FULL TRANSCRIPT OF SY RAY'S TESTIMONY, 5-30-24
It's definitely worth a read!
UPDATED 3/13/25: Corrected spelling of the word “LocDBoR” in 2 locations.
Back in August I posted a portion of the transcript from Sy Ray's testimony, which occurred during the motion to compel hearing held on May 30th, 2024. At the time I made that post, I promised I would eventually finish transcribing Sy Ray's testimony, and then I would post the entire thing together in a new post… so here it is! It took me a little longer than I had originally planned, but better late than never!
So the video I used as a reference was posted by Julez with True Crime Reactions, and the timestamps given in this post correlate with her video.
Video begins with Sy Ray providing his law enforcement background and his extensive experience working with cell phone data.
ANNE TAYLOR: Do you usually work with the defense?
SY RAY: This is the first time l've ever testified for the defense.
ANNE TAYLOR: Fair to say you usually are a prosecution witness?
SY RAY: That is a very fair statement.
ANNE TAYLOR: Well here you are, and you're working with us in Mr. Kohberger’s case. What's your role in this case?
SY RAY: Trying to conduct an analysis of all of the geolocation data, at this point still focused primarily on Mr. Kohberger's device, but ultimately all devices, but any geolocation data, which is the ability to look at a specific area, whatever range or size that may be, at a specific time, and put some type of accuracy and reliability to a phone's travel; maybe it's stagnant, when it's moving, when it's not moving, when it's off, it's on, those type of things. But specifically as it relates to network, so the cellular network or a wifi network… I am not a forensics digital guy, I don’t get into cell extractions, I’m not looking at the metadata on the phone, I'm looking at it very much as a network.
ANNE TAYLOR: If I can make a rough distinction, you're not the person that's going to tell me who they called and which Facebook groups they might be a part of, you're not going to look at the data from the phone like photographs, but you're going to tell me the places this phone went and how it was used while it went somewhere?
SY RAY: Kind of. Uh, let me clean that up a little bit… I will look first at where I believe the phone went: where it traveled, how it got there, how long it took, possible routes, and then to your point, I call it “corroborative data”; l'm then going to seek out all that data you just talked about, to say “okay well we have these three photographs, we have this piece of surveillance video, we have these four receipts, l'm going to overlay it with my analysis so that I can corroborate if the analysis is accurate”. Or maybe we see activity associated with that person, and the phone's not there. Does that person just not have the phone? Or is part of our analysis wrong? Maybe it’s [the details?] that are wrong? So eventually I will get back to that data you're talking about, but I'm not the guy who's going to go out and extract that.
ANNE TAYLOR: Would it be fair to say that that's data that you would use in a final analysis as it comes in from other sources, but you're the go-to for me to understand how a phone works with the tower, and how it moves between towers if the phone’s in motion somewhere?
SY RAY: Yes, 100%.
ANNE TAYLOR: You talked a little bit about, um, drive test data, or drive testing, and that being part of the company that you developed and part of the work that you've done… is that helpful in understanding the ultimate picture?
SY RAY: Depending on the type of records we're dealing with, it can be very helpful. When we're looking at just basic call detail records (CDR’s), a lot of times we're just getting connections to a particular cell site, and we can say a side of that cell site, sometimes the frequencies that are used… drive testing is really the only way to get a little bit more specific with where that phone may be, but more importantly, we can start to rule out areas we know it's not [located] by drive testing. So just think of drive testing as a forensic evaluation of the actual cellular network in a particular area.
ANNE TAYLOR: Fair enough. Are you familiar with AT&T records?
SY RAY: I am intimately familiar with AT&T records.
ANNE TAYLOR: How long do you think you've been working with AT&T records?
SY RAY: 28 years?
ANNE TAYLOR: In our case that we’re here on today, have you reviewed any AT&T records that relate to Mr. Kohberger?
SY RAY: I have.
ANNE TAYLOR: What have you reviewed?
SY RAY: What AT&T refers to as their regular CDR’s, which is a Report AU, as in Adam-Unit, I have identified that the Report CT, as in Charles-Tom, which is the subscriber information, there is a really weird name called LocDBoR (pronounced “low-cah-bar”) which is AT&T's attempt to estimate general locations using latitude and longitude… I don't want to say GPS, because it is different than GPS. I believe I've looked at some ping data from December. For the most part, that's what l've reviewed so far.
ANNE TAYLOR: Have you looked at two separate AT&T warrant returns from December 23rd, 2022?
SY RAY: l have.
ANNE TAYLOR: In your experience with working with AT&T records, is it common or uncommon to have two warrants, one that relies on the content of the first and it’s the same day?
SY RAY: It's not uncommon to see a small time period that produces results that would increase the desire, or the need, for a bigger time period of records. Seeing that entire process happen twice in the same day is extremely rare.
