Officers from Europol took the stand on Monday afternoon and testified in the proceedings against murder suspect Yorgen Fenech.
17 Black owner and former Electrogas director stands accused with complicity in the murder of journalist Daphne Caruana Galizia.
Three Europol experts who worked on the extraction of data from all electronic devices seized from Fenech presented a copy of the data which amounted to around 4 TB to the court.
During the sitting, one of the experts returned two iPhones and two SIM cards which were still in his possession.
The three experts also presented their reports relating to the data extraction carried out on the different devices.
Police found a Wifi security camera disguised as an air freshener in Fenech’s home, but there was no micro SD card in the camera, which therefore contained no data.
A separate Europol team was tasked with analysing the extracted data. The team is from the AP Weapons and Explosives which is an analysis project that deals with criminal organisations and individuals involved in the illegal manufacturing, possession and trafficking of small arms, light weapons, ammunition, parts and components, as well as explosives (military, commercial, pyrotechnics and improvised/homemade), explosives precursors, improvised explosive devices (parts and components), military ordnance (parts and components), chemical biological radiological and nuclear (CBRN) materials and other dangerous substances that could be used as weapons
Thank you for following us.
The sitting has been adjourned. The next sitting is on Wednesday 2 December at 10am.
It prohibited the parties from giving this information to third parties unless required by a criminal investigation. Failure to do so would be a prosecutable offence.
The court says that it prohibits the parties from publishing any information contained on the hard drive presented in court today and of which copies will be given to the parties, aside from the information which will emerge in open court.
"Bla dubju ta' xejn," says the court, which was going to order it anyway.
Dr Mercieca says that in view of the fact that the data could contain data unrelated to the charges and about the private life of Fenech. He asks about a ban on the publication of the data.
The Europol experts are asked to wait outside.
Petrou exhibits their third copy which is split on two drives, but it is identical to the other hard drives.
Petrou takes the stand again. He will testify on behalf of all three experts.
Mercieca: I don't understand why we have to get it at the same time.
Magistrate Montebello: You had a very specific request. It's for everyone to receive it at the same time.
Magistrate Montebello: I don't think that you don't have an objection that defence takes its copy when the rest are ready, right?
Europol experts are called in back in the courtroom.
The copies might not be ready by Wednesday's sitting.
The second copy of the hard drive exhibited today will not be touched.
The court appoints Alvin Cardona to make three copies of the information contained on the hard drive. Copies of hard drive XYZ1 will given to the parties.
They are called back into the courtroom.
A further copy will be made and exhibited at a later date.
The court orders Europol experts to hand the third hard drive to the defence on 2 December. This hard drive was meant to be presented before the inquiring magistrate. The hard drive will be given to the defence as copied.
"You do appreciate that the process you are explaining will take a lot of time," Magistrate Montebello tells the defence.
"It is not the defence's intention to delay the process," Mercieca tells the court, he says that the process to copy the data might result in errors during the process, as he explained their position.
Deputy AG highlights that the request of the defence means that there are expenses and time involved.
The court turns down the request by the defence since this would mean that the parties would not be given a copy of the data in a short time.
Dr Azzopardi says that for the parte civile it does not matter if it's Europol or a local expert.
The prosecution request the appointment of an expert to make a copy of the data contained in the hard drives which were exhibited today. These copies will be given to the parties. The defence objected to the request and demands that the information which it receives is extracted directly by Europol from the same network used by Europol.
The spare copy to be exhibited is not enough.
"We don't need Europol to make a copy of a hard drive, a Maltese expert can be appointed to do this," Azzopardi says.
"We do not have the appropriate equipment to replicate the hard drive," Torres said.
They have another copy which will be exhibited in other proceedings.
Petrou says that it is almost four terabytes of data consisting of small files and that he is not sure that it would finalized by Wednesday.
Magistrate Montebello tells that three witnesses that the court requires another 3 copies of the information they exhibited today.
Europol experts are called back in.
Deputy AG explains that the court expert is answerable to the court.
"Even if they copy it from these hard drives, the important thing is that Europol does the copy of the hard drives," Dr Camilleri clarifies.
Arnaud suggests that the court orders new hard drives and the Europol experts make the copy until they are in Malta.
Dr Camilleri clarifies that what the defence does not want a new expert to be introduced in the chain.
Dr Camilleri says that they want an extraction to be done, with the prosecution hitting back that this has already been done.
"Why is the defence playing for time?" Dr Azzopardi asks.
Deputy AG Galea Farrugia argues that the copies were made from the data extracted. The court can distribute copies of it all will, he said.
