One Tragic Night (69 page)

The policemen wanted access to Oscar's contact lists, call logs, Internet history, photographs, videos and all back-ups that could help with the investigation. While they could scroll through the phone, they could not download any of the information and use it as evidence in court. They also could not install their software to ‘jailbreak' the phone – an approved and legal method to disable the security feature on the device to install third-party apps in order to download deleted information. They had done this on Reeva's phone and also on Oscar's work phone, which had been seized at the crime scene. The SAPS use two different products to analyse data: one is a Swedish product XRY and the other is made by the Israelis, called Cellebrite. Neither of these could access the device.

It was the second-last week of February and the trial was ten days away – due to begin on Monday, 3 March – when Moller, Sales and the police's head of detectives General Vineshkumar Moonoo received the green light to take the phone to Apple headquarters in California. On Thursday, 20 February, the US officials authorised the warrant and Moller and Sales were instructed to be at a meeting at Apple in San Francisco a week later, on Thursday, 27 February. And so, just a week before the trial was scheduled to start, the team jetted off to the United States.

They arrived at the tech giant's offices at 1 Infinite Loop in Cupertino with
high expectations, but were soon disappointed as their fears were confirmed – the missing password was between the device and the computer it had been synchronised with, not the network. This meant that the Apple technicians could not help them.

The problem was that only one computer had been seized from the crime scene – Reeva's. None of Oscar's computers had been taken as evidence and yet crime scene photographs show a workstation in the runner's upstairs lounge and at least one MacBook laptop in the house. Some on the scene attest to there being as many as three laptops lying around the house, none of which was seized. Without the computer on which the account had been created, it was highly unlikely the police would be able to gain access to the phone.

They returned from the United States empty-handed, except for a back-up of the phone data on a hard-drive. Despite their best efforts, they could not unlock the secrets held by the iPhone. This meant that all they had going in to court was the data retrieved from Oscar's work phone and the contents of Reeva's phone.

So what did the investigating team believe could be on Oscar's personal phone that they were so determined to access it? And what do they believe was done in an attempt to prevent them from accessing it?

During the course of the investigation, one of the SAPS software providers had, in fact, found a way to get into the iPhone.

Executives from Cyanre, The Computer Forensic Lab, South Africa's leading private digital and computer forensic company, had heard on the radio that the police were struggling to get into the device. They knew they had the technology the police needed so they called them up, as managing director Danny Myburgh explains. ‘We supplied the software and the hardware to the police to do the forensics. When we heard over the radio that they were unable to decrypt Oscar's phone, we approached them and said we can make our equipment available to them. We set it all up for them and supplied it to them and we enabled them to access Oscar's phone. We didn't have a mandate from the SAPS to assist them with the analysis, so unfortunately we could not get involved or conduct the analysis for them.

‘We know what type of information they could access from similar actions we've done in the past. We could typically decrypt about 80 to 90 per cent of the data. What could be extracted was calendar items, chats, contacts, limited amounts of locations and quite a lot of SMS messages. We concluded that
the main reason why they went to Apple was to get that other 10 per cent that couldn't be decrypted. They went to extract that other 10 per cent because they didn't know what they could get,' explains Myburgh.

He says the police would have been in a perfect situation to see if any data had been deleted or if content on the phone had been wiped off. ‘They could tell if there were large chunks of emails or messages that were missing. From what is there, it would have been easy for them to determine what is not there and what had been deleted.'

What the police did establish through this exercise was that at some point the cellphone was synchronised with a MacBook – one named ‘Titanium Hulk'.

Only one person close to the accused has a fascination with the lumbering green Marvel Comics hero. It featured in his Twitter feed as quotes from comic strips; he wore green bandanas bearing the eyes of the behemoth; he edited pictures of himself to colour his own skin green; and one friend even remarked on social media, ‘You truly are the Titanium Hulk.' Carl Pistorius. His Gmail address contains that very name.

So this was what had put a spanner in the works – it was suspected that when the phone was last synchronised a new password had been created, so relying on Oscar's old password would obviously not have worked. To confirm their suspicions, a source said police were able to track the phone over the time it had been missing and compared it to data linked to Carl's phone, which showed a potential overlap. Both phones followed the same route over a period of days.

