web browsing as forensic evidence in Norwegian murder case

A very peculiar murder is being investigated by the Norwegian police, known as the "Skøyen homocide" after the Oslo region where it happened. Basically a man was killed with a knife in a garage, he had no known enemies and there is no obvious motive. The police investigation so far has made the police believe that one of the neighbours did it. There is some technical evidence, specialists claim a knife the neighbour owns is "more likely to be the murder weapon than not be the murder weapon", and there are assumptions based on his computing activity on that day. Basically, there is a 10 minute gap of inactivity around the time the police assumes the victim arrived at the garage. The accused explains that he was working from home because his daughter was ill, and any absence from the computer is due to him taking care of her.

I have no inside information here, I have only paid some attention to media reports because the case is so peculiar. (Personally I don't find the police's scenario very convincing. Who would leave their web surfing, walk back to their garage to commit a messy knife murder of a random person, walk back up again and continue surfing only ten minutes later?) But the latest news from one of Norway's most respected daily newspapers reveals some more details about the computer evidence – and it says that the accused even was an Opera user:

(..) between 16.03.48 and 16.13.11 there was no clear evidence of user activity on the computer (..) – In this interval we do have the timestamps that have been a topic as evidence, Holden [police lawyer] points out.

The court debates whether these so called timestamps are created due to user activity or by the computer's software.
The conclusion from Kripos [special police unit] was that other software than the accused's Opera E-mail client may have created the debated timestamps, but they can not confirm what kind of software may be involved.
Defence lawyer Petter Nordgreen Sterud (..) says five timestamped files and one cookie are from the interval between 16.03 and 16.13, and he believes that no other good explanations than user activity have been put forward.

Of course, a web browser is absolutely not a reliable witness for user activity. Today's all-singing all-dancing websites can reload bits and pieces at any time, thus cause new cached files without anyone being present at the computer. We don't get any information about what type of files one is dealing with – but the specific reference to the mail client is interesting. If the mail client fetched mail (either at an automated interval or because of a manual "check now" action) it may well have created five new files for downloaded E-mail – but in that case, it should be pretty obvious to the Kripos experts what software was responsible.. If it is about mail client files, the defence should ask whether Kripos checked the interval between mail client timestamps against the interval for automated checks. An unexpected timestamp in the sequence would be a strong indication of user activity.

The cookie may not be significant as evidence either, but it certainly could be, depending on its name, what site served it, and its value. I certainly hope Kripos is professional enough to check where the cookie came from and what sort of process would set it (and I hope the defence lawyers are skilled enough to check whether this has been done). If it is typically set in response to user activity, it could give significant weight to the defence's argument that the accused man was in his flat.

For me, the case raises deeper questions too: how do we explain the details of computing to the public and the authorities? Your aunt might have a very fuzzy interpretation of what a "cookie" is, but one day she may be asked to sit on a jury and listen to computer-related evidence.. Sometimes there is no good substitute for computer literacy..


12 thoughts on “web browsing as forensic evidence in Norwegian murder case

  1. Five minutes of inactivity followed by "He's dead, Jim." That would be something material. Same as they analyze a man's computer if he is accused of soliciting a personal visit with some underage minor.But yes, it would seem the police are grasping at straws without the benefit of a magic spinster to weave this into something useful.On a semi-related note, there was an instance in the UK some years back. A fellow had been in an internet argument. He stood up, walked out the back to his garden shed. Cut the head off his best axe, took its handle and drove sixty kilometers in the family car. Knocked on another man's door, then proceeded to beat him "about the head and neck" with his axe-HANDLE. Left the PC on, lights on, doors open. Like a man possessed.Some years before that, a young girl in Japan gruesomely murdered another at school. Personal computer activity was used as evidence to argue for commitment to a mental facility, as her browsing history indicated a "deranged obsession with the grotesque and paranormal."And on a more personal note, an acquaintance had just arrived home. When she stepped back out to the garage, her purse was missing from her car. She searched the house, then went online to report theft of her credit cards and bankbook. Her Visa had already been used at the nearest fuel station and convenience store. She went back out to drive to the convenience store, and her purse was back in the car. Nothing missing. So she drove to the convenience store and spoke with the manager. They looked at the store camera records and she identified a neighbour as the person using her Visa. This evidence was taken to the police and her neighbour was eventually convicted of theft from six different people.I might also posit that in Opera, the unfortunate fellow under question may have simply been using a private tab for those few minutes.

  2. Four big holes in this one.1. He could never clean blood off himself in a manner that would prevent him from leaving residue on the keyboard.2. A person who is stabbed takes a while to bleed to death, to prevent him from alerting someone he would have to stay longer.3. You cannot pinpoint a time of death to a 10 minute window. There is to many variables that effect how fast a body will cool.4. Knives are mass produced, there are thousands of copies of every knife out there.

  3. They charged this guy because he was leaving scratch marks on cars that were wrongly parked. The police actually parked a car in the parking area, and waited. One day, the guy walks up and scratches it.So they are saying that the guy who was killed most likely caught the accused scratching cars.It doesn't make sense to me that this guy would pick up a knife and walk to the parking area just to look for wrongly parked cars. Did he really do that?Anyway, I certainly hope they bring in some independent computer experts.

  4. Oh wow. That's really something! Perhaps he had some manner of derangement, but I cannot picture anyone saying "wait one sec" then killing a man on the way back from the bathroom. I DO recall a pranking incident where someone snipped all the tire valves in an apartment parking lot with some manner of bolt cutter.Last year a man killed a woman for yelling at her dog because it wouldn't stop barking when let in the yard. He beat her with a barbell, then cut the body. That's pretty crazy.The Register reports an incoherent man running amok at a toy store, he began fending off tazers with a plastic lightsaber so they had to catch him the hard way.

  5. Originally posted by hallvors:

    The police apparently did not convince the court, so the accused was judged "not guilty".

    They better find the person who did it then, or find better evidence.

  6. http://translate.googleusercontent.com/translate_c?hl=en&prev=/search%3Fq%3DVegard%2BBjerck%26num%3D100%26hl%3Den%26safe%3Doff%26client%3Dopera%26hs%3DouV%26rls%3Den%26channel%3Dsuggest%26prmd%3Dimvns&rurl=translate.google.co.uk&sl=no&twu=1&u=http://m.nrk.no/m/artikkel.jsp%3Fart_id%3D17904539&usg=ALkJrhgmY0n8I3-0LMqrl8RICiCoGIuOSQ"According to the daughter the father was at home when she came home from school just before the clock 16 She says that her father was at home all the time to fit the younger sister who was ill and that he probably put in front of the computer in the bedroom when she got home. In the interview the girl said that it was she who told her father that there had been a murder in the garage. – Mom called and told me that there had been a murder. I hung up the phone and told my dad. The police said that her father "might react with some surprise," on what she said, but that he did not ask anything more about the case. – Dad is not the kind of person who talks so much, so we did not talk any more about it, let my daughter to."" The defendant has been working on a screenplay about a murder in a garage. The police have used against him"———————————————-It does rather come across as a case where everyone knew who did it but no-one can prove it.I am surprised there is no forensic psychology about the personality traits of people who key cars because they are improperly parked.

  7. This could have been pinned to him. The margins are so very small and the lack of hard evidence is quite remarkable. It is difficult to avoid blood and/or injury to self when stabbing a person…they rarely collapse and die without a scuffle. Lack of hard evidence in fibers, skin or blood is disturbing by itself. Implying the fellow looked out a window, went off to kill some bloke, and returned to what he'd been doing…in minutes…with no significant evidence….? I'd sooner blame the daughter or a neighbour who knew the circumstances of the family.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s