He then distributed those images all over the Internet. Amanda could not escape the sextortion as the perpetrator continually created fake personas and stalked her. Even when she moved and changed schools, he found a way to continue the harassment and threats.
On September 7th, 2012, Amanda posted a 9-minute video on YouTube, where she told her story using a series of flash cards. The video went viral but not until she died by suicide on October 10th, 2012.
Between November 2021 and the trial in June 2022, he authored various reports numbering a few hundred pages. There were all in response to prosecution requests to provide or present evidence to the jury in the trial. Many of these reports needed to explain how computers connect to the Internet and what IP addresses, VPNs, proxies, and cookies are.
In addition, the reports had to discuss how Facebook worked and how it had evolved between 2010 and 2013 because that was the time period these activities occurred.
The final and most important piece was to analyze 13 Facebook accounts and their associated records. Each of these accounts, the prosecution alleged, participated in the offenses committed against Amanda Todd in one way or another.
Warren's job was to find the commonalities or connections between those accounts using various methods and present them to the jury.
For this case, he needed the ability to isolate a certain set of artifacts, the session activities specifically, and analyze connections or similarities between them. This meant he needed to focus on hundreds of session activities between the 13 accounts.
In the trial materials provided to him by the prosecutor, there was an Excel spreadsheet that they had prepared prior to bringing him on board. It was a part of their preparation of the evidence, and it contained a summary of just over 1,460 session activities from all of the accounts in question.
The columns included IP addresses, dates and times, account names, machine cookie values, locations (derived from the City, Region, and Country), and some photo uploads. All this data was imported into YOSE, which structured the information and made it searchable.
He created a book for each account, and the general contents for each book described any Facebook artefacts they had in common with the other targeted accounts in question. Then, wherever he found matching data, he outlined what the connections were. YOSE helped him find the connections, which he verified in the Facebook records.
The final area YOSE assisted him with was in using the ‘Comparative Analytics’ feature. There were two accounts that had a lot of artifacts in common. They had a total of 171 unique machine cookie IDs combined. He needed to know how many of those intersected between the two accounts. YOSE showed him they shared 53 machine cookies, 46 of which were unique values.
Using YOSE, he could analyze a large amount of data and find crucial connections. He used YOSE to structure the information and evidence presented in court.
subdirectory_arrow_right YOSE™ subdirectory_arrow_right Discovry™
subdirectory_arrow_right Cyber Advisory subdirectory_arrow_right Cyber Analytics
subdirectory_arrow_right Locating trafficked children subdirectory_arrow_right Military intelligence section.. subdirectory_arrow_right Workload overload subdirectory_arrow_right Top target for cyber attacks All impact studies
Blog CyberTalks CISO Report 2022 myPaliscope