4.Kelsey Guay — Direct/Cross/Redirect/Recross

KELSEY GUAY: Sure. So starting at the beginning, I graduated from Portland State University with my Master's of Criminal Justice in 2016. During that time, when I was in grad school, I worked for the Clackamas County Sheriff's Office in their family justice center, which is a domestic violence clinic.

After graduating grad school, I became employed with the Portland Police Bureau, which is in Portland, Oregon. I was employed as an investigative crime analyst. So for about three years, I supported the entire detective division. And I worked on anything from call detail records, mapping cell site location, developing frequency analysis, looking at pattern of life.

I would also help them review search warrant returns. So things like when they get data back from Google, Facebook, Twitter, Instagram, Snapchat. And I would do some open source, just looking at, you know, people's profiles online to help an active investigation.

After that, I was the ICAC analyst. And ICAC stands for Internet Crimes Against Children. So during that time, I performed phone extractions. I went on scene to -- search warrants where there was, you know, an Internet crimes against a person suspect. I would do RAM captures and router examinations. I would also review every single cyber tip and any search warrant returns that came back for those cyber tips.

After that, I was the digital forensics lab manager, basically over the unit. I was a civilian employee my entire time with the police bureau. And so for about the last, a little under two years, I managed the digital forensics lab, where I would perform extractions, and I led a team of five examiners in doing digital forensic extractions and analysis.

KELSEY GUAY: So when I started working on this case, I was given a lot of different data, just so that they -- you know, I could see everything that had been obtained by law enforcement. However, my focus was on Donna's cell phone records. So that's where I kept most of my focus, was on her records.

However, I reviewed all of the data. So, essentially, there was a lot of AT&T records encompassing various time periods. Some of them, you know, a duplicate of the same time period. There were also Sprint records. I think there was also some Verizon and T-Mobile records. So there was a lot.

KELSEY GUAY: So this is a screenshot of the folder that contained the document that I focused my analysis on, because this document was related to Donna's cell phone number, her records. In this document -- after reviewing all of the different ones, I realized that this document contained the most data. It started -- I believe the records started January 1 of 2014, and they went through May of 2017. So it contained both time sets that were seen on slides 26.

Additionally, this data contained seconds in the time stamp. And so me, as an analyst, when I'm looking at CDR documents, I always prefer to get the document that has the most information, and in this case to have a time stamp that includes seconds.

KELSEY GUAY: I can. So you might have also seen something similar to this earlier in this trial, but this is what that document looks like when you open it up. This is just the first three rows. Because this document, like I said, goes through 2017, there are a lot of rows in this document. So this is just a glimpse of what it looks like when you open it up in a text document, which is the native format.

This is not very easy to work with as an analyst. You could take this, and you could put it into an analytical program and run some calculations on it. However, when I looked at this in a little bit more detail -- and there are slides -- I realized this data was kind of messy. And by messy, I mean I wouldn't necessarily just trust putting it into a program and trusting the numbers that came out. So I took this document and put it into Excel.

KELSEY GUAY: So when you open up Excel -- I don't know how many of you are familiar with Excel. I live in Excel. So I am very familiar with it. But one of the options when you open Excel is there is a data option, and you can import data. There is a little tool that helps you bring text files into Excel.

And this one is a great one to bring in Excel because, it might be hard to see, but there are commas between each of these values. So this is what is known as a comma separated, you know, type file. So it translates very nicely into Excel.

KELSEY GUAY: Yes. So this specific file, it's, again, probably very small. But in column 2, or B, the header says, Connect +date -- or con date time, UTC.

So it is very common for call detail records to come in uTc. And if they explicitly say UTC, you know it's UTC. so for these records, the times of interest were in the summer. So I knew that this would be in Eastern Time.

So I was able to add a column in Excel. Again, very easy to do this in Excel, add a column, write a quick formula, do that time conversion so that I could make sure that, you know -- because if you have a call that's in UTC, it might be showing on a different day. But if it kind of happens within that, you know, plus or minus four window of when days change, I wanted to make sure I was looking at the right dates for Eastern Time.

KELSEY GUAY: Okay. So this is that exact same document. Now, instead of just looking at the first three rows, we are looking at rows 1 through 9. And this is at the very top of the document. So as I look -- as I open up any kind of call detail records, I want to see -- get an idea of what the data contains.

