Management Assistance Program on


Gathering Evidence – 21st Century Style
The Craigslist Killer Case and Boston Marathon Bombing Manhunt Demonstrate the Importance of Digital Clues

By Jim Calloway

Lawyers have always hired investigators and conducted investigations. But there are many more sources and types of evidence today — and there will be even more in the future.

At ABA TECHSHOW 2013, the attendees heard a great presentation titled, “On the Trail of the Craigslist Killer: A Case Study in Digital Forensics.” This presentation was given by Sharon D. Nelson, president of Sensei Enterprises Inc., (and my Digital Edge podcast teammate) and her husband, computer forensics expert John W. Simek, vice president of Sensei. It was a riveting tale of the fast-moving investigation in the aftermath of the April 14, 2009, murder of a young woman in a Boston hotel.

Less than two weeks after the ABA TECHSHOW, the world was watching as the hunt for the Boston Marathon bombing suspects took place. Many, many law enforcement officers were involved, as were digital forensics technicians from the FBI and other agencies. It is hard to imagine the amount of information reviewed by those investigators in a relatively short period of time.

Certainly, lawyers in private practice, and even most law enforcement investigations, cannot marshal the resources used in these two situations, not to mention at the speed with which these investigations occurred. Many of the techniques and tools seen in televisions shows like CSI are perhaps more dramatic than today’s reality. But there are still lessons in both of these two Boston homicide cases about evidence sources today that did not exist that long ago.

So let’s review these two investigations.


The Craigslist killer used Craigslist to schedule “appointments” with masseuses. The meetings were in hotel rooms and the room number was only given to the customer after the customer called from the hotel lobby. But something went wrong with the appointment on this day. Police were called when 26-year-old Julissa Brisman was found dead from gunshot wounds in the doorway of her room with a flexicuff plastic tie around one wrist. The shooter had left behind no apparent evidence.

Luckily the victim’s phone, which was found in the room had no lock code and police noticed a recent missed call. The call was from an associate who confirmed the 10 p.m. appointment with a person calling himself Andy M. She gave the police “Andy’s” phone number and email address. The number was for a “disposable” phone purchased locally that could not be associated with any individual and the email account was created shortly before the murder.

Hotel surveillance cameras had captured the image of a young man in a black leather jacket and a New York Yankees cap leaving the hotel right after the murder. At a nearby hotel two days earlier, a masseuse had been robbed at gunpoint and bound with plastic ties. Police believed the man in the videos at that scene showed the same suspect. Contact with her was also arranged through Craigslist.

Three days after Brisman’s murder, a woman who worked as an exotic dancer was attacked at a Holiday Inn Express in Warwick, R.I., by a man who had responded to an ad she had placed on Craigslist. He was also caught on video leaving the scene and appeared to be the same suspect.

While the hotel videos were helpful, digital evidence actually identified the suspect and provided better evidence. Investigators located the IP address used to set up one of the web-based email accounts used to contact the women who advertised on Craigslist.

It belonged to one Philip Markoff from Quincy, Mass., about 10 miles from Boston.

Once they had the name and location of a strong suspect, a search of Facebook located a page created by Markoff noting his engagement to Megan McAllister, about their upcoming wedding. They then staked out Philip’s apartment. In what seems like a scene written for a movie, they followed Markoff to a BJ’s Wholesale Club store and detectives followed him around and dusted for prints on cans he touched and the grocery cart he used since they had retrieved one good finger print from the first attack.

Only six days after the murder, police pulled over Megan and Philip and brought them in for questioning. His fiancé was aghast and said the accusation was impossible. Now that they had a good photo to show previous victims, the first victim identified Phillip as her attacker. With that evidence, a search of his apartment pursuant to a warrant revealed damning evidence, including a handgun hidden in a hollowed-out copy of “Gray’s Anatomy,” bullets, a disposable phone and a pair of shoes with Brisman’s blood on them. Markoff later committed suicide in custody while awaiting trial.


The horror of the Boston Marathon bombing instantly grabbed the nation’s attention. In addition to the massive amount of video from the various surveillance cameras in the area, members of the public who were present were asked to send the FBI photos and videos they had taken with their mobile devices.

The authorities ultimately made an appeal to the public by what must have been the most rapid sharing of “manhunt” photographs to the most people — ever. Countless photographs and hours of video had been reviewed to isolate two suspects.

Public spaces, particularly in urban areas, are now far more likely to be under digital video surveillance than any of us may have understood. There is also a greatly increased amount of video recording in places of business. We have all seen video from convenience stores robberies provided by law enforcement in an attempt to identify the perpetrators.

Many readers might be surprised at how many stores, hotels and downtown areas have video surveillance now. It is probable that if you spend an afternoon shopping in a local mall, someone with access to all of the recorded videos with their timestamps combined with the time and motivation to review everything could probably reconstruct your entire visit to the mall. The Boston Marathon investigation also illustrates just how far we have come from the days when the state of the art was FBI “Most Wanted” photos and descriptions posted in post offices. As we now know, many people recognized the brothers from the images released and contacted the FBI.

The final shootout between the Boston Marathon bombing suspects and the police in Watertown was well-covered by the media, as was the “shelter in place” order given to residents as the remaining brother was sought.

