The latest on the Karen Read murder case
Sign up for our Extra newsletter to get updates from the retrial and other breaking news alerts delivered to your inbox.
Karen Read trial jurors hear from digital expert about infamous ‘hos long’ search
Jessica Hyde opined “to a scientific degree of certainty” that Jennifer McCabe did not Google “hos long to die in cold” at 2:27 a.m. on Jan. 29, 2022.
On the stand Wednesday:
5 p.m. update: Defense grills digital forensics expert on analysis of ‘hos long’ search, John O’Keefe’s phone data
Defense attorney Robert Alessi went over digital forensics expert Jessica Hyde’s report with a fine-toothed comb on cross-examination, highlighting her analysis of data from witness Jennifer McCabe’s cellphone.
Alessi drew Hyde’s attention to an excerpt from the report where she wrote McCabe’s now-infamous “hos long to die in cold” Google search “was marked by Cellebrite as having this [2:27 a.m.] timestamp and being deleted.”
McCabe was one of two women with Karen Read when she found her boyfriend, Boston Police Officer John O’Keefe, unresponsive in the snow on Jan. 29, 2022. The timing of the “hos long” search is one of the most contentious pieces of evidence in Read’s case; while Read’s lawyers allege McCabe made the search at 2:27 a.m. on the 29th, prosecutors contend she did so hours later, at 6:24 a.m.
Advertisement:
Earlier Wednesday, Hyde threw her weight behind the 6:24 a.m. timestamp and explained that the earlier time offered by the defense actually indicates when McCabe opened the browser tab she used.
Poring over Hyde’s report, Alessi noted that she wrote testing showed “great inconsistency” for the timing of McCabe’s search. He pointed to another excerpt from her report that reads, “While a definitive reason as to why the timestamp is listing the time of 2:27:40 is unknown, the time is inconsistent with the timestamps associated with the same search.”
“So you used the word ‘unknown’? Your word, in your report?” Alessi pressed. Hyde agreed she did.
Answering a later question from special prosecutor Hank Brennan, however, Hyde testified prosecutors never asked her to provide a particular result or conclusion debunking the 2:27 a.m. timestamp. She said her analysis was independent of the Norfolk County District Attorney’s Office, and she had limited communication with the DA’s office leading up to Read’s first trial last year.
Advertisement:
Alessi turned his attention at one point to the tools Hyde used in her analysis of McCabe’s phone data. Wouldn’t Apple’s closed source code offer the best information to clear up the timestamp dispute, he wondered?
“You do not need access to the source code to be able to speak to an artifact,” Hyde maintained.
“Apple’s source code is not a healthy way to do an examination, because it would be so onerous, and we do not know the level of documentation, we don’t know the language,” she later added. “That is not necessarily the most effective way to determine what data is. Forensics tools parse results of how data is. They don’t interpret them; the examiner interprets them and provides meaning.”
Hyde also testified that O’Keefe’s phone did not appear to have been stored in accordance with best digital forensics practices, which would dictate securing the device in a Faraday box or bag to shield it from electromagnetic signals.
“This is so a remote wipe command couldn’t be sent, or so that more data isn’t received to the phone, because phones are live and constantly obtaining data,” Hyde explained.
Advertisement:
“Do you know whether any of those protocols were followed for either the iPhone of Jen McCabe or John O’Keefe?” Alessi asked.
Hyde said she wasn’t there for those processes and doesn’t have relevant documentation.
“Fair enough,” Alessi acknowledged. “But do you have a little bit of [a] hint as to whether the phone of Mr. John O’Keefe was properly secured in airplane mode, a Faraday bag, or a Faraday box, based upon your own report?”
Hyde explained she did see incoming data on O’Keefe’s phone “that is consistent with the device not being Faradayed, such as the receipt of SMS messages, notifications from Ring, et cetera.”
She testified that it didn’t appear O’Keefe’s phone was at risk of being wiped, because it ultimately was not wiped.
“And we actually have more data, because we get to see the data that continued to come in to the device,” Hyde continued. “I’m not saying that’s in accordance with best practice; I’m saying that that’s what I see based off of what you just had me review in the data.”
Advertisement:
Alessi told Hyde it sounded like she was trying to justify investigators leaving the device unsecured, and she denied doing so.
The best practice is to put the phone in a Faraday bag, unless a victim’s biometrics are needed to unlock the device, she said. Alessi asked if she knew whether investigators were able to immediately obtain O’Keefe’s passcode, and she said she didn’t.
Answering another question from Alessi, Hyde confirmed that when a phone is not placed in a Faraday enclosure, its data can “theoretically” be overwritten.
Following Hyde’s testimony, Brennan played a brief clip from one of Read’s interviews for an Investigation Discovery docuseries.
“Jen McCabe, it’s me or her,” Read said in the clip. “Either I’m going down, Jen, or you are.”
Judge Beverly Cannone dismissed jurors shortly after 3:30 p.m., telling them the trial is still moving ahead of schedule.