ANNE TAYLOR: The first AT&T record, we called it today “the 48 hour AT&T record”, of Bryan’s call detail record, if you were to take that and do an analysis on the call detail record, how long would that take?
SY RAY: Depends on the analysis… I will qualify that answer with, looking at what was put into the second warrant that shows us at least parts of that analysis to include a route that was identified, to do it reliably and feel comfortable that I'm accurate… at least 3 hours? And that's if you know what you're doing, and you have all the tools at your disposal. Um, arguably you could spend half a day or more doing that very easily.
ANNE TAYLOR: To do that, do you just take these records, print a copy, and know what's on there? Or do you have to do something with those records?
SY RAY: You'd have to use some type of a mapping platform, software, and you would take the digital copy, which is typically a text file, you would import it into that program, which would then map everything. But if I'm going to use those results in a search warrant affidavit for example, there's a process that I'm going to go through to confirm the accuracy because in theory, if I'm wrong, the entire lynch pin of that case is now hinged on this affidavit that I wrote, so before I commit to swearing out to an affidavit, “hey, this is what the phone is doing, X, Y, and Z”, there's a further process of just mapping it to validate it. In this case, there's a lot of time distance measurements that need to be performed that can be extremely time consuming. There's some alterior [I assume he means ulterior or additional?] issues that come up with how that phone is interacting with other cell sites that needs to be analyzed… um, again, saying that, a very qualified competent investigator spending half a day just coming up with that basic summary is very reasonable.
ANNE TAYLOR: And in that half a day you would put that record into a computer program and a map would be produced?
SY RAY: Correct.
ANNE TAYLOR: What other information besides that call detail record would you need to do this analysis?
SY RAY: In this case I would want the call detail records, I would want the LocDBoR, it’s L-O-C-D-B-O-R, and I would want the regional cell tower list from AT&T.
ANNE TAYLOR: Does AT&T generally provide that regional cell tower list inside of its record that it produces, pursuant to the search warrant?
SY RAY: No, I would actually say by policy they do not. It's a very large file, it typically does not transmit very well to government email, so they would direct users of where they could go online to download it.
ANNE TAYLOR: And have you looked at this record, the 48 hour AT&T search warrant record, the return on that?
SY RAY: I have.
ANNE TAYLOR: Did that include the regional cell tower list?
SY RAY: It did not.
ANNE TAYLOR: Okay… so if you are doing this analysis you put CDR records into a computer program, you put a regional tower list into the computer program, what does it produce?
SY RAY: The CDR’s would show me cell sites that the phone connected to uh, in this case. Even within the 48 hours there's hundreds of those cell sites, so it would take a while to really look at that. The original cell site list which would show me the cell towers that the phone's not interacting with, which can be just as important.
ANNE TAYLOR: Does it spit out product to you, or does it create something that you can reference to write your next warrant?
SY RAY: Depending on which mapping platform you're using, they all create some type of a map that the person doing the analysis on can interact with, and they can change things, they can save things, they can create work product depending on that platform that saved the different types of maps, but yes, all of them would have some type of a mapping platform.
ANNE TAYLOR: Okay would that be consistent with this CAST draft that we heard about earlier?
SY RAY: It's my opinion that Corp. Payne is probably misusing some terms there… um, I don't see any possibility of the FBI CAST team producing a CAST draft report on the 23rd. I think he's probably mistaken that he saw some type of CAST work product, which would be this map, uh before they export all those results into a report. So I believe that he probably saw some mapping through a mapping platform… it would really surprise me if there was a physical report, it would be completely out of character.
ANNE TAYLOR: In that first AT&T report, did you (the request search warrant affidavit), did you see the request for advanced timing reports?
SY RAY: I did, it's in both search warrants.
ANNE TAYLOR: Did you get a copy of that in either return?
SY RAY: I have not seen any timing data in this case.
ANNE TAYLOR: In December of 2022, did AT&T have this advanced timing report?
SY RAY: They absolutely did.
ANNE TAYLOR: Was it something that they could produce?
SY RAY: It absolutely was.
ANNE TAYLOR: Alright. But in May of 2023 - but how's it [different to prior to??] May of 2023?
SY RAY: Prior to May of 2023, only certain agencies were receiving this timing report, the FBI being one of them. What was referenced earlier about the May 23rd date, that is when AT&T started offering the same type of reports… it's a little different, but it's the basic timing report… to the state and local law enforcement as well. But prior to that date, state and local law enforcement would have to leverage these reports through federal agencies that had access to them.
24:42
ANNE TAYLOR: Let's talk about the second, the return on the second AT&T warrant… did that have the tower list, the regional tower list in it?
SY RAY: It did not.