What received a little less media attention was that the brothers were tracked to Watertown electronically. The victim whose leased Mercedes SUV was carjacked by the brothers escaped, running from where the suspects stopped him to a Shell filling station in Cambridge. He then told authorities that the SUV could be tracked, both by his iPhone left in the vehicle and by “mbrace,” a Mercedes satellite tracking system.

We are all familiar with the rest of that story.

These are just two investigations that demonstrate the nature of evidence is changing. Lawyers involved in the criminal justice system increasingly know of this, but often digital evidence is important in civil cases and investigations.


Imagine a hypothetical case where a client had been charged with homicide based on a hit-and-run. Numerous witnesses saw him celebrating at his favorite bar. They tried to get him not to drive, but he insisted and stormed out of the bar. A witness who saw the car strike the pedestrian a few hours later gave police a description of the car and the tag number. When the police got to his home early that morning, there was damage to the front of the car, which was parked in the yard rather than the driveway. The most devastating evidence was a piece of torn material from the victim’s clothing in the car’s grill.

After the police pounded on his door for a while, he opened the door, smelling of alcohol and unsteady on his feet. His alibi was flimsy. He claimed he had gone to another bar, where he was mugged and his car stolen. He was unconscious for some time and when he woke up alone in the parking lot he walked home. He claimed to have no idea how his car ended up at his house. The only evidence even slightly supporting his story was a large knot on the back of his head.

Decades ago, even if the client convinced the lawyer that he did not commit the crime, it was pretty much a hopeless case. A jury would be extremely unlikely to believe the alibi. Even if he appeared very sincere and honest, evidence of his reputation as a hard drinker and his prior misdemeanor DUI conviction would discredit the story.

But today’s lawyer might find hope from the records of his mobile phone calls trying to find someone to come pick him up. Maybe a friend even received a drunken call asking for a ride and would testify when he received it. Maybe the lawyer would be able locate the records of which cell towers his phone “hit” on the drunken stroll home. But this defendant had used up his phone’s battery earlier in the night.

Luckily, this defendant walked home through one convenience store parking lot, went inside another one to use the rest room and stumbled into an ATM even though he did not use it. Cameras at all three locations recorded good, time-stamped images of him. The hard-nosed prosecutor did not yield, noting that the time of the videos was well after the hit-and-run. The state’s theory was now that defendant walked by the cameras after the hit-and-run to leave a false trail of evidence supporting his alibi. Defense counsel had a bad feeling now. He was certain the client was innocent and aware that the state had a very strong case.

The defendant knew he was facing a likely prison term. At a meeting at his home, he thanked his lawyer for uncovering the video evidence that would at least give him a fighting chance at trial. He remarked that he had no idea there were so many cameras recording people in public, but he wasn’t surprised as his neighbor across the street had installed a camera after a recent burglary. Suddenly everyone got quiet. They all jumped up to visit the neighbor.

The neighbor’s camera was set up to retain 10 days worth of video on a hard drive instead of the usual 24 hours. On that night, the defendant was shown stumbling into his house. Twenty minutes later someone else parked the car in his yard. The camera showed a clear image of his face, as well as the face of the driver who had picked him up after parking the car, along with the tag number of the car. The driver of the other vehicle confessed after less than an hour of questioning, he had been a passenger in the stolen car. After the accident, they had used the street address on the insurance verification form to frame the lawyer’s client.


Potential video evidence and other digital evidence will only increase in amount in the upcoming years. More communities are installing more video cameras in public areas as a crime prevention tool. We have seen controversies from “red light” video cameras that record video and cause tickets to be issued with no human intervention.

A meteor exploded over Russia in February 2013. There were several videos of the explosion available because apparently Russian drivers extensively use dashboard cameras in cars because of bad experiences with insurance companies refusing to pay claims without convincing evidence. Is it possible such civilian dashcams might become popular in the U.S.?

Another example is that smart phones that are used to take pictures and are GPS-enabled are most likely storing the exact location of every picture taken within the metadata associated with the picture. Parents whose children post pictures to Facebook or other social media may want to discuss that with their children and turn this feature off.

One of my co-workers leaves his house empty every day. Among the video security systems he has installed is a camera that instantly sends him a photograph of everyone who comes to his front door when he is away.

Almost all hotels have video surveillance. But if your client is certain her spouse met a paramour at a downtown Tulsa hotel on a certain day, will all of the downtown Tulsa hotels turn over the videos from the lobbies on that day in response to a subpoena or will they resist, citing the privacy of their customers? Or can a lawyer in a family law case obtain the cell phone tower records that might show someone’s travels on a certain day? Who now has the expertise and resources to review hours of digital video or cell phone tower records without compromising the evidentiary value? And what about the fact that many of these digital videos are recorded over and erased after 24 or 48 hours?

Prosecutors have complained about “the CSI effect,” shorthand for jurors in criminal prosecutions expecting to see the flashy investigative tools and techniques that appear on criminal investigation television series. But as more data is available, there are more potential ways to prove or disprove many allegations.

One picture may be worth a thousand words, but an exculpatory video might literally be worth a client’s freedom.

Mr. Calloway is director of the OBA Management Assistance Program. Need a quick answer to a tech problem or help resolving a management dilemma?Contact him at 405-416-7008, 800-522-8065 or It’s a free member benefit!

Originally published in the Oklahoma Bar Journal -- May 18, 2013 -- Vol. 84, No. 14