Let’s continue to look at some computer-forensics testimony from a juror’s point of view for a change.
The first police officer to examine Scott Peterson’s computers was Kirk Stockham. His testimony is unnecessarily long, in my opinion. The prosecution used Stockham to demonstrate how careful the police investigators were and also to try to imply that Scott Peterson bought his boat for no purposes except nefarious purposes. To do this, apparently they thought they had to bludgeon the jury with tedious, technical issues. And the defense apparently thought they had to counter the impact of this techno-babble with equally tedious quibbles.
As to the first point (Stockham’s thoroughness) defense attorney Gergagos scored some points by showing flaws in the process, but (I fear) the points were too subtle for the jury because they were too complicated. As to the second point, the length of the cross-examination only reinforced the “peculiar” fishing-related searches.
Toward the end of Stockham’s testimony, the prosecutor and the defense focused on times and dates when Scott Peterson accessed a website called something like “USA Fishing” and when he printed images from that website. I’m not sure why it mattered, but the parties argued over the dates Dec. 5, Dec. 8, and Dec. 9. Now, since Scott met Amber Frey sometime in late November, the prosecution thought it was sinister that Scott began thinking of buying a boat in early December. The defense tried to show that this assumption was based on erroneous interpretations of the computer-forensics evidence–but took a very long time doing this.
Here’s a section of that testimony (I have inserted comments and questions in all caps):
HARRIS: Mr. Stockham, I want to talk about this particular item Mr. Geragos was asking you in your first–looking at that–for you to assume something. And the assumption was that particular day 12-5, 2002, headline, if that was updated on a regular basis. Going back to that particular area what he’s asking you about that. Now, there is another date that he showed you on the bottom. You see the 12/9 date down there?
[APPARENTLY, A WEB PAGE HAD A HEADLINE DATED ON DECEMBER 5, 2002, BUT A DATE OF DECEMBER 9 SOMEWHERE ON THE PAGE BELOW THAT.
HARRIS: Now, on the left side lower portion of this particular — the USA Fishing website,
STOCKHAM: That means, if I if I was at that company’s offices, and I knew the computers that were serving up those web pages, I could probably find a file called SFBay dot HTML on that web serving computer, and it’s giving you that file name.
[WHAT COMPANY DOES HE MEAN? PETERSON’S OFFICE? THE USA FISHING WEBSITE? HOW COULD A JUROR TELL WHAT HE MEANT? I’M GUESSING HE’S REFERRING TO THE USA FISHING SERVERS, BUT DID THE JURY DO THE SAME?]
HARRIS: So when you go online, you are on the internet, you find a document, you want to print it, hit the button that says print on there, does your computer, when it prints it out, add something to the bottom of that document that says where it’s coming from?
STOCKHAM: In that case, yes. That’s a file name, yes.
HARRIS: So looking at this particular document, this document when it’s printed tells us it’s coming from this internet site?
[I HAVE TO GUESS THAT THE PROSECUTION WAS HOLDING UP A PRINTOUT FROM THE WEBSITE, WHICH THEY BELIEVE SCOTT PETERSON PRINTED.]
HARRIS: Looking to the far right, when you print, this document has been — it’s stamped on the bottom of the document when your printer is doing it, so it gives you the location it’s coming from. Does it also give you the date?
HARRIS: So, now, looking at this particular document, since we know that it, from looking at that, that it’s coming from this website on that particular date —
GERAGOS: There is an objection. That misstates the evidence. Coming from the website, and it’s based on the internal clock. It’s not on that particular date.
JUDGE: Do you want to clean that up?
HARRIS: The date that’s being printed, is that coming from the computer, or from the within site?
STOCKHAM: It’s probably in the computer, but you can, just by seeing this copy — I am making some assumptions. If we have the actual file name, if we have that HTML, we can do what’s called view source, and you will see the code behind that. And you could tell exactly what the web page is doing. Asking me to make these conclusions from just a black and white printout, it’s an educational guess, but, you know, I need to go further to give you as good solid answer. It’s there on the computer file.
[THIS IS A KEY POINT. STOCKHAM IS QUITE CORRECT TO EQUIVOCATE. AS A JUROR, MY QUESTION IS, WHY DOES IT MATTER?]