ANNE TAYLOR: Did it have call detail records?
SY RAY: It did.
ANNE TAYLOR: What time span?
SY RAY: I believe it's from June 23rd of 2022, the historical was as of the date of December 23rd, but there was also a Real Time Pen Register that was added that extended, I want to say, to the end of December, maybe the very first of January.
ANNE TAYLOR: What's a Real Time Pen Register?
SY RAY: So the second search warrant asked for a couple of different things: historical records going back to June 23rd to the current date, which was December 23rd. The second piece that was asked for is Real Time Data from the network, which is commonly referred to as a Pen Register Trap and Trace, and it's the ability of law enforcement to monitor network connections in Real Time, so as that phone connects to the network for certain reasons, I can actually I can see those connections. It's not a wiretap, I can't hear anything, I can't see content, but I can tell the phone is connected to a particular cell tower. There's also what's referred to as “ping data”, and that's going to be AT&T's estimation of where the phone is at, and that's provided by latitude and longitude and that comes in every 15 minutes.
ANNE TAYLOR: What is the purpose of one of those devices?
SY RAY: I should probably clarify, the third thing was the authorization for a Cell Site Simulator, so it was the combination of all these… um, just as a matter of policy, and I think pretty much every law enforcement agency in the world has adopted this if they can, to use the Cell Site Simulator you want to see a real time feed of the phone, otherwise you're driving in circles where the phone may not be. So it gives law enforcement the ability to have a general understanding of where a phone is operating or functioning, and then I can use the Cell Site Simulator to do it. There's a number of reasons an agency might do this, uh, this search warrant actually says they were requesting because they were trying to locate where Mr. Kohberger was.
ANNE TAYLOR: Going to the understanding what's happening right now, is that used so that you don't just know where the phone was five minutes ago, but you know where it is right now?
SY RAY: Within a time period. It's not a perfect system, there is a little bit of a delay and the information comes in intermittently, so it's not a real time feed of giving constant evaluation where that phone is, but if you know what you're looking at and you've done it long enough, you get a pretty good idea.
ANNE TAYLOR: I heard you say that this is to try to find out where Mr. Kohberger is in the information that supported this warrant… didn't they already know where Mr. Kohberger was?
SY RAY: I reviewed a lot of documents that clearly state not only did they know where he was, they had a surveillance team with eyes on him… um, so yes, it would be unusual for an agency to request this type of equipment - and I need to qualify that this truck driving around is about a million dollars, it's not something you just park in the garage at night. It's a very expensive resource, it's a very technical resource, that requires a lot of training and skill to use properly, so typically when it's used it is used for, “hey, we don't know where this person is at, and we need to find them”. And to be very honest, I don't have an issue with that part. I've used it, it's a good tool, it's a great tool, however, if I know where a subject is and I'm physically watching him, it's probably disingenuous for me to get a search warrant justifying it that I need to find him.
ANNE TAYLOR: Thank you… I want to switch gears and talk about the CAST VIZ program.
SY RAY: Okay.
(29:00)
ANNE TAYLOR: Are you familiar with the CAST VIZ program?
SY RAY: I am.
ANNE TAYLOR: How-why?
SY RAY: I've worked with a lot of agencies that have used it and accessed it, so I've worked on cases where we've used different mapping platforms to do kind of a compare and contrast as a peer review… so they would create a work product, we would create a work product, and then we would check each other's work… because at the end of the day, we're just looking for the accuracy, we want to see if there's any errors in that. I would say I probably have worked with the CAST VIZ reports, several dozen times, maybe, maybe it's 50? Um I'm common- or, I'm aware of some of the updates they've made. Like I mentioned earlier, I'm aware that they have added a feature that you can now input tower density, so you can create these estimated ranges, if you will… um, and I'm-I'm very familiar with the basic settings that have certain controls you can do, like time zone, what time zone [???], am I going to use the coverage density, am I going to save my work, am I going to just exit the program, I physically have seen those features a number of times.
ANNE TAYLOR: As it relates to this particular case, have you had a chance to look at any exhibits prepared by Detective Mowery using the CAST VIZ program?
SY RAY: Yes, but I should clarify… one of them I'm pretty familiar with, uh I believe it's State Exhibit 48 that was used for the grand jury… the others I had never seen, until I believe it was last week…. um, so I'm probably going have to look at those if you're going to ask any questions on those. But State's 48 I'm pretty familiar with.
ANNE TAYLOR: I want to ask you a question about that… I'll ask you some other questions about the records we received last week… and I'm going to have you handed what was admitted last week as “State’s R” [Response, I assume? I tried to find this specific document in the court docket, but I couldn't find anything that wasn't under seal 🙄] just another, my copy of it, so that we know what we're talking about here.
