Brad Cooper: Appeal info

[otto]

I, for one, am quite pleased with the result of the appeal. Although I do not think it is over yet, as the state still can take this to the NC Supreme Court to have the appeal renewed. However, Brad deserves a fair trial, and he did not get one the first time. Having followed the original trial, I am still convinced that he is innocent. And I really cannot comprehend how anyone can believe otherwise based on the full evidence presented at trial.

That being said, the thing that I find the most outrageous and manipulative is the "Butterfly Fund" for Nancy Cooper. Unless you presume that Brad was guilty, there was NO evidence of domestic violence. By making the "Butterfly Fund" against domestic violence, the sponsors promoted an agenda (blame Brad) and dishonored Nancy. This was the M.O. of Nancy's friends that blamed Brad from the outset. And I find it contemptible.

That's an interesting and refreshing perspective. Given how widely Brad was badmouthed during the marriage ... well, let's put it this way, if a woman was badmouthed as widely as he was, that woman would be perceived to be an abused spouse.

 

[otto]

Trial wise ... is Brad going to get caught in the google map search (absolutely bizarre that a computer expert with inside information "silent routing" would make this mistake - but not unheard of) or will it be that a machine that he had at his house ... something about the IP and routing ... that suddenly surfaced when the trial was going down the tubes - with a little help from Geisner and his biased antics.

Anyway, will the google map and machine with the IP address sink him, or will he walk free with a pall over his head?

 

[oenophile]

Anyway, will the google map and machine with the IP address sink him, or will he walk free with a pall over his head?

Can you explain the IP address bit? I did not see that in the evidence, only the accusation of a missing router, which is meaningless given the context.

 

[otto]

Can you explain the IP address bit? I did not see that in the evidence, only the accusation of a missing router, which is meaningless given the context.

I didn't really understand what it was all about, but I thought that there was a missing router that was discovered at the last minute, and that supposedly supported the theory that Brad staged a phone call to himself while he was buying juice in the morning. It was not admitted into evidence. Perhaps that was posturing by the state?

 

[oenophile]

I didn't really understand what it was all about, but I thought that there was a missing router that was discovered at the last minute, and that supposedly supported the theory that Brad staged a phone call to himself while he was buying juice in the morning. It was not admitted into evidence. Perhaps that was posturing by the state?

There was a router unaccounted for 2.5 years after it was purchased. The problem is that this wasn't unusual at Cisco, as they testified that people borrowed equipment all the time, took stuff home all the time, and that a misplaced router was common.

However, there was supposedly something about a windows log not being admitted into evidence. But there was never much info about this, and it was unclear as to whether it was another red herring (like most of the prosecution's "evidence") or actually damaging.

 

[otto]

There was a router unaccounted for 2.5 years after it was purchased. The problem is that this wasn't unusual at Cisco, as they testified that people borrowed equipment all the time, took stuff home all the time, and that a misplaced router was common.

However, there was supposedly something about a windows log not being admitted into evidence. But there was never much info about this, and it was unclear as to whether it was another red herring (like most of the prosecution's "evidence") or actually damaging.

Any thoughts on the prosecution trial strategy next time around? Clearly, the duck theory is gone. Two weeks of listening to the neighbors badmouth the suspect didn't make sense to me, but I understand it's allowed in NC trials. The google map is questionable if the defense didn't have access to the same original information. The wiped cell phone still can't be explained as an accident.

 

[macd]

Can you explain the IP address bit? I did not see that in the evidence, only the accusation of a missing router, which is meaningless given the context.

This evidence was not offered to the jury, as it was a last minute find, but here's the gist of it:

At around 10pm that night, an error message was written to the Windows system log of Brad's laptop. The message was about a duplicate IP address and it gave the MAC address of the offending system.

This error message implies someone was configuring network equipment in the house that night, because an IP address must have changed to cause the error.

The MAC address (burned into each device at manufacture time) matches the missing router that Brad borrowed from work that has not been found.

Together, this implies that the router was in the house and someone was configuring it (to get ready to spoof a call the next morning) that night.

In deposition, Brad said he was sleeping (not working) at that time and the router was not in the house after the house was sealed. This means that whatever happened when that log was made, Brad saw fit to lie about it and remove evidence of it afterwards.

 

[macd]

Any thoughts on the prosecution trial strategy next time around? Clearly, the duck theory is gone. Two weeks of listening to the neighbors badmouth the suspect didn't make sense to me, but I understand it's allowed in NC trials. The google map is questionable if the defense didn't have access to the same original information. The wiped cell phone still can't be explained as an accident.