HARRIS: Without going through assumptions, let’s talk about what’s on this particular document in terms of facts. What’s printed at the bottom, that’s something that’s generated by the printer saying this is the location where this document comes from?
STOCKHAM: Yes, like a footer.
HARRIS: So the time that’s attached to that footer, as you were describing earlier, that is the time of the clock that that computer thinks that it’s printing?
GERAGOS: I think he is misstating. The date. The date, not the time.
JUDGE: Doesn’t have time. Has the date.
HARRIS: I’m sorry.
JUDGE: 12/9. Doesn’t have a time on it. At least I don’t see one.
HARRIS: The date?
STOCKHAM: Once again, if you have the file, and you look at the code and you do not find 12/9/2002. That has the text. Not that text. That had to be generated by the user’s PC, not the website.
[THE DATE IS NOT THE DATE THAT ANYTHING HAPPENED ON THE WEBSITE, ONLY THE DATE THE PC THOUGHT WAS THE CORRECT DATE WHEN THE PAGE OR IMAGE OR FILE WAS PRINTED OUT. I FIND THIS VERY CONFUSING.]
HARRIS: Again, what we are looking at from this particular exhibit, we have the date from the PC, and the location where it’s being printed from, or where the information is coming from, and that shows us on the bottom of that document it’s 12/9/2002?
HARRIS: So up higher in the document where it’s saying Today’s Headline, Thursday, December 5th, you were asked to assume that that was correct. Would it also be a fair assumption to say that that’s just — website has not updated that headline yet?
GERAGOS: Objection. That calls for speculation. He can’t answer that.
[GERAGOS SEEMS TO BE RIGHT TO ME. THERE IS NO WAY TO TELL WHETHER SCOTT’S COMPUTER CLOCK WAS SET AHEAD BY FOUR DAYS WHEN THE DECEMBER 5 HEADLINE WAS PRINTED OUT, OR WHETHER THE WEB PAGE SIMPLY HAD A DECEMBER 5 HEADLINE BEING DISPLAYED ON ANY GIVEN DAY AFTER DECEMBER 5.]
JUDGE: Well, he wants to know if it’s a fair assumption. You can cross him on it.
STOCKHAM: Once again, it could be a fair assumption. But the code will tell you if you look at that file.
[ACTUALLY, STOCKHAM IS SAYING IT ISN’T A FAIR ASSUMPTION, BUT THE PROSECUTOR IGNORED OR MISUNDERSTANDS HIM BELOW.]
HARRIS: And you were asked about that in terms of that particular USA Fishing, the Captain Hook banner goes to that particular document. That’s D5L-3. So I’m going to point out right there, where it says “BANNERCapthook”.
HARRIS: You were describing for us the dates that this particular data was created to the computer, the date created access modified, right?
HARRIS: What are the dates and times that that particular banner for Captain Hook was created on that computer?
STOCKHAM: We have a date of 12-8 of 02.
HARRIS: What time?
STOCKHAM: 8:19 a.m. with two seconds difference. On 8:19 —
JUDGE: It’s not 19.
STOCKHAM: I’m not sure what the columns are labeled without going back to the computer data
HARRIS: You were asked about these this — other gif that was up there, cb16 —
STOCKHAM: Cb16, underscore, bracket, 1, dot, g-i-f.
HARRIS: You were asked on here — on here some place?
HARRIS: On — do you see that up there someplace?
STOCKHAM: Yes. The upper middle.
HARRIS: Right there?
HARRIS: What’s the date and time that that was accessed on that computer?
STOCKHAM: 12-8 at 9:54 and 9:53.
HARRIS: Is that a.m. or p.m.?
HARRIS: So what would that be thirteen hours later?
STOCKHAM: Thirteen hours later from what?
HARRIS: From the earlier one, the Captain Hook in the a.m.
[HMM. LET’S SEE. AT 8 SOMETHING IN THE MORNING, SCOTT ACCESSED A WEB PAGE. THEN AT ALMOST 10 THAT NIGHT HE ACCESSED IT AGAIN AND PRINTED IT OUT? WHAT ARE THEY TALKING ABOUT AND WHY? AND WHAT IS SO INCRIMINATING ABOUT THIS? NOW LOOK AT WHAT THE PROSECUTOR DOES NEXT.]