SY RAY: Okay.
ANNE TAYLOR: I'm curious about what was needed to go into CAST VIZ to create that?
SY RAY: So when I open the CAST VIZ program, I have to input what I'm going to refer to as source data - so let me define source data: is any data that is an electronic format, typically a text file, that the CAST VIZ program is going to link to this mapping session, and use that source data to create the images we're seeing. I can tell you right off the bat, without a doubt, this one is linked to two different sources data's, one is going to be a set of CDR records, so the regular AT&T CDR's, and then this particular exhibit would require the regional AT&T tower list, which is a text file that contains all of the cell site locations, most likely the western Washington, Idaho, and Eastern- I'm sorry, eastern Washington, Idaho, and western Montana is typically that region, but there's no way this map was created without the AT&T tower list, it's physically impossible.
ANNE TAYLOR: Is the AT&T tower list, was that contained in the call detail records that were obtained by search warrants relating to Mr. Kohberger?
SY RAY: It was not.
ANNE TAYLOR: all right… and in the CAST VIZ program, when you input the CDR’s (call detail records), and you input the tower list, does that program create any type of log?
SY RAY: It does… and I want to make the record really clear on what I'm testifying to, because it can get kind of confusing when we start talking about different versions… the CAST VIZ program offers two styles of mapping. I can just default to a normal size, what they're going to refer to as a wedge shape, which is representing the sector the device connected to. If I was doing that, all I need is the AT&T records, because the AT&T CDR's actually have the tower information that's required for that. As soon as I change that feature though to add coverage areas, the estimated coverage areas, and now these little wedge shapes or these sectors are all different sizes, the CAST program has to be linked to a tower list that has the location of all of those towers. That's the only way the program knows how to size the cell sites. So I just want to clarify if I'm mapping the CDR's without coverage areas, all I need is the CDR's. If I'm mapping the coverage areas in the CAST VIZ program, I have to have a tower list. This one I can see three different sectors, two of them- if anybody sees this exhibit, just to make the record really clear, they're really hard to see. One of them is just under the N as in Nora, under the word Pullman, the other one is right by the L in Pullman. Um, but they're different sizes, and that tells me right off the bat that the AT&T tower list is used.
ANNE TAYLOR: And why are they different sizes? Remind me again please?
SY RAY: Cell tower density. We see a great big sector right in the middle of this map, and I'm not familiar with the area here, it's basically south of Pullman, and south of Moscow, kind of out in the middle of nowhere. There's not a lot of cell towers out there, so one tower covers a very large area. Then the other two are going to be in Pullman… um it's kind of hard to see on this map, but I believe they are going to be ones that are on Washington State University campus, a lot more cell towers, the coverage is much smaller. So it's just a way to look at tower density, to kind of estimate how far certain towers may connect to a phone where others may have a very short range.
ANNE TAYLOR: And is it based on that difference in towers that causes you to know that a certain type of tower report was used?
SY RAY: Yeah, it's a basic algorithm that uses tower density, and the only way to determine tower density is to have a list that has all of the towers, not just the ones that were used by the cell phone.
ANNE TAYLOR: Okay… do we have the list of the towers, the tower list that was used by Detective Mowery in developing that exhibit?
SY RAY: Detective Mowery stated he did not use a tower list to create this exhibit, so no… but I'm not sure how to answer that, other than I haven't seen one.
ANNE TAYLOR: Should it be there?
SY RAY: It is physically impossible to create this map without it.
ANNE TAYLOR: If you had the logs from the CAST VIZ program that would, would that give you more information about what was used?
SY RAY: It would. Uh, we would need the CAST VIZ program as well, the logs are saving certain settings, and it's a JSON format, which is just a software language. We could load that JSON file into the CAST VIZ program, and for the most part we could replicate exactly what was done.
ANNE TAYLOR: If I understand that, to turn it around, in order to replicate that and to see what was done, you would need a CAST VIZ program, is that right?
SY RAY: Correct… and preferably the same version that was used.
ANNE TAYLOR: And you need a JSON file that was made by Detective Mowery, is that right?
SY RAY: Correct. And depending on where the software program is, we would probably need the source data- again, because it may not be automatically linked; anybody who did PowerPoint 10 years ago, you make a PowerPoint on one computer, you save it on a thumb drive, you go to a different computer, all the links are broken… it could create a situation like that, so you probably need the original source data as well, just to be sure.
ANNE TAYLOR: What's the original source data?
SY RAY: In this case it would be the AT&T CDR's and the cell tower, the regional cell tower list.
ANNE TAYLOR: From that time?
SY RAY: Correct… okay well no, if we're trying to recreate this work, this is where it gets a little bit complex… we would need the exact AT&T tower list that Mowery used, but didn't use, which makes it really difficult because AT&T updates these on a fairly regular basis. If he used a November list, and I use an April list, the results could be different.