Just keep it simple:
1) Google maps shows him planning the day before.
2) Windows log shows him setting up phone call spoof.
3) Dig more into the hard drive. If the map is there, I'll bet other google searches are there too.
4) Stomach contents: an almost empty stomach with onion does not fit someone doing laundry for 4 hours and then going out for a long run. Coffee, water, breakfast?
5) Insect evidence: keep it simple. All it takes is one maggot too big for a morning murder. Don't get bogged down with sample issues.
6) Computer evidence: Get someone from Microsoft to explain how timestamps work in that particular version of Windows. Show that the defense "experts" wild claims about the timestamps are false.

Much less neighborhood gossip is needed, just enough to show that the marriage was in trouble and Brad was backed into a corner.

 

[oenophile]

This evidence was not offered to the jury, as it was a last minute find, but here's the gist of it:

At around 10pm that night, an error message was written to the Windows system log of Brad's laptop. The message was about a duplicate IP address and it gave the MAC address of the offending system.

This error message implies someone was configuring network equipment in the house that night, because an IP address must have changed to cause the error.

The MAC address (burned into each device at manufacture time) matches the missing router that Brad borrowed from work that has not been found.

Together, this implies that the router was in the house and someone was configuring it (to get ready to spoof a call the next morning) that night.

In deposition, Brad said he was sleeping (not working) at that time and the router was not in the house after the house was sealed. This means that whatever happened when that log was made, Brad saw fit to lie about it and remove evidence of it afterwards.

IF that is true, and it's a big IF, then it would be the first piece of evidence that contradicted the phone call. As of the moment, there is no evidence that there was any spoof. It is all conjecture by the prosecution in order to confuse the jury and the public.

But there are all kinds of issues here. Why wasn't this found before (after all, this stuff has been in the possession of police for years)? If there was an issue with a MAC address and you know the MAC address in question, its pretty easy to determine what the address actually belongs to. If there is no MAC address, just an IP address, then its all meaningless.

The problem is that the prosecution has taken us down misrepresentations and falsifications in the past. Just look at this example:

4) Stomach contents: an almost empty stomach with onion does not fit someone doing laundry for 4 hours and then going out for a long run. Coffee, water, breakfast?

In reality, the almost empty stomach contents fits with the jogging scenario, not with the Brad-did-it scenario. People usually do a morning run on an empty stomach. Nancy was known for getting coffee during the run, not before (lots of testimony about this). If Nancy had been drinking and eating all evening, as witnesses said, and then she was killed when she got home, there would be a lot more contents in her stomach. The prosecution (successfully) attempted to make people believe that evidence supported their narrative when it in fact supports the defense.

There are plenty of examples of this, from alcohol to bugs to whatever. Thus, I don't have a lot of confidence that the prosecution's description of what was not entered into evidence is accurate until we actually see it in court.

 

[oenophile]

Any thoughts on the prosecution trial strategy next time around? Clearly, the duck theory is gone. Two weeks of listening to the neighbors badmouth the suspect didn't make sense to me, but I understand it's allowed in NC trials. The google map is questionable if the defense didn't have access to the same original information. The wiped cell phone still can't be explained as an accident.

Several perspectives. The prosecution should theoretically be going after the person or persons that actually did it. If I had the evidence that the prosecution had, apart from the Google Map search, there is no way that I would believe Brad was guilty. And so as a prosecutor, I would try to find the real killer.

But assuming that I did believe him to be guilty, then IF there is a Windows log that demonstrates clearly (e.g. via MAC address) that a FXO-capable router was connected to one of Brad's computers the night before the murder, I would start with that. Apart from that, there is only the narrative and the Google Search. The Google search is still the big challenge for the defense, even if they do get to have their experts in there. And so from a prosecutors perspective, I would attempt to address the possibility of tampering up front, take the wind out of any of the accusations of the defense.

Oh, and I wouldn't use Boz.

 

[otto]

Several perspectives. The prosecution should theoretically be going after the person or persons that actually did it. If I had the evidence that the prosecution had, apart from the Google Map search, there is no way that I would believe Brad was guilty. And so as a prosecutor, I would try to find the real killer.

But assuming that I did believe him to be guilty, then IF there is a Windows log that demonstrates clearly (e.g. via MAC address) that a FXO-capable router was connected to one of Brad's computers the night before the murder, I would start with that. Apart from that, there is only the narrative and the Google Search. The Google search is still the big challenge for the defense, even if they do get to have their experts in there. And so from a prosecutors perspective, I would attempt to address the possibility of tampering up front, take the wind out of any of the accusations of the defense.

Oh, and I wouldn't use Boz.

