State v. Bradley Cooper 4-29-2011

[ncsu95]

JW testified a lot on the contents of the hard drive as a networking expert and as a security expert. He was only precluded from testifying on forensic contents, like the MFT, on the hard drive.

The system log about a network connection to a router is to rebut the networking expert testimony given by JW. I think it is on point.

He did not testify about the system event logs on the PC. So what testimony would this be rebutting? Did JW say a Cisco router wasn't connected to the laptop or accessed by it? If he did, this would be rebuttal testimony.

Just admit this is new evidence and the prosecution is trying to be sneaky in getting in in. Can you at least admit that? It means nothing...but it is the truth.

 

[otto]

Yes, it does sound like they located one of the routers. But if it is a log in that router, it means that router was at Cisco on the 11th. We know he only accessed that building once before his badge was turned off, and that was on the 17th. That would have meant he had to hide a router somewhere and also somehow avoid the security cameras at the office to return it.

I don't find that believable since Brad was under surveillance during that time. I suppose it could be that the logs were internal logs at Cisco, and not attached to the router at all (other than being attached to a router number). I do not see any way that this should be admitted, but it will be very interesting to see what the Judge decides.

 

[ncsu95]

The only thing he was allowed to testify to from the hard drive were things he would have had knowledge from on the hard drive--the CSA Logs, because he worked at Cisco. Nothing else. No event logs. No internet files. No $MFT. If this guy wants to testify to CSA Logs, go right ahead.

Actually, he should not be allowed to testify about the CSA logs unless he is accepted as a network security expert.

 

[Shadow722]

The router he used is in a dumpster somewhere, that's why the logs can't be found.

So then what router log is going to be presented in evidence if that router is in a dumpster??????

If there is an log of an interaction between a 3825 router and the CISCO Network @ 10:21 PM July 11th, then that interaction would also be on the Laptop, NO?

If it's on the laptop then the FBI would have evidence of what interactions were completed that necessitated the use of that particular router for that one time use?

If BC is such a expert, and he did not need the 3825 to perform whatever he did at 10:21 PM, then why did he use it?

Are you now suggesting he set up the 6:40 AM spoofed call at 10:21 PM the previous night???

There are more questions than logical answers at this point.....

 

[ncsu95]

I don't find that believable since Brad was under surveillance during that time. I suppose it could be that the logs were internal logs at Cisco, and not attached to the router at all (other than being attached to a router number). I do not see any way that this should be admitted, but it will be very interesting to see what the Judge decides.

Of course he'll let it in. It will make as much sense as some of his other rulings.

 

[SleuthinNC]

Actually, he should not be allowed to testify about the CSA logs unless he is accepted as a network security expert.

I agree although I can't imagine him not being accepted as a security expert. it would essentially make him a new witness though as he was not tendered nor listed as an expert previously.

 

[WolfpackWoman]

Actually, he should not be allowed to testify about the CSA logs unless he is accepted as a network security expert.

Agreed. That's why it's so nonsensical. Of course he's an expert.

Stop trying to tiptoe around it Boz to sneak it in!!

 

[otto]

Of course he'll let it in. It will make as much sense as some of his other rulings.

I'm concerned about that from the point of view that it gives the prosecution a chance to enter new evidence that the defense does not have an opportunity to refute. We've already seen that everything the prosecution has offered can be refuted, but it there is new evidence dangling in the wind without a response, it could result in an incorrect verdict.

Do you recall the details of the "deal" that Brad made at the beginning of the trial where he waived certain rights in exchange for others? I didn't pay attention at the time, but I wonder if it's coming into play at this time.

 

[Cheyenne130]

News & Observer article:

http://www.newsobserver.com/2011/04/29/1164010/coopers-defense-rests-but-more.html

Despite objections from the defense, the judge agreed to let prosecutors call Fry to the stand in front of the jury next week as a rebuttal witness.

The defense can then bring in witnesses to rebut specific testimony that prosecutors present during their rebuttal session.

Read more: http://www.newsobserver.com/2011/04/29/1164010/coopers-defense-rests-but-more.html#ixzz1KwUyJ5MH

 

[ncsu95]

I'm concerned about that from the point of view that it gives the prosecution a chance to enter new evidence that the defense does not have an opportunity to refute. We've already seen that everything the prosecution has offered can be refuted, but it there is new evidence dangling in the wind without a response, it could result in an incorrect verdict.

Do you recall the details of the "deal" that Brad made at the beginning of the trial where he waived certain rights in exchange for others? I didn't pay attention at the time, but I wonder if it's coming into play at this time.

I think that deal only would have mattered if the defense decided to not put on any witnesses (remembering from the conversation at the time). I have no real knowledge of this, but if I remember correctly, if the defense doesn't put on a witness, they get to speak last to the jury. He essentially waved this by introducing evidence during the prosecutions case in chief. But since the defense put on a case, it didn't make a difference. The prosecution will get to speak last.