ANNE TAYLOR: Okay why would the results be different and [given the month of??]
SY RAY: AT&T could have added or subtracted cell sites in the area, which would change the tower density. they could also reconfigure those cell sites, so maybe they point different directions. Uh, given the rural area, two or three months, I don't think you're going to see much of a change, but it's always possible. So if we're talking about recreating this exhibit exactly the way it was, we would need not just the regional tower list, we would need to know which version of the regional tower list he used.
ANNE TAYLOR: Is that generally why people in your field save their work?
SY RAY: We're talking best practices 101. Um, we're creating a work product that is going to be used in a forensic nature, not showing how an extraction is done, not showing the source data that I use to create an exhibit… it happens, but it for the most part it's not preferable, especially somebody who is a subject matter expert in digital forensics… I won't say I haven't seen it, but it is rare.
ANNE TAYLOR: Thank you. Let's move on and talk about the CAST draft… let's have you-
COURT REPORTER: I'm sorry Miss Taylor, the CAST [??]?
ANNE TAYLOR: Draft.
JUDGE JUDGE: Can I ask how much longer on this, because we're 90 minutes, I need to give the court reporter a break?
(38:43 hearing resumes after a break)
ANNE TAYLOR: Mr. Ray, when we left off at our break, I was about to talk to you about the CAST draft report.
SY RAY: Okay.
ANNE TAYLOR: So we'll start there… have you reviewed a CAST draft report in Mr. Kohberger's case?
SY RAY: I have.
ANNE TAYLOR: And from your review of that report, can you tell what records were relied on by [FBI] Agent Ballance to create that report?
SY RAY: That report would include- he had to have the AT&T CDR's, the full six months, a tower list to make some conversions that I'm seeing on the report, and also drive test data, should be another form of source data. And then a mapping platform to adjust the drive test data into, to analyze it to create these shapes that are then put into the draft report.
ANNE TAYLOR: Okay, I think I have it. Do we have the same call detail records that Nick Ballance used to create his draft report?
SY RAY: Yes. Well, I believe so.
ANNE TAYLOR: Do those records appear to come from the December 23rd, 2022 two AT&T warrants?
SY RAY: I would say primarily the second warrant, from what I've read.
ANNE TAYLOR: And is that because the CAST draft report spans the full six months of those records?
SY RAY: That is correct.
ANNE TAYLOR: Okay and those records… did those come from the second AT&T search warrant?
SY RAY: That is also correct.
ANNE TAYLOR: Can you tell anything about the tower report or how the tower information was used by Agent Nick Ballance?
SY RAY: The tower identifiers that are predominantly used, not exclusively, but predominantly used in the CAST draft report, did not come from the Report AU. There's a conversion that can be made, and someone would have to have the national AT&T tower list, or at least the regional list, and I would take information from the CDR's, I would look at certain columns in this AT&T tower list, and I could get certain identifiers that are now being populated to the CAST report, if that makes sense.
ANNE TAYLOR: Do we have a copy of the tower list that you believe was used?
SY RAY: We recently received four different versions- and when I say versions, they're just by month, and I believe we have August, September, November, and maybe December, or maybe it's in October? I'd have to go back and look. So far l've only had time to look at the November, and from what I can tell, all of that appears to be accurate.
ANNE TAYLOR: Would we need the October, or the missing month, to be able to do our work accurately?
SY RAY: It's a really good practice, I'm sure that's why the FBI included it. If I'm mapping records over a long period of time, like in this case six months, I do want to see the different versions of the tower list to make sure that if a change was made within the network during that six-month period, a tower I map in July may map differently in November, so it is important to have that data.
ANNE TAYLOR: We have four of the six months, but not the other two?
SY RAY: Correct… it would be helpful to even maybe see May, because there may not have been an update made in late June, early July, so May’s would be what I would start with.
ANNE TAYLOR: Can you tell if drive testing was done to create that CAST draft report?
SY RAY: Yes. There's images in the latter part of the report, up around slides 100 and above... I believe there's a total of four images that were populated to that report that would require drive testing.
ANNE TAYLOR: When somebody's doing drive testing, do you expect data to be produced?
SY RAY: Absolutely. Um, creating a work product that uses drive testing, and then coming into court and testifying without the drive testing, is no different than creating an exhibit like this [gestures to document in front of him] and then saying “well, we don't have to produce the AT&T records that created this”... um, the source data for drive testing, is the drive test.
HERE IS WHERE THE TRANSCRIPT FROM MY EARLIER POST BEGINS:
(Beginning at 43:27 in the video.)
ANNE TAYLOR: Do we have the drive testing that was done by the FBI to help create that report?