Or ... maybe leading with cell phone tampering by police and the secrecy surrounding that tampering, then the google map search that could not be verified by the defense due to prosecution delays in sharing information, then to the mysterious appearance of the router at the last moment (after the duck theory failed), and topping that up with documented evidence (spanning several years) that NC prosecutors worked with forensics pseudo-experts to tailor the evidence to fit the prosecution theory ... put the prosecutor's office on trial. What happened with the Michael Peterson evidence was a systemic problem (link). The Duke Lacrosse rape accusations are another example where the prosecution was determined to prosecute without evidence (link)

Regarding Boz, I think half the problem is that a conviction can and does result in career promotion for the prosecutor. Prosecutors should be hired into a job, not elected. That problem needs to be eliminated before a prosecutor can truly be objective.

 

[PokerPlayer]

Or ... maybe leading with cell phone tampering by police and the secrecy surrounding that tampering, then the google map search that could not be verified by the defense due to prosecution delays in sharing information, then to the mysterious appearance of the router at the last moment (after the duck theory failed), and topping that up with documented evidence (spanning several years) that NC prosecutors worked with forensics pseudo-experts to tailor the evidence to fit the prosecution theory ... put the prosecutor's office on trial. What happened with the Michael Peterson evidence was a systemic problem (link). The Duke Lacrosse rape accusations are another example where the prosecution was determined to prosecute without evidence (link)

Regarding Boz, I think half the problem is that a conviction can and does result in career promotion for the prosecutor. Prosecutors should be hired into a job, not elected. That problem needs to be eliminated before a prosecutor can truly be objective.

I'm having doubts that the Google map search will make it into a second trial. If the defence can successfully petition to exclude it based on spoliation or police not following forensic protocols for collection and handling of digital evidence, then the outcome could be radically altered. The court wouldn't allow DNA evidence where it sat on a counter for weeks, where the chain of custody is broken and where there is evidence of contamination, so why would they allow digital evidence when it hasn't been collected and protected properly?

 

[otto]

I'm having doubts that the Google map search will make it into a second trial. If the defence can successfully petition to exclude it based on spoliation or police not following forensic protocols for collection and handling of digital evidence, then the outcome could be radically altered. The court wouldn't allow DNA evidence where it sat on a counter for weeks, where the chain of custody is broken and where there is evidence of contamination, so why would they allow digital evidence when it hasn't been collected and protected properly?

That's an interesting thought. I don't remember the details exactly. Was the computer left unattended at the home for some time, was it left unattended/unsecured after police collected it, both?

 

[Skittles]

Howard Kurtz writes letter to the News & Observer.

http://www.newsobserver.com/2013/09/05/3166959/howard-kurtz-coopers-new-trial.html

Here's the earlier article Kurtz references:

http://www.newsobserver.com/2013/09/03/3160393/appeals-court-orders-new-trial.html

 

[PokerPlayer]

That's an interesting thought. I don't remember the details exactly. Was the computer left unattended at the home for some time, was it left unattended/unsecured after police collected it, both?

The computer was left turned on and connected to the internet for 27 hours after police took over the Cooper's house with a warrant. There was also a 6 week delay between when the computer was received into evidence by the police and when it was hashed (a forensic copy made) and during this period, Windows updates and/or Cisco updates were downloaded to the computer (I can't recall which one or both, sorry) but the police said that it was stored in an evidence room with no battery, no power and no internet. There was also a long delay, close to a year, where the police/FBI would not release the computer to the defence for them to do their own investigation on it - I'm not suggesting something could have happened in that time as far as spoliation of the computer evidence (after it was hashed). However what did happen in that time is that Google's retention policy was passed and that means that the defence could not subpoena Google's records for the cookie related to that search - which was what the FBI instructed the police do in order to verify that the search had happened on that computer.

 

[otto]

The computer was left turned on and connected to the internet for 27 hours after police took over the Cooper's house with a warrant. There was also a 6 week delay between when the computer was received into evidence by the police and when it was hashed (a forensic copy made) and during this period, Windows updates and/or Cisco updates were downloaded to the computer (I can't recall which one or both, sorry) but the police said that it was stored in an evidence room with no battery, no power and no internet. There was also a long delay, close to a year, where the police/FBI would not release the computer to the defence for them to do their own investigation on it - I'm not suggesting something could have happened in that time as far as spoliation of the computer evidence (after it was hashed). However what did happen in that time is that Google's retention policy was passed and that means that the defence could not subpoena Google's records for the cookie related to that search - which was what the FBI instructed the police do in order to verify that the search had happened on that computer.

Thank you. Based on how the computer was handled, and proof (automatic updates) that police were dishonest about their handling of the computer (no battery, no electricity, no internet), the computer should be excluded from evidence. Automatic updates to a computer that police claim was stored such that it could not download updates should place doubt on all the evidence collected by police.

