Analyzing evidence for court

Impact Study

A Digital Investigator used YOSE to analyze evidence in a widley known sextortion case

Challenge

Analyzing reports and Facebook accounts

Warren Bulmer is a digital investigator and was one of the expert witnesses for the Crown Counsel in the Amanda Todd sextortion case.

Between November 2021 and the trial in June 2022, he authored various reports numbering a few hundred pages. There were all in response to prosecution requests to provide or present evidence to the jury in the trial. Many of these reports needed to explain how computers connect to the Internet and what IP addresses, VPNs, proxies, and cookies are.

In addition, the reports had to discuss how Facebook worked and how it had evolved between 2010 and 2013 because that was the time period these activities occurred.

The final and most important piece was to analyze 13 Facebook accounts and their associated records. Each of these accounts, the prosecution alleged, participated in the offenses committed against Amanda Todd in one way or another.

Warren's job was to find the commonalities or connections between those accounts using various methods and present them to the jury.

Solution

Using YOSE to structure and analyze data

Warren has been involved with the development of YOSE and has good knowledge of its tools and features.

For this case, he needed the ability to isolate a certain set of artifacts, the session activities specifically, and analyze connections or similarities between them. This meant he needed to focus on hundreds of session activities between the 13 accounts.

In the trial materials provided to him by the prosecutor, there was an Excel spreadsheet that they had prepared prior to bringing him on board. It was a part of their preparation of the evidence, and it contained a summary of just over 1,460 session activities from all of the accounts in question.

The columns included IP addresses, dates and times, account names, machine cookie values, locations (derived from the City, Region, and Country), and some photo uploads. All this data was imported into YOSE, which structured the information and made it searchable.

He created a book for each account, and the general contents for each book described any Facebook artefacts they had in common with the other targeted accounts in question. Then, wherever he found matching data, he outlined what the connections were. YOSE helped him find the connections, which he verified in the Facebook records.

The final area YOSE assisted him with was in using the ‘Comparative Analytics’ feature. There were two accounts that had a lot of artifacts in common. They had a total of 171 unique machine cookie IDs combined. He needed to know how many of those intersected between the two accounts. YOSE showed him they shared 53 machine cookies, 46 of which were unique values.

Using YOSE, he could analyze a large amount of data and find crucial connections. He used YOSE to structure the information and evidence presented in court.

“YOSE created an opportunity for me to visualize the data. One piece of information can be valuable, but when you can connect 2 or 3 pieces, it becomes powerful, and it can change the level of coincidence.”

Warren Bulmer, Digital Investigator and expert witness in Amanda Todd's case

Result

Convicted of all charges

In December 2020, Aydin Coban was extradited to Canada to face prosecution for his sextortion of Amanda. On August 6th, 2022, he was convicted of all charges.

On October 14th, 2022, he was sentenced to 13 years in prison.

Many other investigators and experts were working on the case and also prosecutors who did an outstanding job. Everyone contributed with their skills, knowledge, and determination to putting Aydin Coban in prison for a long time. And we are proud of the part we could contribute to with YOSE.