So in this example, that red box is just showing three unique rows of data. But when I look at these three unique rows, I see a couple of things that indicate to me that these three unique rows might all be referring to the same one call event. And by “call event,” I mean, like, an incoming or outgoing call.

So if a program takes this, it might see this as potentially three different call events. whereas, me asa human, I can realize, Oh, there's indicators that tell me that this is one call event.

KELSEY GUAY: So, essentially, when I look at row 6, I see the connect date, time, which is when the call was initiated, whether it's an incoming or outgoing call. I see a few things. I see the seizure time, which is the time it takes for the network to set up the call, the elapsed time, which is ET. That's how long the phones would have, quote/unquote, connected. I see the originating and terminating number. So -- whoops, a little too far. There we go -- originating number, so the call that it was started on. Terminating the call -- the phone number that the call was ending on.

And then, because this is a screenshot of Donna's phone records ending in 0997, we also see the IMEI and IMSI. Those are just the -- it's like a VIN number for a phone is an IMEL, International Mobile Equipment Identifier. And then the IMST is the International Mobile Subscriber Identity. That's how the network can tell that you are allowed to be on their network, right, and make calls on the AT&T network.

we also see the call type, CT. Mobile terminating is what that MT stands for. So, again, it reinforces the fact that we see Donna's phone number in the terminating column. And then it's reinforced by that MT.

In the feature, this is unique to AT&T records. So this is some -- they look like maybe what might be random letters. But they all have meanings, and there is a record key that if you're not super familiar with what those letters mean, you can go and look at that record key.

But, essentially, what this is saying in human speak is that the number calling, there was number identity present. That's the NIOP. There's the CN -- or CFNA, which is call forwarding. It wasn't available; that it couldn't reach the other party. And then you see that VM, which just means voicemail was involved in this transaction.

KELSEY GUAY: So the next two lines are related to this initial call event. So I can see that this next one has voicemail. I also can see that this is the forwarding number, which is to forward it to the voice mailbox.

And then if I go all the way back, the SO and the ST are service originating and service terminating. So these are not human-generated. These are network-generated logs. So that's what the SO and ST stand for. And then if I go back and I look at the times, the thing I notice is that for those following two service calls, the timestamps are the same.

And all of this -- so while the connection time is that -- what would be 2:52 p.m., that's when the call would have, you know, come into her phone and gone to voicemail. Then the second two with the identical timestamps are essentially just multiple legs of that activity.

So as a human, I can see that these three lines are all related to one event, an incoming call that was routed to voicemail.

KELSEY GUAY: Yes. So because this slide particularly was focused or created using Charlie's phone records, I went through all of those files that we had described earlier and tried to see if I could find any one particular file for Charlie's phone records that contained this entire time span, May 2014 through -- or May 2nd, 2014 through July 20, 2014.

Again, going back, there were a lot of different records for this case. I couldn't find one specific file that encompassed this entire time frame. I did find three different files for his cell phone number. So, essentially, I had to take three different files to try to recreate this, and when I was doing that, I noticed that at least between two of the files there were a few dates that overlapped, right?

So when law enforcement gets a call detail record return, they'll ask for specific dates. So, for example, you might ask for May 1 through June 20. And that would be one return. And then on another date, you do another warrant or subpoena, and you ask for June 18th through July 18th, right, a month's worth of data.

So when you -- when I found these three files, I noticed that there were at least two files that had some dates over lapping.

KELSEY GUAY: So I did two different steps. I did the one that I just explained, where I converted everything to Eastern Time, ensured that there were no dates overlapping. And so that it was essentially just showing me, you know, May 1 through July 20.

And I think when I did that and I took out these extra overlapping dates, and then I filtered to just only look at the incoming and outgoing calls, I did not deduplicate at all. That what I just explained, right, where I see that three, three for potentially one event, did not deduplicate. I just put a filter for Charlie and Donna's cell phone numbers. And at that point for these dates, I think I got maybe 383 unique call events. And that was, again, taking out the overlapping dates.

The second step I did was I thought, well, maybe the tool didn't do that and it just took everything and it didn't deduplicate the dates. So I tried it again, and I got 393 when I did not take out any extra dates. So -- and these were just calls. I was only looking at calls.