What a bungled case! All that was proven was that Nancy badmouthed Brad and that the neighborhood wives loved the drama. We also know that the family was in trouble financially and that Nancy found $300/week for groceries/gas insufficient. Unless they were eating caviar every day, $1200 a month for groceries/gas should be plenty for two healthy adults and two toddlers.

Even the bug evidence was compromised:

"Wes Watson, an entomologist for the North Carolina Program for Forensic Sciences, testified Monday that fly larvae on Nancy Cooper's body indicated she had been dead anywhere from 68 to 72 hours before her body was found, putting her time of death sometime between 1 a.m. and 6 a.m. on July 12, 2008.

On cross-examination, he said he wasn't completely confident in the results because he had so few samples with which to work. The larvae weren't properly preserved, he said, and all but 12 of the living specimen died before he had a chance to examine them."

http://www.wral.com/specialreports/nancycooper/story/9379937/

 

[macd]

The computer was left turned on and connected to the internet for 27 hours after police took over the Cooper's house with a warrant. There was also a 6 week delay between when the computer was received into evidence by the police and when it was hashed (a forensic copy made) and during this period, Windows updates and/or Cisco updates were downloaded to the computer (I can't recall which one or both, sorry) but the police said that it was stored in an evidence room with no battery, no power and no internet. There was also a long delay, close to a year, where the police/FBI would not release the computer to the defence for them to do their own investigation on it - I'm not suggesting something could have happened in that time as far as spoliation of the computer evidence (after it was hashed). However what did happen in that time is that Google's retention policy was passed and that means that the defence could not subpoena Google's records for the cookie related to that search - which was what the FBI instructed the police do in order to verify that the search had happened on that computer.

To clarify: the computer was left exactly as Brad left it in the house for 27 hours. The police were following their protocols: don't touch it until the computer experts get there. It was during these 27 hours, when the computer was on, connected to the Internet and connected via VPN to Cisco that the computer received the automatic updates. This is exactly as you would expect. The computer was protected inside a sealed crime scene. Nothing suspicious about this course of events at all.

 

[macd]

I\
In reality, the almost empty stomach contents fits with the jogging scenario, not with the Brad-did-it scenario. People usually do a morning run on an empty stomach. Nancy was known for getting coffee during the run, not before (lots of testimony about this).

But, this wasn't a roll out of bed and lace up her shoes situation.
According to Brad's deposition, she had been up for hours caring for a sick child and doing laundry. Do you really think it would be normal to get up early, after a party, and do hours of house work without so much as a cup of coffee?

Brad was sunk after he did that deposition during the custody hearing. He was stuck to a story line that didn't match the evidence. If he didn't say during the deposition that he never Googled Fielding drive, he could have made up a story about house shopping.

 

[macd]

Even the bug evidence was compromised:

"Wes Watson, an entomologist for the North Carolina Program for Forensic Sciences, testified Monday that fly larvae on Nancy Cooper's body indicated she had been dead anywhere from 68 to 72 hours before her body was found, putting her time of death sometime between 1 a.m. and 6 a.m. on July 12, 2008.

On cross-examination, he said he wasn't completely confident in the results because he had so few samples with which to work. The larvae weren't properly preserved, he said, and all but 12 of the living specimen died before he had a chance to examine them."

http://www.wral.com/specialreports/nancycooper/story/9379937/

This "compromised" evidence was really just defense trying to introduce doubt through confusion.

The live samples are not used to determine time of death. They are used to identify the type of insect. They let the maggot grow to a bug, and identify the bug. It's not a big deal that only 12 lived. The ones that did were of the type common to Cary, NC. Not a surprise. No need for more samples to show what is obvious.

The defense team was awesome, no doubt. But, there is no need for us to stay confused for years, when we can learn about insect evidence. Sure, the samples were "compromised", but not in a way that undermined the evidence.

 

[PokerPlayer]

But, this wasn't a roll out of bed and lace up her shoes situation.
According to Brad's deposition, she had been up for hours caring for a sick child and doing laundry. Do you really think it would be normal to get up early, after a party, and do hours of house work without so much as a cup of coffee?

Brad was sunk after he did that deposition during the custody hearing. He was stuck to a story line that didn't match the evidence. If he didn't say during the deposition that he never Googled Fielding drive, he could have made up a story about house shopping.

However, if he didn't actually do the Google map search, how would he know at the point of the custody hearing that he needed to include it in his deposition? Since the testimony from the 2 defence experts (outside the presence of the jury) was fairly compelling and the FBI computer expert "couldn't recall checking on the timestamps, specifically, though he was sure there was no evidence of tampering" related to that map search, it's reasonable to conclude that Brad didn't do the map search or even know about it. If he had known about it and "made up a story" about it, that would be evidence that he actually did the search, no? Hard to pre-empt or confront evidence if you don't even know that it's there. That's even more compelling that the map search was planted.