This would require the Europol experts to come back with the copies.
Arnaud says that they are not a copy of copy.
Dr Mercieca is asking for a copy to be made off from the network storage onto a hard drive which will be given to the parties.
Dr Mercieca asks that the copies should not be a copy of a copy.
Dr Mercieca starts off with regards to the procedure of making a copy of the hard drive… Magistrate Montebello cuts him off asking him "What are you eating?", he grins, "it's very bad manners," she says.
Arnaud asks the court to appoint an expert to make copies of drives for the parties.
The cross-examination is suspended. The witness steps down.
Dr Mercieca says that they would like to continue the cross-examination on Wednesday.
The witness looks at his report for the software was used.
Petrou confirms that FTK Imager was used. This is one of the standard software used.
The experts used Tableau write-blockers, Petrou explains. He goes into the technical aspect of data extraction. A byte-to-byte copy was made.
Petrou: We were using forensic tools. These have their limitations. Some of the data could not be extracted. But this was technical data.
Mercieca: One last question, in layman's terms, you've extracted the totality of the data contained on the devices?
Petrou has already testified in separate proceedings on extractions.
Deputy AG Galea Farrugia objects on a point of procedure.
Magistrate Montebello points out that this is a cross-examination and not an examination of the witness and that the questions should relate on the extraction performed on certain devices.
Petrou: The documentation contains this information. I wasn't managing the case.
Mercieca: Which ones took part in the investigation?
Petrou: Also other colleagues have been involved.
Mercieca: Who are these people?
Petrou: There is me, Daniel, Israel, Giuseppe, Margerita, Alex (new guy), James, Sami,…
Mercieca: You, Giuseppe and Israel for the devices which have been seized since 2017?
Petrou says that he has performed some extractions, adding that his colleagues have extracted other data.
The lawyer probes the witness on whether he was the team leader.
The Europol has a team to extract data and a team to analyze data.
Petrou explains that he has been on the case and testified in different proceedings related to the assassination.
He offers to check his email to confirm the names of the people.
He met them when he was in Malta and he would have probably had met them at Europol.
Europol WP Weapons and Explosives were working in a separate room.
Petrou: For our team: it was me, Giuseppe, Israel and Sami. I don't remember the others. But it was more than one.
Mercieca: Do you remember how many they were?
Petrou explains that their [the three witnesses present today] job was to extract data, while the Europol experts from AP Weapons and Explosive team analysed the data.
Petrou: There were people from the AP Weapons and Explosive team.
Mercieca: Do you know who they are?
Petrou: I don't recall their names. I know their first name but I forgot.
Mercieca: Are you aware of any more Europol members working in Malta?
"Sami delivered four evidence bags to me which are listed in the report," Petrou says, adding that he was not given any another exhibits by Sami.
Petrou asks to check the list he presented earlier.
Mercieca: Your investigation spanned throughout some time. What other devices did Sami deliver to you?
"The exhibits were received from the Maltese Police by Sami and then they were passed to me," Petrou says.
"In the forensic lab we don't have a person called Gerth. He might be someone from AP Weapons and Explosives. Am aware of a Gerth but don't know his last name," Petrou replies.
Mercieca asks about Gerth Duwee.
The witness says that he worked with Israel and Giuseppe.
The case is called Blue Elephant.
Petrou says he does not understand what Mercieca is asking.
Petrou's team leader was not in Malta.
Petrou says he joined Europol in 2015. His job is to perform forensic tasks for Europol or Member States if they request so. Physical exhibits are given to Petrou for him to extract the data.
There is a copy at Europol.
Petrou says that the hard copy was only made for the court.
Petrou: Yes to the AP weapons and explosive.
Mercieca: Have you sent out copies to anyone else before today's sittings yes?
Petrou: It was requested by the Maltese police. Mr Keith.
Mercieca: Was it the only time that Mr Arnaud contacted you about the investigation?
Petrou: We've been working on the case for many years. No.
Petrou glances over to Arnaud.
Mercieca: Who requested two copies of the report?
Mercieca will cross examine Petrou alone.
Torres and Totaro are asked to wait outside.
Petrou says that they have network storage where all extracted data is stored and this was then copied to the hard drive. The initial extraction happened first individually from the exhibits given to each expert. From there the data was copied to the hard drives.
Petrou says that the data has been copied to the hard drives.
Dr Mercieca asks whether the information they testified about individually is contained in the hard drives.
Dr Mercieca will be cross-examining the three experts jointly.
The three Europol experts are back in the courtroom.
The accused is led back into the courtroom.
We're given a 10-minute break.
The Court asks the witness to wait outside.