1:30 p.m. update: Digital forensics expert says ‘hos long’ search didn’t happen at 2:27 a.m.
Jennifer McCabe’s hotly debated and highly scrutinized “hos long to die in cold” Google search was not made at 2:27 a.m. on Jan. 29, 2022, as Karen Read’s lawyers have claimed, digital forensics examiner Jessica Hyde testified.
Hyde told jurors she reviewed data from McCabe’s cellphone, looking specifically for deleted searches and phone calls from around the time John O’Keefe died. McCabe was one of two women with Read when she found O’Keefe in the snow around 6 a.m. on the 29th.
Advertisement:
Read’s lawyers allege McCabe’s phone data shows a 2:27 a.m. timestamp for the “hos long” search, suggesting she had hypothermia on her mind hours before O’Keefe was found. However, Hyde explained the timestamp actually indicates when McCabe opened the Safari browser tab she used for the search.
“What I can state to a scientific degree of certainty is that that search occurred at 6:24 a.m. and was the last search in the tab that had been opened at 2:27,” she opined.
McCabe testified last week that she played on her phone and Googled youth sports websites after arriving home in the early hours of the 29th.
Taking the stand Wednesday, Hyde spoke about using various forensics tools to parse through the data from McCabe’s phone, including Cellebrite and Magnet Axiom. She explained she was intimately familiar with Magnet Forensics, having previously served as the company’s director of forensics for several years.
The same search can leave multiple artifacts, or traces of data, in different places on a mobile device, she explained. According to Hyde, McCabe’s phone showed multiple artifacts for the “hos long” search, but only one is associated with the 2:27 a.m. timestamp.
“Is there any danger for an untrained eye to rely simply on the software when looking at a search like this ‘how long to die in the cold’ and seeing the 2:27 timestamp?” special prosecutor Hank Brennan asked.
Advertisement:
“Absolutely,” Hyde replied. “There’s a really scary danger that an examiner who has not dug into the artifact and tested to see what it means may assume erroneously that that 2:27 timestamp is the time that what is there is searched.”
Later, she added: “You could erroneously implicate a search was done hours, or some time period, or even days before it actually occurred. Some of us leave our tabs open forever.”
According to Hyde, neither of McCabe’s two hypothermia-related Google searches — “how long ti die in cikd” and “hos long to die in cold” — were done using private browsing mode.
She also testified that McCabe didn’t delete her “hos long” search, as the defense has claimed. Hyde explained that a device’s write-ahead log — an intermediary database storing new and recently deleted data before it is permanently logged — is similar to a warming station at a restaurant that holds dishes going out to diners and dishes sent back to the kitchen.
Noting the write-ahead log can contain both deleted data and data that hasn’t yet been delivered to a database, she asserted, “an assumption that the data was deleted just because it’s in the WAL file is actually not true.”
Hyde also said forensic examiners should “never assume” something has been deleted “without doing a manual examination” of the data.
Advertisement:
“My opinion is there was no deletion that occurred by the user, because it is not something a user can delete,” she said of McCabe’s “hos long” search.
Hyde then addressed whether McCabe had deleted any calls from her phone, stating her opinion that the device itself only stores the 200 most recent calls in its call log and deletes the earliest entry each time the 201st call comes in.
Judge Beverly Cannone called a lunch recess after Brennan concluded his direct examination.
11:20 a.m. update: Lawyers clash over digital forensics examiner expected to weigh in on ‘hos long’ search
With jurors out of the courtroom, Karen Read’s lawyers clashed with prosecutors over upcoming testimony from Jessica Hyde, a digital forensics examiner who has sought to debunk a 2:27 a.m. timestamp for witness Jennifer McCabe’s “hos long to die in cold” Google search.
Defense attorney Robert Alessi explained he’s not trying to bar any of Hyde’s upcoming testimony but said he wants to cross-examine her about a Maryland court ruling that took issue with part of a report she presented in that case. He argued the Maryland ruling calls Hyde’s reliability into question.
“This is an attempt to try to malign a witness with something that’s wholly unrelated and not relevant to what she’s going to testify to, or the basis for her opinion,” special prosecutor Hank Brennan fired back.
“This is not a denouncement,” he said of the Maryland ruling. “She has not been found incredible.”
Advertisement:
Brennan further alleged Alessi wanted to “dehumanize” Hyde, a claim Alessi disputed.
“I have no intention to dehumanize her,” Alessi replied. “What I intend to do is impeach her on her reliability.”
Evidently frustrated, Judge Beverly Cannone called a recess to weigh the arguments. When she returned, she announced she would exclude the Maryland decision, though she said Alessi is “certainly free to cross-examine Ms. Hyde regarding her methodology.”
10:10 a.m. update: State Police trooper shows jurors taillight fragments, answers questions about working with Michael Proctor
Jurors got a glimpse at some of the taillight fragments at the heart of Karen Read’s case Wednesday as Massachusetts State Police Trooper Connor Keefe took the stand and put several pieces of evidence on display.
