DAY FORTY-SEVEN: Trial Against David Castillo

Last update: June 25 at 1:40 pm

Main Points of the Day

• Through a translator, the defense’s expert witness Shaun Vodde gives a brief presentation about the data found on cell phones in possession of David Castillo, Berta Cáceres, Sergio Rodriguez, and Douglas Bustillo. The two phones belonging to Castillo were either deleted or had a passcode and no data was extracted. The defense questioned Vodde focusing on messages between Berta Cáceres and her contacts that reference security risks. Some make reference to the energy company Blue Energy and a message that talks about “if they lend the piece of land” … “for a bird to land” (“Si prestan el terreno” … “para aterrizar un pájaro”) which the defense has used, in the Honduran media, to try and link COPINH and Berta to drug trafficking.

• The trial will continue tomorrow with questions to expert Vodde from the Cáceres family’s attorneys.

More Details

Defense’s Data Extraction Expert, Shaun Vodde

Shaun Vodde is a US citizen, senior Vice President of Forensic Technology. He’s also a digital forensics and e-discovery consultant.

PRESENTATION

• Timeline: June 28, 2018, entered as experts on the case

  • July 24, 2018: Performed an extraction on Castillo’s two mobile devices

  • August 13, 2018: There were court proceedings and the scope of analysis was expanded to include Douglas Bustillo, Sergio Rodriguez and Berta Cáceres’s phones

  • August 30, 2018: Extractions were performed on Bustillo, Rodriguez, and Cáceres’s phones.

  • November 5, 2018: Went to Tegucigalpa to submit his declaration

• Extractions from David Castillo’s phones: July 24, 2018

  • Iphone 7: Locked and no PIN. Only basic information could be retrieved because no PIN was provided

  • Iphone X: In status of factory reset (attached to a US number). They (Vodde and his partner) observed the expert from the prosecutor’s office doing some sort of update on the phone.

• Extractions: August 30, 2018

  • Berta Cáceres - 5 devices (Blu T901 (phone); Samsung SM-T110 (tablet); Samsung SM-T231 (tablet); Sony Ericsson D5503 (phone); Sony Ericsson Xperia (phone)

  • Douglas Bustillo - Huawei Ascend and LG D508

  • Sergio Rodriguez - Samsung Galaxy S6

• On Berta Cáceres’s devices:

  • Blue T901: There were 299 contacts, 1 audio file deleted, 7 text messages (1 deleted)

  • Samsung SM-T110 (tablet): 808 contacts (14 deleted); 83 emails; 3 notes; 127 web history (36 deleted)

  • Samsung SM T-231 (tablet): 7 Calendar; 73 call log (2 deleted); 15 Facebook messenger; 659 contacts (168 deleted); 262 emails (11 deleted); 1 MMS Messages (1 deleted); 190 sms messages (51 deleted); 91 web history (1 deleted)

  • Sony Ericsson

  • Sony Ericsson (Locked: No access to PIN) - they attempted to open it using three passcodes.

• Douglas Bustillo’s phones

  • Huawei Ascend phone: 1 calendar; 115 call log (3 deleted); 49 Facebook (49 deleted); 98 Facebook messenger (4 deleted); 1 instagram; 6 snap chat (4 deleted); 24 Skype; 1 Twitter (1 deleted); contacts, emails, etc.

  • LG D805: Call log, Facebook, kik messenger; Whatsapp, twitter, contacts, emails, MMS, SMS, web history.

• Sergio Rodriguez’s phone:

  • Samsung Galaxy: Calender, call log, google +, skype, tango, Twitter, Viber, Whatsapp, Contacts; Emails; MMS; Notes; SMS Messages; web history

• Data sources for the extraction

  • David Castillo: Both of his phones were erased or blocked

  • Berta Cáceres: One was blocked/erased; two were used for the data extraction; two didn’t have much information

  • Douglas Bustillo: Both had little information and no chat messages.

THE DEFENSE QUESTIONS THE EXPERT (the most important parts)

• Q: Who was present when you did the extraction? A: We did the extraction in front of the prosecutors and Cáceres family lawyers

• Q: You said that one of the devices was actively updated, since when and how long had it been updating for? A: I don’t know the length of time it was updating and the fact that it was being updated, was explained through translation. The phone itself rebooted.

• Q: How could the wifi connection be made with the phone? A: I don’t have insight into that. There would have had to be a wifi network in range and the phone attached to it.

• Q: What was the activity of Berta Cáceres’s phone after March 3, 2016? A: There was a lot of activity, it was active until March 30 and there are several incidents of incoming texts and calls and one instance of an out-going call.

