2011050110

Google Maps Played Prominent Role In Cooper Murder Trial

By Bryan LeClaire, The Raleigh Telegram

Saturday, May 14, 2011

RALEIGH - Images from Google Maps played a key role in the recent trial of Brad Cooper, who was accused of murdering his wife Nancy in July of 2008. Brad Cooper was convicted of first degree murder at the end of the trial.

His defense attorneys have cried foul after the trial’s conclusion, saying that the chain of custody for Cooper’s laptop was not handled correctly after it was seized by police as evidence and that some of the evidence was tainted.

Although he chooses not to use the word “framed,” one of Brad Cooper’s attorneys claims that someone altered the contents of his client’s laptop to produce damning evidence against his client.

Attorney Howard Kurtz alleges that the tampering occurred while the computer was in police custody.

The case against Cooper, whom Cary Police arrested in October 2008 as a suspect in his wife’s murder, rested mostly on circumstantial evidence.

The lone piece of hard evidence presented during the eight weeks of testimony was a Google Maps search on Cooper’s computer for the exact location where his wife’s body was found. That cul de sac where her body was found was only three miles from the Coopers’ residence.

According to police testimony during the trial, Cooper’s laptop showed that someone performed a Google Maps search for the Holly Springs Road and Fielding Drive area in Cary.

Chris Chappell, a Durham Police Department detective who is currently to the FBI's Cyber Task Force, testified during the trial about the Google Maps files found on Cooper’s laptop.

Chappell told the jurors that the aerial photos were accessed via Google only one day before Nancy Cooper’s body was found near the searched site in a drainage ditch.

However, Kurtz says that there are discrepancies in timestamps on those files found on Cooper’s laptop. Computers generate timestamps whenever files are created, accessed or modified.

“For every single timestamp on 507 files, all show an invalid timestamp,” claims Kurtz. “One hundred percent of the map files have an invalid timestamp, less than 2 percent of the files on the computer.

“Eighty-seven percent of all files created, accessed and modified [from] 10-12 July 2008 also show invalid timestamps,” he added. “Zero were invalid prior to June 22.”

The nature of the timestamps suggests that someone after that period had tried to backdate the timestamps, says Kurtz.

Cary Police took possession of Cooper’s laptop on July 15, 2008.

According to Kurtz, the cursor file on the Google Maps search was unusual.

“Cursor files are created the moment you go to Google Maps and are modified as you navigate from point to point,” he said. “When you stop using it, that’s reflected in the date-modified and the time-last-used timestamp.

“There’s no way possible to have the same first-time-created and last-accessed timestamp down to the microsecond. That’s the difference between artifact and artwork. That’s artwork.”

Kurtz also questions the chain of custody and preservation of evidence practices in the case.

Cooper’s laptop, he says, was for weeks not held in an evidence locker but in a computer lab with no video cameras or special safeguards.

Kurtz points out that the computer was not hashed - a process in which a snapshot is taken of a hard drive - until August.

According to Kurtz, hashing should be done immediately upon entering a computer into evidence to ensure an accurate look at the contents before police investigate.

“[A hard drive] is the easiest thing in the world to change, but the hardest to find out what was changed,” he said.

Two chain of custody forms presented at the trial also cast doubt on the Cary Police’s handling of the computer, says Kurtz.

One form indicated that Detective Josh Bonin received the computer from Detective Todd Thomas. Another form indicated that Bonin had received the computer from Detective Todd Thomas.

“That’s two different people on two different days,” said Kurtz.

In an interview on Friday, Cary Police Chief Pat Bazemore claimed that mistakes were made but defended her force against any wrongdoing.

Kurtz cautions that he is not accusing Cary Police of the tampering.

“The computer was left on for 27 hours on a WEP-protected network, essentially leaving it completely insecure,” he said. “It’s like allowing any member of the public to walk through a crime scene.”

None of the computer tampering evidence that Kurtz outlined was admitted during the trial because Superior Court Judge Paul Gessner ruled that the defense’s expert witness was not qualified to present computer evidence.

During the trial, Cooper himself was portrayed by the prosecution as a technical wizard himself. The prosecution alleged that Brad Cooper, who worked for a network hardware company in RTP, had created a fake phone call purportedly from his wife to his mobile phone to try and create an alibi.

However, some in the community have questioned how the prosecution can claim that Cooper would be so technically proficient as to create a fake phone call while at the same time claiming that he would seemingly forget to remove the Google Maps images from his computer.

The public defender’s office is working on Cooper’s appeal. Kurtz said he is not involved in work on Cooper’s appeal at this time.

:: END