The most intriguing piece of information to be gathered from the partial extraction of data had more to do with what
wasn't
on the phone than with what was. Our study of the data, compared to the extraction from the personal phone, shows that the entire call history had been deleted, the entire WhatsApp record and all its messages had been wiped out, and specific text messages had been deleted. Some of these messages were received on the device while Oscar was in the Brooklyn holding cells and while the device was unaccounted for. This would have to have meant that the device had been switched on, and allowed to download messages from the network to the handset, before they were deleted. This appeared to have occurred days after the shooting.

Moller was set to begin his evidence on Monday, 24 March – the third week of the trial. The weekend prior, there was a strong rumour amongst the media that Carl Pistorius was about to be arrested. Some had got wind that the Blade Runner's brother might be charged with defeating the ends of justice for allegedly removing the phone from the crime scene and tampering with it.

But it wasn't to be – Carl was not arrested, nor was he charged.

That Monday morning court started 11 minutes late and prosecutor Nel made an unexpected announcement to the court. Nel apologised to the court for starting a little late because the state had been ‘engaging with the defence in terms of certain admissions'. Once Masipa was in her chair, Nel read the admissions into the record from a handwritten note, which he said had been drafted earlier that morning. It had clearly been done in haste and at the last minute:

Included in these admissions was the authenticity of the cellphone data from the service providers – this would mean that the prosecution would not have to call a representative from Vodacom to confirm the data, which is a run-of-the-mill occurrence in criminal trials. The second admission was that the defence would not dispute the chain of evidence around the phones – they would not dispute that the phones and iPads were seized on the crime scene, bagged and tagged, put in evidence bags and taken by Hilton Botha to Captain Moller who carried out the extractions and analysis.

What had led to this unanticipated announcement of admissions being made by the defence related to the phones? One might have expected that Oscar's counsel would have fought tooth and nail against the contents of the phone being admitted to a trial court with such ease. It was also expected that the defence team would challenge each and every step taken by the police investigators in securing information and maintaining the integrity of the ‘chain of evidence', as is so often the case in criminal courts in the country. This was even
more pressing in this trial, where the defence had blatantly accused the police of tampering and contaminating the crime scene. It all seemed too easy.

Did anything happen behind the scenes while the prosecution ‘engaged with the defence' on the admissions?

It also appeared that the defence may have made a strategic error. What they did not realise was that by making the admissions the prosecution would not have to call former investigating officer Hilton Botha to testify. The only reason the state needed Botha on the witness stand was to confirm the chain of evidence regarding the phones and iPads – and that had now been mutually ‘resolved'. Putting Botha on the stand would be high risk for the state as Roux would repeat what happened at the bail hearing and tear him apart over his handling of the crime scene, allegations that the scene was contaminated and his initial interactions with witnesses. It would have been a field day for the senior defence counsel.

However, a source close to the defence legal team said there was no oversight and they did not miss a trick. Rather, the situation was far more complex.

These questions around the unexpected admissions were echoed by experts in the industry watching the trial unfold. The way both the prosecution and the defence dealt with the digital evidence raised serious concerns for Myburgh and his team from Cyanre. As experienced forensic investigators, they found the conduct of the legal teams very strange.

‘It is normal for them to challenge the chain of evidence. We didn't see that the defence tested the expert or the evidence. There was no question regarding the authenticity of the messages. It was watered down. We were expecting a lot more in terms of this. We were hoping that the forensics would open up this case and prove it beyond reasonable doubt. We expected the state to make a lot more of the digital evidence and for the defence to test it more vigorously. We're sitting in cases where we are under cross-examination for up to two years over this kind of evidence. So in a case of this nature, to have a person under cross-examination so fast, it was a bit weird,' explains Myburgh.

He also doesn't understand why the prosecution didn't make a big noise about deletions on the handset if any. ‘There was no evidence to say, “We saw that he deleted this.” Why not? Why not? If we had this situation in OJ Simpson, if this was in America, they would have stayed on this point for four days, showing exactly what was not on the phone. In this case, the phone was mentioned briefly and then nothing else. This points to why are you cleaning out this phone? What attempts did the police do to find backups? Did they go to the cloud? They would have been able to see if it was synchronised to his brother's
computer – did they get a search warrant for his brother's computer? If not, what led them to decide not to do that?'

Later that Monday, once Oscar's neighbour Annette Stipp had completed her testimony, Moller took the stand armed with a litany of explosive and emotionally laden WhatsApp messages. The courtroom and the world were afforded rare insight into the reality of the relationship between Oscar and Reeva. At times it was uneasy and awkward but the prosecution believed it a necessary discomfort for this was the only way they could ‘hear' Reeva's voice. Her words were being heard from the grave through the messages she had typed.