Boston police detectives say they were able to track down and arrest the so-called Craigslist killer by following a trail of electronic footprints.
Suffolk District Attorney Daniel Conley says police were able to track down and charge Philip Markoff with murdering Julissa Brisman on April 14 and robbing another woman four days earlier by tracing his e-mail and cell phone communications.
Lawrence James works in law enforcement and is the director of forensics and investigations for the Cyber Forensic Group in Medford, which conducts cyber-investigations and provides cyber-security for corporations.
James explained to WBUR how detectives can use digital information to find criminal suspects.
Police were able to track down Philip Markoff by tracing the use of his cell phone and his computer. Walk us through how that works — how are police able to uncover cyber fingerprints?
LAWRENCE JAMES: First off, let me just state that I haven't spoken with any of the investigators involved and I have no intimate knowledge of the investigation. But, if they have the target in mind, information, subpoenas, freeze orders and subsequent search warrants could be issued to the legal team at Craigslist, to provide any information regarding any communications from the victims, in this case, and the alleged suspects.
Once that information has been returned back to law enforcement, from there they'll continue to pour through those records and they may issue several or even another dozen follow-up subpoenas on IPs that may have been provided in the initial subpoenas and search warrants, and e-mail addresses, etcetera.
As far as the cell phones go, if there was a cell phone on the scene that would be pretty standard operating procedure, to see who the victims most recent communications were with. A freeze order could be placed on that telephone number, and a subsequent search warrant, to provide any of the phone calls, incoming and outgoing.
Do most criminals, or alleged criminals, not appreciate how traceable they are by cell phone or online?
JAMES: I think a good deal of them do understand that they can be traced, however I think a great deal of them lack the understanding of the technologies to realize where they're leaving information about themselves.
So, more and more, as we're becoming more technologically advanced, people are understanding more — bad guys are understanding more — that they are leaving information that can be retrieved by investigators, so they may at some point try to employ some techniques to try to cover their tracks a little bit better.
Does it appear to you that Philip Markoff was unusually clumsy in the way that he left his cyber fingerprints all over the place?
JAMES: Well, like I say, I don't know exactly what they did subpoena. But the fact that, using Craigslist, there are several records that could be gleaned from that. And based on what I've heard through the media, they've done some subpoenas based on IP records, which may very well have come back to his Blackberry or his home.
And that just shows that he probably didn't have a great understanding of how easy it would be to trace him.
Can a more sophisticated criminal use the Internet, and cover his or her tracks more effectively?
JAMES: Yeah, they can try. There are some tools out there that will assist them. But at that point in time it really comes down to good old-fashioned police work. Solid interviewing. Background checks on the victims. Speaking to people that knew them.
You get a great deal of information from there. That, in turn, can lead you into other areas to try to help you identify the people involved.
The arrest of Philip Markoff shows how effective cyber investigation can be. Is there a flip side to that? Is it also a reminder of how visible and maybe vulnerable we are in cyberspace?
JAMES: Personally, myself, I'm not looking over my shoulder when I'm in cyberspace. You know, I use it for the reasons it was intended. I think the vast majority of people do use it for its intended purpose.
With the onslaught of identity theft and all of the frauds and stuff going online -- that is a sign of that. I think people just need to be vigilant, especially from childrens' standpoint of being victimized. Parents need to be involved in their lives and make sure they go in and check on their kids and see what they're doing.
This program aired on April 22, 2009.