• Q: What is the date of the outgoing call? A: March 4, 2016

• Q: On pg. 15516 of the Spanish report, what is the difference between a thumbnail and a photograph? A: the picture is the original file that was sent. When it is put onto the local phone, the operating system will create a much smaller, lower resolution file so that it can be easily located. If you click on it, it will take you to the original file.

• Q: Can you read the conversation from March 26, 2015? [the secretary reads it. The conversation is between Berta Cáceres and someone named “Tomas Zica”] The conversation makes reference to recent threats and Tomas asks Berta if they are related to Rio Blanco and asks her what she’s going to do. Berta responds: “It’s Blue Energy, on the Cangrel river”

• Q: Can you read messages from March 27, 2015 on Pg. 5682? [secretary reads it] The conversation has to do with a conversation between a teacher in Agua Caliente and Berta. They reference Blue Energy and something about a road blockade.

• Q: Can you read two other conversations dated February 5, 2015 and February 23, 2015. [The secretary reads them]. The first on February 23 has to do with whether Berta had heard from a man (without mentioning names) and some sort of incident involving Blue Energy. The second conversation on February 5, 2015 is Berta asking for a summary of the incidents related to Blue Energy

• Q: Can you read the conversation from June 3, 2015 between Berta and Jerónimo (very very rough translation. Hard to understand without context)

  • 20:58 from Jerónimo: I already did it. Tell me what you think

  • 20:58 from Berta: They are lending (or borrowing)? That is what they say

  • 20:59 from Jerónimo: If [or yes] to borrow/lend the land. To let a bird land

  • 20:59 from Berta: if it doesn’t have an impact. In the process

  • 20:59 from Jerónimo: They won’t know

  • 21:00 from Jerónimo: It could have. One can’t know

  • From Berta: There must be another thing

  • 21:00 from Jerónimo: What thing?

  • From Berta: I don’t know. Alliances. What is behind that. More behind.

  • 21:02 from Jerónimo: Direct contact. An entrance, an exit

  • 21:02 from Berta: One time no more

  • 21:03 from Jerónimo: Yes

  • 21:07 from Berta: No media is friendly

  • 21:07 from Jerónimo: It’s up to me to make the decision

  • 21:07 from Jerónimo: What do you advise?

PROSECUTIONS QUESTIONS

• Q: Why do you say that the Iphone 7 belongs to David Castillo? A: That was reported to us. It was reported to us as Castillo’s phone and although this is weak evidence, the phone is called “David’s phone”

• Q: What information did you obtain to relate one of the phones to Sergio Rodriguez? A: It was reported to have belonged to him and there was information that also names him inside the report itself.

• Q: The watermark stamp of your company that is on all pages of the report, how does it affect the ability to read the document? A: It’s a translucent water mark but it may sometimes obstruct the text. But the text can be selected and copied from the document.

DAY FORTY-SIX: Trial Against David Castillo

Main Points of the Day

• Today, the prosecution asked the court to reconsider yesterday’s decision about admitting the defense’s telecommunications expert witness and analysis. The prosecution again argued that many documents were in English and that the printed version of the analysis differs from the digital version. The court maintained their decision and convened the defense’s expert and his English translator for tomorrow at 9 am.

DAY FORTY-FIVE: Trial Against David Castillo

Main Points of the Day

• The prosecutors ask the court to not admit the expert testimony of the defense’s telecommunications expert Shaun Vodden arguing that parts of his analysis were submitted to the court in English and not in Spanish as is required. The prosecutors also complained that some of the submitted files could not be opened and thus accessed by all parties. The court took several hours to review all submitted files and ruled that the English translator sworn in to translate Vodden’s testimony would spend tomorrow translating parts of Vodden’s analysis that were not submitted in Spanish. The judges also ruled that all parties would spend part of tomorrow reviewing the files submitted by Vodden to ensure that all had a copy of all files (in Spanish) prior to hearing Vodden’s expert testimony.

• The trial is convened for tomorrow morning.

DAY FORTY-FOUR: Trial Against David Castillo

Last update: June 22 at 9:20 am

Main Points of the Day

• Today, Jonathan Murillo, the defense’s data extraction expert, continued on the stand. Both the lawyers for the Cáceres family and the prosecution team managed to create some doubt about Murillo’s analysis including that one of the key audio files was oddly not transcribed for the court and that the date that the LG phone was obtained by state investigations, questions the authenticity of the audio file (this is the subject of another legal case against two investigative police for falsifying evidence). This in turn, created doubt about the defense’s argument that the audio file suggests there were other threats against Berta Cáceres that were not pursued by authorities.