SY RAY: We have what I believe is the majority, there are some significant pieces missing, I can't say that those missing pieces exist and haven't been turned over, or they were erroneously not collected, I-I don't know which, but there are some pretty significant pieces that are missing.
ANNE TAYLOR: I'm going to ask you some questions about that, but first I want to know when you first saw drive testing data that was produced to us in discovery, what did that cover?
SY RAY: I found a file in the discovery I want to say early December, that included a drive test, but it was about a 3 minute sample that covered less than a quarter of a mile, and a completely irrelevant location, so it added no value to my analysis at all.
ANNE TAYLOR: What were you looking for? What time frame and location were you looking for based on the CAST draft report review?
SY RAY: I would expect significant drive testing around any location that coverage maps were being used in the CAST report. I would expect significant documentation on potential routes that this device may have taken. I would expect significant documentation on the crime scene.
ANNE TAYLOR: You just told us that you think we have most of it, but that there's some significant parts that are missing?
SY RAY: Yeah and I want to qualify that, just so it's really clear, because I understand it's starting to get very technical: there's over 500,000 lines of data that was turned over, so I-I'll make it clear, there's a lot of data that has been produced. I would say, in my opinion, looking at what's been produced, probably 2 or 3% is missing, but it’s not the amount of data, or the time of the data, it's the locations of the data. Some of the most significant locations in this case, we're missing some data.
ANNE TAYLOR: Those significant locations, have they been depicted or captured on the CAST draft report?
SY RAY: They have.
ANNE TAYLOR: And tell me what those locations are, what are we missing?
SY RAY: I am unable to find any measurements along, I believe it's 270, um the Moscow-Pullman Road, if you drove the most direct route from Pullman to Moscow or vice versa, pretty much as soon as you're leaving Pullman to the time that you arrive in Moscow, we are missing that entire stretch… if there's ever been a case that we need to look at what does it look like when a phone travels from Pullman to Moscow, this is probably the case. Um, we have the neighborhood around the crime scene, we don't have the crime scene. Normally that wouldn't be too terribly significant, because if it's a flat area, there's not a lot of vegetation, or mountains, you can probably interpret it the same. The location of this crime scene is very unique because it sits on a mountain, part of it is shielded by a mountain, there's a lot of other big thick, dense uh, apartment buildings there. Your phone is going to behave differently inside of that residence than it might on the road behind the residence, or in the front of residence, I can't find any drive test data that actually encapsulates any part of the property.
(47:04)
ANNE TAYLOR: You talked about the device that helps do the drive testing, or that captures the data while you're doing the drive testing. What's that called again?
SY RAY: It's a drive test scanner. The most common one used in law enforcement is created by Rohde & Schwarz, that same company I referred to earlier. I'm familiar with the hardware that the FBI uses and it is a Rohde & Schwarz scanner.
ANNE TAYLOR: Is it called Gladiator?
SY RAY: Gladiator is the company that sells the product to the FBI. Gladiator actually buys this product from Rohde & Schwarz and it does what they call “white label”. So they buy the hardware from Rohde & Schwarz and they kind of slap their sticker on it, and they put their software in it, and then they sell it to the FBI. But ultimately it is a Rohde & Schwarz piece of hardware.
ANNE TAYLOR: And once you have that piece of hardware, once you have this device, does it just work forever? Or is there anything that has to be done to ensure it's working properly?
SY RAY: It is a technical piece of equipment that takes measurements, it is required to be calibrated. The best way that for probably everybody in the courtroom to think of, if we go a little old school, is the old breath tests. If you had a DUl and law enforcement couldn't produce the calibration records of the breath test, it was really problematic… similar thing here, we want to see that the device is calibrated. In this case it's really important, because keep in mind I reviewed thousands of these drive tests over my career, there is a significant gap that I believe there's something malfunctioning in the equipment, or the operators are just not paying attention, I can't tell you which one it is. So in this case we need the calibration records to show that the device is functioning properly, are really critical.
ANNE TAYLOR: Do we have those calibration records on the device that was… well, was there more than one device used?
SY RAY: There was, there was actually two devices used.
ANNE TAYLOR: And was this drive test done on just one day? is this a one-time shop (stop)?
SY RAY: No, I think there's maybe five days total that I've seen drive test data collected.
ANNE TAYLOR: Okay… so now let's talk about the calibration for this instrument, or this machine… did we get records for all the machines that were used by FBI in this case?