The witness steps off the stand.
Torres is presenting documents relating to the delivery of exhibits.
Mercieca asks for more time before cross-examining the witnesses as the defence received the reports today.
Some SIM cards were still new.
The pack is the format in which a SIM card is sold.
"A nano SIM card is intended to provide phone service, and data to a device," the expert says.
Dr Azzopardi says he did not ask about the "bahh".
Magistrate Montebello says that the questioning can proceed.
Dr Mercieca objects to the questions by the parte civile, saying that the expert should reply to questions related to his appointment.
Asked about a nano-SIM card listed in the report.
Torres says they are SIM cards for ISP and service provider services for the phone.
He asks about SIM cards Monaco Telecom.
Dr Azzopardi takes over the questioning about report XYZ 10. He asks about the devices listed in page 4 from the cabin cruiser GIO.
All the devices he worked on were presented to the court on 22 November 2019.
This device does not store information on it, but has a slot for a micro SD card. There was no SD card.
The second report relates the devices seized from his residence. The data was only extracted from one device – a WIFI camera, Torres explains.
– Two micro SIM cards were partially acquired because they were protected by a PIN code.
– Six SIM cards were fully acquired.
– 13 were not acquired because six of them were brand new SIM cards and seven were just in the pack without a SIM card.
All these exhibits in the second report are either SIM cards or SIM card bags, Torres explains.
21 devices were seized from cabin cruiser Gio.
The 17 DVDs seized by the police were empty – they contained no information.
It was in a system restored status and did no contain any personal information. No extraction was made of this device.
The smartphone was an iPhone.
Torres goes through the report. Fenech is having a word with Mercieca and Caruana Curran.
A computer, 3 USB devices, 1 smart phone, an envelope containing 17 DVDs, 1 BT device used to connect a keyboard or mouse which was wrongfully described as a USB by an investigator
The exhibits from which data was extracted by Torres are:
The exhibits were delivered by the Maltese police to one of his colleagues.
They used various tools to extract the data.
He was in Malta until 23 November. They were assigned a room at the Malta security services facility and they were the ones to have access to the room, Torres explains.
He was appointed as court expert in the case in 2019. His task was to support the Maltese authorities in the extraction of the data from Fenech's devices.
Torres works at the Europol forensic lab since 2017.
While Fenech is out of the courtroom, Torres takes the stand.
Fenech would like to be excused, Dr Mercieca informs the court.
"Among the devices found are tablet, hard drive and phones,… WIFI air freshener camera. Is it a spy camera?"
"It is a WIFI camera which contained no memory card inside it at the time of the examination," the expert says.
Dr Azzopardi takes over the questioning over XYZ report about devices found in a residence.
Data on the SIM card was extracted separately from the phone. They were always detached. The data was then analysed accordingly, Totaro explains.
The iPhones are being returned in sealed bags to the court.
The SIM card was always detached from the phones. The devices were kept at Europol. He then carried out extractions from the phones.
Arnaud asks where are the seven devices. Totaro says that there 2 iPhones and 2 SIM card which are still with him.
Arnaud asks for the delivery paper documents with regards to the exhibits.
Sources says that one of the devices in this report is a Wi-Fi air freshener camera. (A camera disguised as an air freshener).
The experts merely extracted the data. They did not see it.
The witness received five evidence bags.
Totaro goes through the contents of the report.
This report refers to the exhibit seized from Fenech's residence in Portomaso. This report is 17 pages long.
The witness will testify on the second report.
The extractions can be found in the extractions folder in the hard disk which were presented earlier following the paths indicated in the report.
There are recommendations on page number 8, Totaro says.
Arnaud asks for the IMEI number of the two iPhones.
The report details the specific extraction performed on each device.
A total of seven exhibits from Gio were seized.
Fenech bends over the dock to speak to Dr Merceica who is seated in front of him.
The exhibits have been analysed by the Maltese security services in Valletta, Totaro tells the court.
The report is structured as follows: the table of contents, the background of the case, details about the evidence bags, etc.
Totaro starts to go through the report, page by page.
There are four exhibits – two iPhones and two sim cards.
The other senior Europol officer was on site when the devices were seized.
The devices were seized from Gio. Totaro received the devices from his colleague at Europol. Totaro arrived on 20 November 2019, and received the devices the next day.
One of the reports is made up of ten pages. The exhibits were recovered from the cabin cruiser Gio.
The witness has two reports.
Totaro is a specialist forensic examiner in the digital forensics lab at Europol.
Giuseppe Totaro takes the stand.
Lawyer Mercieca says that the defence wants to cross examine the three experts together first and so will cross examine Petrou individually later.
