DAY FORTY-SEVEN: Trial Against David Castillo

/

Last update: June 25 at 1:40 pm

Main Points of the Day

  • Through a translator, the defense’s expert witness Shaun Vodde gives a brief presentation about the data found on cell phones in possession of David Castillo, Berta Cáceres, Sergio Rodriguez, and Douglas Bustillo. The two phones belonging to Castillo were either deleted or had a passcode and no data was extracted. The defense questioned Vodde focusing on messages between Berta Cáceres and her contacts that reference security risks. Some make reference to the energy company Blue Energy and a message that talks about “if they lend the piece of land” … “for a bird to land” (“Si prestan el terreno” … “para aterrizar un pájaro”) which the defense has used, in the Honduran media, to try and link COPINH and Berta to drug trafficking.

  • The trial will continue tomorrow with questions to expert Vodde from the Cáceres family’s attorneys.

More Details

Defense’s Data Extraction Expert, Shaun Vodde

Shaun Vodde is a US citizen, senior Vice President of Forensic Technology. He’s also a digital forensics and e-discovery consultant.

PRESENTATION

  • Timeline: June 28, 2018, entered as experts on the case

    • July 24, 2018: Performed an extraction on Castillo’s two mobile devices

    • August 13, 2018: There were court proceedings and the scope of analysis was expanded to include Douglas Bustillo, Sergio Rodriguez and Berta Cáceres’s phones

    • August 30, 2018: Extractions were performed on Bustillo, Rodriguez, and Cáceres’s phones.

    • November 5, 2018: Went to Tegucigalpa to submit his declaration

  • Extractions from David Castillo’s phones: July 24, 2018

    • Iphone 7: Locked and no PIN. Only basic information could be retrieved because no PIN was provided

    • Iphone X: In status of factory reset (attached to a US number). They (Vodde and his partner) observed the expert from the prosecutor’s office doing some sort of update on the phone.

  • Extractions: August 30, 2018

    • Berta Cáceres - 5 devices (Blu T901 (phone); Samsung SM-T110 (tablet); Samsung SM-T231 (tablet); Sony Ericsson D5503 (phone); Sony Ericsson Xperia (phone)

    • Douglas Bustillo - Huawei Ascend and LG D508

    • Sergio Rodriguez - Samsung Galaxy S6

  • On Berta Cáceres’s devices:

    • Blue T901: There were 299 contacts, 1 audio file deleted, 7 text messages (1 deleted)

    • Samsung SM-T110 (tablet): 808 contacts (14 deleted); 83 emails; 3 notes; 127 web history (36 deleted)

    • Samsung SM T-231 (tablet): 7 Calendar; 73 call log (2 deleted); 15 Facebook messenger; 659 contacts (168 deleted); 262 emails (11 deleted); 1 MMS Messages (1 deleted); 190 sms messages (51 deleted); 91 web history (1 deleted)

    • Sony Ericsson

    • Sony Ericsson (Locked: No access to PIN) - they attempted to open it using three passcodes.

  • Douglas Bustillo’s phones

    • Huawei Ascend phone: 1 calendar; 115 call log (3 deleted); 49 Facebook (49 deleted); 98 Facebook messenger (4 deleted); 1 instagram; 6 snap chat (4 deleted); 24 Skype; 1 Twitter (1 deleted); contacts, emails, etc.

    • LG D805: Call log, Facebook, kik messenger; Whatsapp, twitter, contacts, emails, MMS, SMS, web history.

  • Sergio Rodriguez’s phone:

    • Samsung Galaxy: Calender, call log, google +, skype, tango, Twitter, Viber, Whatsapp, Contacts; Emails; MMS; Notes; SMS Messages; web history

  • Data sources for the extraction

    • David Castillo: Both of his phones were erased or blocked

    • Berta Cáceres: One was blocked/erased; two were used for the data extraction; two didn’t have much information

    • Douglas Bustillo: Both had little information and no chat messages.

THE DEFENSE QUESTIONS THE EXPERT (the most important parts)

  • Q: Who was present when you did the extraction? A: We did the extraction in front of the prosecutors and Cáceres family lawyers

  • Q: You said that one of the devices was actively updated, since when and how long had it been updating for? A: I don’t know the length of time it was updating and the fact that it was being updated, was explained through translation. The phone itself rebooted.

  • Q: How could the wifi connection be made with the phone? A: I don’t have insight into that. There would have had to be a wifi network in range and the phone attached to it.

  • Q: What was the activity of Berta Cáceres’s phone after March 3, 2016? A: There was a lot of activity, it was active until March 30 and there are several incidents of incoming texts and calls and one instance of an out-going call.

  • Q: What is the date of the outgoing call? A: March 4, 2016

  • Q: On pg. 15516 of the Spanish report, what is the difference between a thumbnail and a photograph? A: the picture is the original file that was sent. When it is put onto the local phone, the operating system will create a much smaller, lower resolution file so that it can be easily located. If you click on it, it will take you to the original file.

  • Q: Can you read the conversation from March 26, 2015? [the secretary reads it. The conversation is between Berta Cáceres and someone named “Tomas Zica”] The conversation makes reference to recent threats and Tomas asks Berta if they are related to Rio Blanco and asks her what she’s going to do. Berta responds: “It’s Blue Energy, on the Cangrel river”

  • Q: Can you read messages from March 27, 2015 on Pg. 5682? [secretary reads it] The conversation has to do with a conversation between a teacher in Agua Caliente and Berta. They reference Blue Energy and something about a road blockade.

  • Q: Can you read two other conversations dated February 5, 2015 and February 23, 2015. [The secretary reads them]. The first on February 23 has to do with whether Berta had heard from a man (without mentioning names) and some sort of incident involving Blue Energy. The second conversation on February 5, 2015 is Berta asking for a summary of the incidents related to Blue Energy

  • Q: Can you read the conversation from June 3, 2015 between Berta and Jerónimo (very very rough translation. Hard to understand without context)

    • 20:58 from Jerónimo: I already did it. Tell me what you think

    • 20:58 from Berta: They are lending (or borrowing)? That is what they say

    • 20:59 from Jerónimo: If [or yes] to borrow/lend the land. To let a bird land

    • 20:59 from Berta: if it doesn’t have an impact. In the process

    • 20:59 from Jerónimo: They won’t know

    • 21:00 from Jerónimo: It could have. One can’t know

    • From Berta: There must be another thing

    • 21:00 from Jerónimo: What thing?

    • From Berta: I don’t know. Alliances. What is behind that. More behind.

    • 21:02 from Jerónimo: Direct contact. An entrance, an exit

    • 21:02 from Berta: One time no more

    • 21:03 from Jerónimo: Yes

    • 21:07 from Berta: No media is friendly

    • 21:07 from Jerónimo: It’s up to me to make the decision

    • 21:07 from Jerónimo: What do you advise?

PROSECUTIONS QUESTIONS

  • Q: Why do you say that the Iphone 7 belongs to David Castillo? A: That was reported to us. It was reported to us as Castillo’s phone and although this is weak evidence, the phone is called “David’s phone”

  • Q: What information did you obtain to relate one of the phones to Sergio Rodriguez? A: It was reported to have belonged to him and there was information that also names him inside the report itself.

  • Q: The watermark stamp of your company that is on all pages of the report, how does it affect the ability to read the document? A: It’s a translucent water mark but it may sometimes obstruct the text. But the text can be selected and copied from the document.