Between November 2021 and the trial in June 2022, he authored various reports numbering a few hundred pages. There were all in response to prosecution requests to provide or present evidence to the jury in the trial. Many of these reports needed to explain how computers connect to the Internet and what IP addresses, VPNs, proxies, and cookies are.
In addition, the reports had to discuss how Facebook worked and how it had evolved between 2010 and 2013 because that was the time period these activities occurred.
The final and most important piece was to analyze 13 Facebook accounts and their associated records. Each of these accounts, the prosecution alleged, participated in the offenses committed against Amanda Todd in one way or another.
Warren's job was to find the commonalities or connections between those accounts using various methods and present them to the jury.
For this case, he needed the ability to isolate a certain set of artifacts, the session activities specifically, and analyze connections or similarities between them. This meant he needed to focus on hundreds of session activities between the 13 accounts.
In the trial materials provided to him by the prosecutor, there was an Excel spreadsheet that they had prepared prior to bringing him on board. It was a part of their preparation of the evidence, and it contained a summary of just over 1,460 session activities from all of the accounts in question.
The columns included IP addresses, dates and times, account names, machine cookie values, locations (derived from the City, Region, and Country), and some photo uploads. All this data was imported into Explore, which structured the information and made it searchable.
He created a book for each account, and the general contents for each book described any Facebook artefacts they had in common with the other targeted accounts in question. Then, wherever he found matching data, he outlined what the connections were. Explore helped him find the connections, which he verified in the Facebook records.
The final area Explore assisted him with was in using the ‘Comparative Analytics’ feature. There were two accounts that had a lot of artifacts in common. They had a total of 171 unique machine cookie IDs combined. He needed to know how many of those intersected between the two accounts. Explore showed him they shared 53 machine cookies, 46 of which were unique values.
Using Explore, he could analyze a large amount of data and find crucial connections. He used Explore to structure the information and evidence presented in court.
Blog myPaliscope Login