KELSEY GUAY: So the voicemail flags are going to be the best indicator of if somebody didn't connect, because AT&T is telling you that the phone call went to voicemail. So as an analyst, that's, to me, the best indicator.

Another indicator that you can use -- I think different people have different thoughts on this. But if it’s a very short duration, like, let's say, under ten seconds, could the phones have connected and there's just actually no communication? Or it may be, you know, you answer but you don't hear anything so you hang up?

So different analysts will use a different amount of elapsed time to determine like, you know, I think -- some people will say, I think everything over 30 seconds indicates there was, you know, actual communication. So people have different thoughts on it. But I like to see, you know, if it's two seconds to zero seconds, there probably wasn't any actual communication.

KELSEY GUAY: So this chart is focused on -- would have been created using Donna's call detail records. And the contact at the top that's highlighted is Charlie's cell phone number, and the date range that was used to generate these records was June 23rd, 2014, through July 22nd, 2014.

Again, I did the same process like I did with Charlie's. I went to go look through all the data to see if I could find a file that would cover this date range and only this date range, and I was able to find a file that covered this date range.

KELSEY GUAY: Unique -- so for this one, I took the original file that I mentioned, and I just looked at the filters between charlie and Donna's phone number. And I was able to recreate the 80 when I just look at the totality of the data.

Taking a step back, all the way back to that slide 1, I mentioned that record for Donna contains data from 2014 through 2017. So that particular document covered both of the time frames. It covered this one, which is June 23 through July 22, 2014, and it covered what was in Charlie's records, which was May 2nd through July 20th.

So I used that document that I showed you guys at the very beginning to dedupe. So I went through that document. I put the filters for Charlie and Donna's phone numbers, and then I went through each line during those time frames to determine, like, is this a voicemail activity? Is this just AT&T duplication? Is this an actual unique call event?

So that was the document that I used, focusing on these two parties’ phone numbers. And I went through each line, line-by-line, and removed manually any rows that I believed to be referencing the same call event.

So when I did that, I got for this time frame, deduplicated, and this would be attempted and connected, right? So it's including the voicemail. It's just noting that there is only one line for that voicemail, not potentially three. I got 69 unique call events that would be connected and attempted.

KELSEY GUAY: There's a lot of different purposes. So when I worked in law enforcement, I would do them for lots of different things. One of the things that you can do is just see who's the number one caller for a particular person. Sometimes, that's a significant other or family member. So that's one reason you can do a frequency analysis.

Another is just to do more of a pattern of life and look at activity over a matter of days, months, years.

KELSEY GUAY: Potentially. I mean, I would like to see the feature flags or the call flags. But, yes, based on the timestamps, the minutes -- there's no seconds in this. But it does appear that this looks like a phone number is calling a phone number.

It's being routed to what I know to be, like, an AT&T voicemail routing number, and then I see the first two numbers replicated. Again, I don't see the -- like, the call type or the feature flags, but it does appear to be a three-in-one incident.

KELSEY GUAY: So any applications, anything third party, really even FaceTime audio or FaceTime video is technically not, you know, through the AT&T network. All of that activity would be a data transaction.

So when you look at AT&T records for a data transaction, it's not going to show you individual items, for example, that you got an email and that was so many bytes sent on the network. It's just going to show you a time that the data session was open and how many bytes were received and how many bytes were sent from the handset to and from the network.

So AT&T does show data transactions, but it's not going to show, like, a FaceTime audio or, you know, an email.

KELSEY GUAY: So the records don't give you, like, minute by minute, second by second. So when I look at data transmissions, data records, I look at the time when that data transmission was initiated. Because in order for a data transmission to be initiated, the phone would have to be on and connected to the network, right? Your phone, if it's, you know, in airplane mode or, you know, off, it's not going to be able to reach the network. So the time when that data begins, the phone would have had to be on.

when I see these things, like, 60 minutes, do I know with a hundred percent certainty based on these records that the phone was on for the entire 60 minutes? I can't say that. But I do know at least at the beginning, that phone was on and connected to the network. And I did see data transmissions throughout the day and the evening where the connected time was, you know, kind of throughout the day.