the report. So, the report was finalised on 27 November 2020.”
Kurt Sansone
11:45 Mercieca: “When was the last extraction?”
Kurt Sansone
11:45 Totaro: “Yes.”
Kurt Sansone
11:44 “Let's talk about the extractions in your reports,” begins Mercieca. “You finalised the report after the extractions were carried out, correct?”
Kurt Sansone
11:44 Torri is a former Europol employee. Totaro says he wasn't involved in the case.
Kurt Sansone
11:44 Mercieca asks whether a Marco Torri was in the team. “No,” the witness replies.
Kurt Sansone
11:43 Totaro says he liaised with Sammy Hermona who liaised with the Maltese police. In Malta, he worked with Petro and Torres.
Kurt Sansone
11:42 “The office is in The Hague,” points out Mercieca. “Who did you liaise with in Malta?”
Kurt Sansone
11:42 Totaro: “I don't recall the name. I just reported the nomination... I'm nominated to examine the exhibits that I received for this case 1292035461. It is related to the explosion mentioned in [the report]…”
Kurt Sansone
11:41 The lawyer notes that on page 3 of the report it is indicated that he was nominated with the rest of the team by the inquiring magistrate.
Kurt Sansone
11:40 Totaro: “It's when I finished compiling the report.”
Kurt Sansone
11:39 Lawyer Charles Mercieca refers to Totaro's report, asking what the date on the cover refers to.
Kurt Sansone
11:39 He is asked about his time in America. Totaro says he worked with NASA, the American space agency. He's been with Europol since 2018 and started on the Yorgen Fenech case in November 2019.
Kurt Sansone
11:38 Europol expert Giuseppe Totaro is called to the stand. He is one of the Europol experts who testified in the last sitting. Totaro is asked about his background. He has a PhD in Computer Science and several masters in digital forensics plus a host of other certifications. He was a chief technology officer in the Italian police.
Kurt Sansone
11:37 The court insists that the copies must be handed out in open court and not collected from the magistrate's chambers as suggested by Jason Azzopardi. The acts must be sent to the AG today, the magistrate says. “Nothing and nobody is going to change the procedure before this court. If need be we will wait till February,” she says.
Kurt Sansone
11:36 There appears to have been a misunderstanding on the copies and who and when they are to be given out.
Kurt Sansone
11:02 Lawyer Charles Mercieca says the defence didn't yet have the opportunity to see the content of the hard drives given to them by the experts. “We would like to have another opportunity to cross examine the experts as it is humanly impossible,” he says.
Kurt Sansone
11:02 A knock on the door and the courtroom stands to attention. Magistrate Rachel Montebello emerges.
Kurt Sansone
10:39 Yorgen Fenech has just entered the courtroom. He sits and converses with his lawyers as we wait for the magistrate to emerge from chambers.
Kurt Sansone
10:19 In the last sitting on Monday, the court heard the testimony of three Europol experts, who also submitted hard drives with all the data extracted from Fenech's electronic devices. The acts of the case now contain 4 terabytes of data.
Kurt Sansone
10:11 The lawyers and police investigators are already in Magistrate Rachel Montebello's courtroom. The court is currently tackling its scheduled cases first before the compilation of evidence begins.
Kurt Sansone
10:09 Good morning.
Kurt Sansone
Matthew Agius was Senior Reporter on Law and Court Affairs at MaltaToday from 2014 to 2024...