SY RAY: We've got the calibration records that were taken prior to the use of these, of the samples. It'd be really helpful to have the calibration records after the use, so we-we kind of need to bookend those, because we know that it left Rohde & Schwarz factory in October and everything was working great. When it came back, we don't know when it came back, and we don't know if it was functioning properly when it came back. It's not uncommon for there to be errors, I saw a report and it said it came in and it had two errors. It's not the end of the world, the sky doesn't fall, uh you have to get into the documentation to see what those errors were. Normally the device kind of self-calibrates itself, if you know what you're looking at, the major concerns that you would see if the calibration is off, it it becomes very obvious because results are really flawed… that's where I have a concern in this case, is we have what I consider a significant chunk of data for specifically a location where the instrument is running, there's no doubt it's functioning, but it's not properly collecting AT&T data, which is concerning as to why.
(50:35)
ANNE TAYLOR: Because there were multiple drive tests done, and you talk about bookending these calibration reports, would you need to bookend all of the time that the drive testing was done with these calibration reports? and what I'm saying is, if there's something done in November, and then drive testing done in December, and then more drive testing done in January, and then maybe some in March, do you need the bookend calibration reports around each of those drive tests?
SY RAY: You would. As of today, I haven't seen any drive test data I believe beyond January 5th, and I'm not sure the time zone, so maybe it could creep into January 6th… but if there's any drive test data after the first week of January, I'm unaware.
ANNE TAYLOR: Okay so in our case, which months are we missing?
SY RAY: For the calibration?
ANNE TAYLOR: Yes.
SY RAY: Whatever the next calibration - the FBI would choose when to send these devices in, so whatever that next calibration report was generated for these two devices.
ANNE TAYLOR: On the calibration certificates we have, I think you told us that after the maintenance, it went back into service and passed inspection and was functioning properly?
SY RAY: Well, when it came in, it did have multiple errors, but when it went out it was functioning properly.
ANNE TAYLOR: Is that why you need to see the next one, on the other side of the drive testing?
SY RAY: That is correct.
ANNE TAYLOR: Okay now when we're thinking about the data, the drive test data that we have that's missing some significant portions… could it be because the machine wasn't working right all the times they tried to do drive testing?
SY RAY: Yes.
ANNE TAYLOR: Okay, is it also possible that the FBI agents using this machine weren't properly trained to do the drive test data, or to do the drive testing and collect data?
SY RAY: I know of the two FBI agents from prior lives. I believe they're properly trained.
ANNE TAYLOR: So we're looking at either the machine itself isn't functioning properly, or could that data have been pulled out of what we got?
SY RAY: If we're talking about possible scenarios that would cause the shortcoming of data, maybe it was never captured in the first place? I-I can't speak to that… um, the machine erroring at least during one portion of this drive test, I've seen similar errors before. I'm pretty sure they had a small period of time where it just, it had been a very busy day, and it kind of gave up for a little while like any computer will, it needed to be reset. Could things be extracted and us not know? That's always possible, I can't rule that out.
ANNE TAYLOR: Is the missing data important to you to fulfill your duties in Mr. Kohberger's case?
SY RAY: I don't recall when I got involved in this case, on the day where I could actually start looking at evidence… l've had a concern since the very first day I saw the CAST draft report that there are significant errors in the drive testing… it was before I even saw the drive testing, I can look at the coverage areas, I can tell you they're wrong… so… yes, it's not a concern that they're wrong, people make mistakes, we can fix things… it's a concern that I still don't have the source data that any expert, not just myself, but anybody, could sit down and look at it and say “okay, I see what's happening here, here's how we fix this”... unfortunately, that mistake has a ripple effect, and I'm seeing multiple errors that are happening as a result. So that's why this data is important… we've reached a point that we need to determine is this just human error? Is this accidental? Is it intentional? Is there other things at play here that's changing this narrative, to where there's clearly some manipulation of the original data?
ANNE TAYLOR: And having that data, will that help us answer that question?
SY RAY: It's the only way we're going to answer that question.
ANNE TAYLOR: Alright, I have just a couple of other questions for you, and I'm going to depart from the CAST report and the drive test data a little bit… as an investigator, or as a person doing an analysis of this case, does the drive test data tell you where a phone traveled to indicate other investigation that you should do?
SY RAY: Technically, the call detail records tell us that, the drive test data help us become more accurate with that. AT&T is one of the best companies in this particular situation, to show device movement, because we get a constant connection. So when, and I will emphasize when, all of the data is mapped, and I'm talking about the CDRs (call detail records), we can get a really good idea of, “hey, a phone traveled north for 10 miles, and then it traveled east”. The drive test data would actually allow us to replicate and recreate these tower handoffs, that we're seeing to come up with that first theory… to now we can say, “in order to do this, and hit these towers in the sequence that it did, it has to be driving on this highway, and then when it went east, it most likely turned onto this highway”. So the drive test data helps us get very specific with what the CDRs (call detail records) mean.