Keefe testified he responded to 34 Fairview Road in Canton between 5 and 5:30 p.m. on Jan. 29, 2022. Read had discovered her boyfriend, Boston Police Officer John O’Keefe, cold and lifeless on the home’s lawn hours earlier.
Keefe told jurors his role at the scene was to process any evidence the State Police Special Emergency Response Team uncovered in the snow. State Police Lt. Brian Tully would photograph the evidence, he said, and Keefe would then secure it in a bag.
He showed jurors O’Keefe’s missing sneaker, which investigators found buried in the snow that day. Keefe also displayed pieces of clear and red plastic taillight shards. He explained he’d initially placed two pieces of red plastic in one of the evidence bags and didn’t know whether a third chip in the bag had broken off from one of the larger fragments. However, he testified the small chip was consistent with the two bigger pieces.
Advertisement:
Keefe also said he extracted data from cellphones belonging to witnesses Jennifer McCabe and Kerry Roberts, who were with Read when she found O’Keefe on Jan. 29, 2022. He noted he was not involved in analyzing either phone’s contents.
On cross-examination, defense attorney David Yannetti asked Keefe about former State Police Trooper Michael Proctor, who led the investigation into O’Keefe’s death. Keefe testified he’s worked on “a few” cases with Proctor in the past.
Yannetti asked whether Proctor and Keefe interviewed witness Sarah Levinson together on Oct. 21, 2022, and Keefe said he didn’t recall doing so. Yannetti showed him a copy of a report to refresh his memory, and Keefe confirmed Proctor wrote the report in question.
He also testified that he retrieved surveillance video from the bars where Read and O’Keefe drank on Jan. 28, 2022, though Proctor was the one to analyze them.
Keefe confirmed he attended O’Keefe’s autopsy at the Office of the Chief Medical Examiner in Sandwich and said O’Keefe’s injuries included two black eyes, a swollen right eye, and a small cut above his right eye.
“You didn’t see any bruising on his arm, correct?” Yannetti asked.
“I don’t recall,” Keefe replied.
“You didn’t notice any obvious broken bones, did you?” Yannetti pressed.
“I am not a medical expert,” Keefe answered.
Advertisement:
Yannetti asked whether there was a defense expert present during the autopsy.
“Not when I was there,” Keefe said.
Livestream via NBC10 Boston.
Testimony continues in Karen Read‘s murder retrial Wednesday after jurors heard about the search for evidence outside 34 Fairview Road and listened to Read’s expletive-filled voicemails to John O’Keefe.
“John, I f***ing hate you!” Read screamed in one voicemail at 12:37 a.m. on Jan. 29, 2022 — the same morning O’Keefe was found unresponsive on a snowy lawn in Canton. In later messages, Read called her boyfriend of two years a “f***ing pervert” and alleged he was cheating on her with “another girl.”
Read, 45, is accused of ramming O’Keefe with her SUV in a drunken rage following a night of bar-hopping. Prosecutors allege she struck O’Keefe, a Boston police officer, and left him to die in a blizzard while dropping him off at 34 Fairview Road for an afterparty.
More on Karen Read:
However, Read’s lawyers contend she was a “convenient outsider” framed in a vast law enforcement conspiracy to protect the friends and family of homeowner Brian Albert, a fellow Boston police officer. They’ve suggested O’Keefe was actually beaten inside 34 Fairview Road, attacked by the Alberts’ dog, and dumped outside in the snow.
Testifying Tuesday, retired Canton Police Lt. Paul Gallagher adamantly denied giving special treatment to Brian Albert during the early investigation into O’Keefe’s death. He also told jurors he didn’t see footprints, dog tracks, or visible signs to suggest anything had been dragged through the snow outside 34 Fairview Road.
Advertisement:
Massachusetts State Police Lt. Kevin O’Hara similarly testified that he saw “fresh, undisturbed” snow in the search area when he first arrived at 4:56 p.m. on Jan. 29, hours after O’Keefe was found. He said the State Police Special Emergency Response Team (SERT) ultimately unearthed a sneaker “flush up against the curb” and “maybe six or seven pieces of taillight” from the deep snow. According to O’Hara, the SERT team commander, a couple pieces of evidence found during that search were “at ground level, touching the asphalt.”
Defense attorney Alan Jackson highlighted the lack of crime scene security throughout much of the day Jan. 29, confirming O’Hara didn’t see crime scene tape, barricades, or a police presence when he arrived.
“So before you arrived at least, and before your presence was known, for some time before you got there, that scene could have been accessed by anyone, to your knowledge?” Jackson asked.
“Well, I think the weather played a good [role] helping us with the scene security, because with that being fresh, undisturbed snow, and with the man tracking we do, we would be able to determine if anyone had accessed that area,” O’Hara replied.
The ongoing trial is Read’s second, after her first murder trial ended with a hung jury last July.
To comment, please create a screen name in your profile
To comment, please verify your email address
Conversation
This discussion has ended. Please join elsewhere on Boston.com