 

[SleuthinNC]

News & Observer article:

http://www.newsobserver.com/2011/04/29/1164010/coopers-defense-rests-but-more.html




Read more: http://www.newsobserver.com/2011/04/29/1164010/coopers-defense-rests-but-more.html#ixzz1KwUyJ5MH

Not unexpected but unbelievably ridiculous.

 

[less0305]

Me so happy!

 

[ncsu95]

Not unexpected but unbelievably ridiculous.

A biased ruling from a biased judge. Personally, I hope it is concrete evidence of something that doesn't lead to more speculation. Ultimately, I'm hoping that if he did it, he is found guilty. But I fear that this is going to be something else open to interpretation. Regardless, I'm disgusted with this process and the prosecution team and this judge that represent the people in Wake County.

 

[Maja]

So then what router log is going to be presented in evidence if that router is in a dumpster??????

If there is an log of an interaction between a 3825 router and the CISCO Network @ 10:21 PM July 11th, then that interaction would also be on the Laptop, NO?

If it's on the laptop then the FBI would have evidence of what interactions were completed that necessitated the use of that particular router for that one time use?

If BC is such a expert, and he did not need the 3825 to perform whatever he did at 10:21 PM, then why did he use it?

Are you now suggesting he set up the 6:40 AM spoofed call at 10:21 PM the previous night???

There are more questions than logical answers at this point.....

Could the spoof be done via BC's blackberry through the fxo/router?

 

[unknown403]

Not unexpected but unbelievably ridiculous.

Okay, is it ridiculous? Let's say a city worker stumbled on a street camera that showed this mystery van drive by at the exact time the Defence maintains someone killed NC and they found it this week. Not only should it be introduced but not ridiculous at all, especially if it refutes testimony of the state. On the flip side if the state has a piece of evidence that is crucial and has merit in refuting a defence witness why would it now be ridiculous?

 

[cityslick]

Okay, is it ridiculous? Let's say a city worker stumbled on a street camera that showed this mystery van drive by at the exact time the Defence maintains someone killed NC and they found it this week. Not only should it be introduced but not ridiculous at all, especially if it refutes testimony of the state. On the flip side if the state has a piece of evidence that is crucial and has merit in refuting a defence witness why would it now be ridiculous?

There are specific rules to what you can and cannot introduce during rebuttal. Grit or some other lawyer would need to chime in to expand on that.

 

[foltster]

A biased ruling from a biased judge. Personally, I hope it is concrete evidence of something that doesn't lead to more speculation. Ultimately, I'm hoping that if he did it, he is found guilty. But I fear that this is going to be something else open to interpretation. Regardless, I'm disgusted with this process and the prosecution team and this judge that represent the people in Wake County.

I agree with this.

 

[ncsu95]

Okay, is it ridiculous? Let's say a city worker stumbled on a street camera that showed this mystery van drive by at the exact time the Defence maintains someone killed NC and they found it this week. Not only should it be introduced but not ridiculous at all, especially if it refutes testimony of the state. On the flip side if the state has a piece of evidence that is crucial and has merit in refuting a defence witness why would it now be ridiculous?

Because there are trial rules that have to be followed. And there isn't a level playing field in this trial. The judge has consistently made rulings favoring the prosecution that don't seem right. And no matter how you spin it, this is brand new evidence. While it is great for seeking justice for Nancy Cooper (potentially...we'll have to see what the actual evidence is), it's not great for our judicial system.

 

[Shadow722]

Could the spoof be done via BC's blackberry?

Not likely as the distance from HT to the Cupper house is too far for the Blackberry to interact with wireless network present in the house.

The router cannot be accessed by just dialing into it via a cell phone call.

 

[unc70]

Let me see if I understand the new router scenario:

There was an error in the CSA log for July 11 for an invalid or duplicate MAC on the lan.

The MAC address is that of one of two 3825 routers for the lab and its current location is unknown.

Does the MAC also appear in the VPN logs? System event log? BZ was trying to make it seem later and and I sensed that it was a little before 10:00pm.

Cisco GM testified that he and BC left work together between 5:30 and 6:00. By the way, he testified first testified that they left Cisco that Friday for lunch around 1:00; BZ carefully helped him adjust that to allow "1:00 to 1:30".

(Something seems off when discussing NC calling and leaving a message for him. Probably just me.)

When JW was reviewing the CSA logs, K appeared to confuse JW slightly about a time (roughly 14:00 -4:00) which was discussed as if the 14:00 was Z rather than local and they converted the 14:00 as 10:00 am. The -4:00 is the timezone adjustment so the time was actually 2:00 pm. Since it is easy to forget whether a time is Z or local, it is fairly common for 4:00 mistake in either direction. I plan to point back to this post when they find this router somewhere at Cisco.

How common would it be for someone like BC to tunnel to one router or computer and from there to another and maybe another still? How would that look on the wall?