Will you be cross-examining the witness? Magistrate Montebello asks.
Dr Mercieca stands up. He says that what they would like to do, that first they cross-examine each expert individually and then cross-examine them jointly. He sits down.
Petrou says that the terminology was assigned in the lab by the experts.
Dr Azzopardi asks about a path on page 5 and who assigned the nomenclature.
There is a micro SD card and a chrome cast which is usually connected to a screen to play YouTube, Netflix etc.
There was a SSD drive among the exhibits.
Petrou: My job is to extract data. I'm not going through the data.
Dr Azzopardi: for example there is one laptop. Can you tell us in brief what was extracted from it?
Petrou: 580 something giga bytes of data
Dr Azzopardi: Can you walk us through the list?
Europol Expert: There are many things going on at Europol. The name was assigned by AP weapons and explosives group for a name common to us.
Dr Azzopardi: On the first page there is "Operation Blue Elephant". Where did the nomenclature arises?
Dr Azzopardi takes over the questioning.
Petrou joined Europol since 2014 and nowadays he is a senior specialist forensic examiner.
The physical devices were left in Malta while the digital copies were analysed abroad, Petrou explains.
They carried out their work from the police premises. A room was allocated to the team and they were the only ones to have the key to the room, Petrou replies to Arnaud.
Petrou arrived in Malta on 20 November 2019 and left on 23 November 2019.
He confirms his signature on the report.
The videos extracted from the DVR can be played using VLC.
Fenech was also skimming through the report.
On page 7 there are some recommendations for the reader of the reports. Forensic images have been included in the report.
For the portable case, those accessing the data would only need to double click on the extension.
There was also a DVR (a video) in the images.
Thee images can be accessed through a free software called FTK imager.
AXIOM was used in the extractions, among other software.
In section 6 of the report deals with the extractions made by Petrou. He explains that the exhibit was not used over and over since this could cause some failure, instead they copied the data.
The exhibits include a laptop. He explains the method used for the nomenclature.
Both courtroom backdoors have been closed off.
Under acquisition, the report details out when the data was acquired and it also details what has been found in the hard drive.
The witness explains the methodology used to extract the data.
The court is currently dealing with paperwork.
The balcony door is open and conversations may be overheard. Everyone looks up as a guard leaves the courtroom to close it off.
Petrou holds a document which is in Maltese.
Arnaud asks if the first document shows that the exhibits were delivered to him. Petrou confirms.
He also exhibits the submission forms which had been presented with the exhibits.
He received four exhibits and they were handed to him when he arrived in Malta.
Petrou says he examined the exhibits that were seized on 21 November 2019. All devices are from Portomaso – from the chairman's office and the office of the secretary.
"The court is not expected to step down from here and make a copy. Do you understand? As you can see the court is not well equipped in these circumstances." Magistrate Montebello hits back.
Dr Mercieca: Can we have a copy?
Arnaud asks Petrou to explain his report.
The two other experts are asked to wait outside.
They court says the questions will be heard after the examination in chief is finished.
The court wants the witnesses to testify together but Arnaud says that the experts examined different devices.
Each expert was in charge of examining different devices.
Arnaud is explains that the drive contains just the data, but the extraction would be explained through his examination in chief.
Petrou is called back on the stand.
Dr Mercieca wants to cross-examine but Arnaud says that the examination in chief is not finished yet.
The other two experts swear to the court that they performed the extraction to the best of their abilities.
"No doubt," replies the magistrate.
Dr Mercieca stands up and asks for a copy.
This report was prepared by the witness.
Each expert has prepared a report based on the exhibits they examined.
Petrou explains how the extraction was done and says that report contains the relevant information.
"We'll see about that," says Magistrate Montebello.
Arnaud says that the prosecution will ask the court to appoint an expert to make a copy for the parties and one hard drive will not be touched.
Dr Mercieca asks if there is a copy for the defence. Arnaud says no and will explain why shortly.
The witness gives two hard drives to the court.
Petrou explains that a folder called exhibits contains images of the exhibits. Another folder called extractions contains the data.
The extractions were carried out by the three Europol experts present in the courtroom.
The two hard drives contain identical copies for the proceedings before this court. A third hard drive will be presented during the public inquiry.
"All extractions have been stored." They have two hard drives containing all the data extracted from the devices mentioned in their report.
"I received the devices it was assigned to us a room where we could work in it. During the days we performed the extraction here in Malta, we were the only ones with the keys to the room," Petrou explains.
He looked at devices seized Level 21 at Portomaso including devices seized from the secretary's office.