EDIT TO ADD:
Here is a clip from Sy Ray's podcast with his wife, called Socialite Crime Club. It's an example of the work he does with cell phone locations, in relation to the surrounding cell towers:
The video should start at 44:58, but just in case it doesn't, that's the point in the video I'm talking about.
Back to the transcript!
ANNE TAYLOR: As an investigator, in performing an analysis of work done in this case, when you have the CDRs, the call detail records that tell you where a phone's been, is that useful in directing your investigation to what other evidence might be out there, like videotapes?
SY RAY: I'll qualify my answer, because I'm not sure if you're asking specifically for this case, or in general… yes, you map all of the data, and especially if you're going to justify six months worth of data on somebody's cell phone, you map every single connection that there is in those records. from what I have reviewed, the FBI mapped 6% of the data that came in. From [Detective] Mowery’s testimony, and what I've seen through here, he was up to about 18%. So by either standard, more than 80% on both accounts were never mapped or accounted for… and I'm not talking overall, from every single day for six months. I'm talking about the time frames that are chosen. So for example, this time period that's represented here [holds up paper], uh is where I'm getting the 18%-
ANNE TAYLOR: And that's the 48 hours?
SY RAY: This is specifically from 2 a.m. to 6 a.m. on the morning of the 13th [of November], arguably the most critical time period of this entire investigation, they mapped a handful of connections… when I say handful, they mapped 18%... when you add the other 82%, it tells a much more detailed story. When we put the drive test data on top of that, you can get even more refined. Um, but to answer your question on any case, that's this case… on any case, and we teach best practices, we've established best practices going back to 2008 in law enforcement, what do you do with this type of data… it is a terrible practice to justify probable cause for this very detailed call detail records, that give breadcrumb like trails for individuals, and then not map it. We justify an entire probable cause saying we have to have this. Not mapping it, and then making decisions and work products while leaving that out, is extremely problematic.
ANNE TAYLOR: Last week we received some additional records that Detective Mowery found when he was preparing for his testimony on this motion to compel… have you had a chance to review those records?
SY RAY: I have… a couple of them are very technical, so I'm not going to say that I've mastered them yet, but I have a good idea of what was provided and (what it needs?).
ANNE TAYLOR: Based on your, I guess not as thorough as you'll do, review of these records, do you have a sense as to whether these records matter to us, and what we're doing to defend Mr. Kohberger?
SY RAY: Given the timing of these records, from what I can tell in the emails that were produced by Detective Mowery, these records were generated on the 23rd of December, it's when everything starts with probable cause statements… and if I had to pick a time when the wheels fell off the wagon, that's the date. There are statements, and there's assumptions made in the records, that will never be supported by the data. There's a lot of claims that are said in these emails, and even the name files [file names] of the records are problematic; it does not represent what it's claimed to represent.
ANNE TAYLOR: Sounds like those might be pretty important to us in defending Mr. Kohberger?
SY RAY: I could give examples but I-I know it's a very technical thing, so I'm not - it could be extremely impactful to either side, I'm not saying just in defending Mr. Kohberger. it could be extremely impactful in prosecuting Mr. Kohberger. The problem's the problem, not what the data helps or hurts.
ANNE TAYLOR: The content of the data, though is it helpful to us in representing the defendant?
SY RAY: It absolutely is helpful. Everything that I've seen to date is concerning to me, because it's exculpatory - and I want to, I need to clarify this… when all of the records are produced, and the dust settles, and I have time to review it, I reserve the right to say “no, now that I'm seeing everything, here's what l'm seeing”… because of the piecemealing of the data, because of the missing data, because of data that I'm reviewing that is incredibly inaccurate, everything that is missing is absolutely in the benefit of the defense right now. There's other reports that I believe are missing, that I can't tell you are in the benefit of Mr. Kohberger, or in the benefit of the state. If I was contacted on December 1st by Moscow Police Department, there are things I would have absolutely said “you get this today, do not hesitate”, especially come December 23rd. Not because of who it's helpful for, but because those documents are the only things we're going to get that's going to be able to allow us to interpret what it really means… and if we don't get those documents, and we piecemeal things, it creates this narrative that is very harmful for the defense's case… as I've got more documents, I'm finding it's not harmful for the defense's case, there's a lot of misstatements that have been made…. so yes, to your question, to date it is very helpful for Mr. Kohberger. I reserve the right to change that opinion in 6 months, depending on what type of documents are released and what's out there.
ANNE TAYLOR: Fair enough.
After this Anne Taylor ends her questioning, and the prosecution is asked if they have any questions for Sy Ray. In a dramatic shift from the way Bill Thompson behaved during the hearing with Dr. Edelman, he is totally silent throughout Sy Ray’s testimony and has no questions for him afterwards. I can’t imagine why that could possibly be…?
This is amazing girl! Boy that must have taken a lot of time!