HARRIS: Now, I know computers do things at different speeds if you have got a dial up modem, if you got cable internet. But is it normal to take thirteen hours for a graphic to load?
STOCKHAM: No, not one of those.
HARRIS: Now, in terms of the times on the clock, you actually checked these particular clocks on these computers?
HARRIS: And you compared these clocks on these computers to the atomic clock?
HARRIS: And did you testify they were within two to three minutes of each other?
HARRIS: So in your assessment, were the clocks in these computers pretty accurate?
HARRIS: I have no other questions.
[I’M UNDERWHELMED. WHAT IS THE POINT?]
Recross Examination by Mark Geragos
GERAGOS: This one says 12/8. Do we have anything there that says “usafishing” on there with that same HTML that you just testified about?
STOCKHAM: You are asking to look at a lot of files.
GERAGOS: Well, the one —
STOCKHAM: That’s that big list on that piece of paper?
GERAGOS: Yeah. The one that he’s pointing to right here that I pointed to, Captain Hook, right? And then what he just asked you about, this item here. That doesn’t show up here, right?
STOCKHAM: No, not — correct. Not on that page.
GERAGOS: Right. It’s not on that page. So when obviously something is out of whack, because we have got 12/9 here, correct?
GERAGOS: And we have got 12/8 here, right?
GERAGOS: And then we have got 12/5 here, correct?
GERAGOS: Okay. So there is something out of whack there, right?
STOCKHAM: Well, not out of whack.
GERAGOS: There is something that’s — is there yet a third possibility, that this item — where was this recovered?
STOCKHAM: Well, you said that came from the desk.
GERAGOS: At the warehouse?
GERAGOS: And Mr. Wall is going to testify that these items came from the house?
STOCKHAM: From the — yes.
GERAGOS: From the laptop at the house that you named as the Dell Laptop at the house?
GERAGOS: Okay. Is there the third possibility, that it was — that this item was printed at the warehouse the following day?
STOCKHAM: Well, I don’t know. I didn’t do any printer tests.
GERAGOS: So we don’t — just don’t know?
STOCKHAM: That’s correct.
GERAGOS: Okay. Well, you don’t know at this point because you didn’t do a printer test?
GERAGOS: Printer test would tell us?
STOCKHAM: Well, not necessarily. Depends on the printer. And if I can match a printout from that printer.
GERAGOS: And the other question that Mr. Harris was asking you was the file times here on D5L-3. All of this is the internal clock, right?
STOCKHAM: Yes. Those would have been time stamps by the computer that had those files.
GERAGOS: Okay. And as you indicated before, much of the accuracy of that depends on the internal clock itself, correct?
STOCKHAM: Yes. And the user.
GERAGOS: And the user?
GERAGOS: Thank you. I have no further questions.
HARRIS: No additional questions.
JUDGE: Okay, Mr. Stockham. Thank you very much.
I congratulate Mr. Geragos on his cross-examination. Even a juror who didn’t sit in the jury box at the Peterson trial can understand it.
What did he show? That the prosecution believes that the first time Scott Peterson accessed the USA Fishing website was on Dec. 8. However, the defense showed that the police investigators didn’t bother to collate the results from all the computers. It’s impossible to tell when Scott accessed the website, except that it was probably after Dec. 5.
But how does this mitigate anything? The jury is still under the impression that Scott only became interested in the boat and the bay after meeting Amber Frey (his supposed motive for the crime).
Rhetorically, Stockham’s testimony bolsters the prosecution. He was clear and careful. The failings in the computer forensics examination were not his. The prosecution implied that the data was damning. The defense failed to imply that the data was ludicrously irrelevant; instead the defense went after the intengrity of the data.
The Peterson family website explains their take on the boat-purchasing issue: http://www.scottpetersonappeal.org/SPA1/Scotts_Boat.html
They list three people who told investigators that Scott was talking about buying a boat long before Dec. 5, but none of them testified at the trial. Why not?
In this humble juror’s opinion, Geragos won the technical battle by showing how indeterminate the computer evidence was, but lost the war of words.
To be continued ….