He is a visual specialist forensic examiner.
Petrou tells the court that he was appointed as a forensic examiner to support the Maltese authorities on the exhibits that had been seized from Yorgen Fenech.
Petrou will testify on behalf of the Europol experts.
The three Europol experts are testifying together.
They're asked to take the oath. All three swear on the bible.
The next witness to be administered the oath is Israel Gordillo Torres, from Spain followed by Giuseppe Totaro from Italy.
The first witness takes the stand, Konstantinos Petrou (Greece), he's writing down the names of his parents and his name to avoid having to dictate it to the court.
Three Europol experts enter into the courtroom.
Dr Mercieca asks for a clarification if the report is about the hard drive.
Arnaud explains that the two experts will testify together to explain how the extraction was done and they will also represent a report.
Arnaud tells the court Europol experts will testify today.
Court messenger brings in the acts of the case in a large suitcase.
Dr Mercieca paces back and forth.
The atmosphere is quite tense as we wait for the magistrate.
Police Superintendent Keith Arnaud and Police Inspector Kurt Zahra have just entered into the courtroom.
Fenech who is in the dock, is back having a word with his lawyer Dr Caruana Curran, while the CCF guards seated outside the dock look on.
The courtroom is silent as we wait for Magistrate Rachel Montebello to emerge from her chambers.
Prison director Alexander Dalli is also around.
The hall which is being used today, is pretty big and usually used for trials.
Yorgen Fenech is now speaking to Dr Camilleri and Dr Caruana Curran, while Dr Mercieca has left the courtroom.
Deputy AG Philip Galea Farrugia walks into the courtroom and joins Dr Azzopardi on the prosecution bench.
While Dr Camilleri is at her laptop in the defence bench, Fenech has a quiet word with Dr Mercieca and Dr Caruana Curran. Dr Mercieca is showing his client some documents.
Yorgen Fenech wearing a grey mask is escorted into Hall 22 by three prison guards. On his way in, he greeted his relatives. He takes his seat in the dock.
Parte civile lawyer Dr Jason Azzopardi has just entered the courtroom, as well as the relatives of slain journalist Daphne Caruana Galizia.
In the courtroom there are the relatives of the murder suspect, his lawyers: Dr Marion Camilleri, Dr Gianluca Caruana Curran and Dr Charles Mercieca, as well as prison guards.
In the meantime, the press has made its way to hall 22.
Murder suspect Yorgen Fenech has just been led into the courtroom flanked by three CCF officers. They're seated on the back bench while Magistrate Montebello hears other proceedings.
Good afternoon and welcome to this live blog. We're live from Hall 9.
During the last sitting, Police Superintendent Keith Arnaud testified behind closed doors. Despite a superior court rejecting a request for an interim measures and stop Arnaud from testifying on the contents of the meetings Fenech held in relation to his request for presidential pardon, Arnaud was allowed to testify on Thursday.
However, the Court presided over by Magistrate Rachel Montebello, was of the understanding, that since the information was given in a confidential manner by the accused in a bid to secure presidential pardon and due to pending constitutional proceedings, at this stage testifying in open court might harm Fenech’s rights.
On Monday, Europol experts are expected to present e-mails, phone messages, images and other documents seized from Fenech’s electronic devices.
A number of investigations have been triggered by the Financial Crimes Investigation Department as a result of messages found on Fenech’s phone.
While testifying during separate proceedings before the board of inquiry, Police Superintendent Keith Arnaud had said that the reason why Europol had not testified yet, is due to the fact that there was a large amount of data to be analyzed.
Police Inspector Kurt Zahra had also confirmed the existence of a WhatsApp group chat involving disgraced former prime minister Joseph Muscat, Schembri and Fenech in his testimony during the compilation of evidence against Fenech in September.
Former Opposition Leader, Adrian Delia, was forced into a leadership contest which he lost after it emerged that he continued to communicate with Fenech even after it was revealed that the latter was the owner of the Dubai-based company 17 Black.
Justice Minister Edward Zammit Lewis and parliamentary secretary Rosianne Cutajar are also understood to have communicated with the murder suspect in 2019 via WhatsApp.
Police Superintendent Keith Arnaud and Police Inspector Kurt Zahra are leading the prosecution.
Deputy Attorney General Philip Galea Farrugia is appearing on behalf of the AG’s office.
Lawyers Jason Azzopardi and Therese Comodini Cachia are appearing on behalf of the family.
Lawyers Marion Camilleri, Gianluca Caruana Curran and Charles Mercieca are appearing for the accused.
Magistrate Rachel Montebello is presiding over the court.