• The trial is convened for 9 am tomorrow. Telecommunications analyst, Shaun Vodden, another expert for the defense, will take the stand. The trial is expected to last until the end of this week and possibly, if still not concluded, a few days next week.

COPINH offers a few explanations as to why the defense revoked two witness testimonies on day 41 [English translation below]

Translation (left to right):

Fabiola Zelaya: Would testify about the administrative duties - carried out by PEMSA, the company that Castillo managed - about contracting Douglas Bustillo for the company in the south [of Honduras] which would have justified the reasons for the communication between both. Reality: She will not testify because she would have to lie to speak about the work that Bustillo did with PEMSA. She started to work with the comapny in October 2016, months after the crime.

Edgardo Jerezano: Would testify about David Castillo’s actions that he spoke about by chat - he was contracted to promote complaints and criminal actions for damages experienced by the company. Reality: His testimony would demonstrate the structure that harassed, persecuted, and criminalized COPINH and Berta Cáceres

More Details

Defense Challenges Credentials of Prosecution’s Technical Consultant

• The prosecution team brought in a technical consultant to assist them with questioning the defense’s expert witness. The defense sought to object to the participation of the technical consultant, arguing that his credentials did not demonstrate his expertise in line with that of the expert witness. The court denied the objection.

Prosecutors and Private Accusers Questions Defense’s Data Extraction Expert Jonathan Murillo

PROSECUTOR’S QUESTIONS

• Q: How did you confirm the phone’s IMEI? A: I did a search in Phone Detective. And in the report, I included a photo on the back of the phone.

• Q: Where is the IMEI number in your report? A: It’s in the photos in the report

• Q: Why didn’t you put the IMEI in the report where you wrote the information about the ID of the phone? [answer inaudible]

• Q: What tool did you use to get the ID information included in the report about the phone? A: Cellebrite

• Q: What differences could exist between the IMEI from the physical extraction and the IMEI on the back of the battery? A: It’s the same IMEI on the back of the battery as is inside the phone.

• Q: According to what you were sworn in to analyze, what was the purpose of your expert testimony? A: Establish the existence of files and audio file 0035433

• Q: When did the chain of custody on the phone begin? A: It starts, according to the document, from the time it was seized.

• Q: When did it start? A: March 31, 2016

• Q: What does the date of collection mean? Objection

• [Defense continues to interrupt. Judges getting increasingly annoyed and call for order]

• Q: According to the chain of custody, what was the collection date of the cell phone? March 31, 2016

• [The court interrupts and the judge clarifies that the collection date of the phone was March 30, 2016 meaning that the phone was in police custody at that time. Then the following day, on March 31st, the chain of custody document was started. The prosecutor clarifies that the chain of custody started at 11:20 on March 31 but the evidence collection date is March 30th.]

• [NOTE: The relevance of this is that the phone was in police custody on the day that the expert says the audio file alleging a threat against Berta was created, modified and deleted. This is likely the origin of the legal case charging Honduran investigative police, including one that came to testify for the defense, for falsifying evidence]

• Q: In your analysis of the audio, why didn’t you transcribe it for the court? A: Because the audio was subject to an expert analysis and it was already described. I also played the audio file [NOTE: The first part of this claim is not true. No transcription of the audio has been provided]

• Q: According to what you understand, who transcribed the audio? A: I don’t know

• Q: And this information, who provided you with it? A: The transmission was put on Facebook.

• Q: Why didn’t you think that it was important for your analysis to transcribe the audio? A: My objective was just technical - it was to identify the audio, not the content.

• The prosecution’s technical consultant presents his conclusion to the report indicating that he is concerned about the types of connector cables used to carry out the extraction. The expert indicated that files were modified but doesn’t say what the modifications are. These modifications could have been made automatically by the phone if it was turned on (ex. if it received a text message, an app was open, etc).

PRIVATE ACCUSERS’S QUESTIONS FOR EXPERT

• Q: You said that you received instructions from the defense, what did they say? A: As I explained, I’m an expert for the defense but my report is based on the technical information found in the cell phone

• Q: What other instructions did the defense give you? A: No other indications

• Q: What date did you submit your report to the court? A: [Missed response]

• Q: You indicated that the audio had been transcribed for the court, but why did you not consider doing it as well? A: It was a personal decision, it was never of technical relevance.

DAY FORTY-THREE: Trial Against David Castillo

Main Points of the Day

• In a short hearing today, Castillo’s defense team raised an issue with the accreditation process of the prosecutor’s technical consultant brought in to assist them in questioning the defense’s data extraction expert, Jonathan Murillo. The court ruled that the consultant would be permitted to participate after his credentials were reviewed by the court. The defense’s expert will continue on the stand on Monday at 9 am.