Dwight Falkofske — Cross
72 linesTHURSDAY, FEBRUARY 9, 2023
(Court resumed at 9:39 a.m.)
JUDGE NEWMAN: Good morning. Anything before we bring the jury? Where is the witness? You may resume the stand, please. It's cross-examination. You may bring the jury.
(The jury returned to the courtroom.)
COURT BAILIFF: The jury is present, sir.
JUDGE NEWMAN: Thank you. Good morning.
(The jury responded good morning.)
JUDGE NEWMAN: Welcome, ladies and gentlemen. Day fourteen. Cross-examination continues. You may proceed.
MR. BARBER: Thank you, Your Honor.
The witness, DWIGHT FALKOFSKE, remained under oath and testified as follows:
CONTINUED CROSS-EXAMINATION
BY MR. BARBER:
MR. BARBER: Good morning, sir.
DWIGHT FALKOFSKE: Good morning.
MR. BARBER: This will be very brief, I believe. But just very briefly, yesterday we covered that it was difficult to download the information from the vehicle because it was encrypted by the manufacturer, correct?
DWIGHT FALKOFSKE: Yes. The encryption was done by the manufacturer.
MR. BARBER: And you essentially had to reverse engineer the device using a test vehicle.
DWIGHT FALKOFSKE: That's correct.
MR. BARBER: And it looks like you got a lot of good data out of it but there's some of it that isn't quite clear, like we said that we didn't exactly know what necessarily would trigger something like a system startup.
DWIGHT FALKOFSKE: Correct.
MR. BARBER: But some of other ones would be pretty obvious, like engine on obviously means somebody cranked the car.
DWIGHT FALKOFSKE: Yeah. The engine was turned on at that point.
MR. BARBER: Okay, and I'm not going to go through that spreadsheet again. I just wanted to clarify that. And how long did this process take you, this reverse engineering process?
DWIGHT FALKOFSKE: Our whole analysis took just about one year.
MR. BARBER: That's a long time to --
DWIGHT FALKOFSKE: It's a hard effort.
MR. BARBER: Will you be able to reuse this work on other 2021 Chevy Suburbans?
DWIGHT FALKOFSKE: Some of the tools we developed will be reusable.
MR. BARBER: And I asked before, and I guess it's -- no one reached out to the manufacturer for assistance in this process?
DWIGHT FALKOFSKE: Our group did not.
MR. BARBER: Okay. Do you know why? I mean, I think yesterday you said in the past there wasn't -- you know, they weren't very helpful, but it seems like the worst they could do was to say no. Do you know why it was decided not to reach out?
DWIGHT FALKOFSKE: For our unit, I believe that our attempt is to get the data ourselves without outside assistance. In many cases we end up finding data that even the manufacturer doesn't know was there.
MR. BARBER: Now, I want to turn to what -- I think a technical issue was resolved, and I'm going to show you a printout that has been marked as Defendant's Exhibit 90. And I believe you've had a chance to review this?
DWIGHT FALKOFSKE: Yes, sir, I reviewed this material.
MR. BARBER: And you recognize it --
DWIGHT FALKOFSKE: Yes, this is from our results.
MR. BARBER: And what is this?
DWIGHT FALKOFSKE: This is a list of events that were recorded from the vehicle. There was a category called events that just listed times that something interacted or something occurred with the vehicle.
MR. BARBER: And on this printout the only event, I guess, listed here are an IPhones, or something called Richard's IPhone earlier on connecting to the vehicle. Is that correct?
DWIGHT FALKOFSKE: I see from the first page here, yeah, there's one that's labeled IPhone with a Bluetooth Mac address, and there's an attempt device connection and timestamp.
MR. BARBER: If you've seen this before and your review and you can look at it now. Do you see any -- is this pretty much all device connections, phones connecting to the Bluetooth in the car?
DWIGHT FALKOFSKE: Yes. I see other Bluetooth devices connecting as well.
MR. BARBER: And is it -- just to be clear on this, the only phone connecting in the month of June, at least, is one named IPhone that has a phone number ending in 1227. Is that correct?
DWIGHT FALKOFSKE: The phone number itself is not listed on this page. It's the Bluetooth Mac address that it's identified by.
MR. BARBER: Okay. Is the -- under connected devices right above the word events where is says IPhone and there's a Mac address, is the IMSI number that's listed there (803)942-1227? Is that the phone number?
DWIGHT FALKOFSKE: That's for the IPhone, correct.
MR. BARBER: Okay, and that's the phone that was connecting in June.
DWIGHT FALKOFSKE: That appears to be the only one that connected in June.
MR. BARBER: Yes. Is this something that you also had to reverse engineer out of the vehicle?
DWIGHT FALKOFSKE: Yes. All of the data we found was unknown prior to taking a look at the test vehicle.
MR. BARBER: And the event that we're looking at here, device connection, that is the phone connecting to the Bluetooth in the vehicle so that, you know, you could use it for whatever goes up to Bluetooth connection, whether it's phone calls or apps or whatever depending on --
DWIGHT FALKOFSKE: Yeah, and it indicates a connection event from the Bluetooth to the vehicle's infotainment system.
MR. BARBER: And up here in connected devices, does this indicate that this IPhone was, I guess, paired to the vehicle?
DWIGHT FALKOFSKE: That's correct.
MR. BARBER: Okay, and so in your experience, if your phone is paired to your vehicle and Bluetooth is on and it connects, that typically happens automatically when you get in and turn it on if your phone is with you?
DWIGHT FALKOFSKE: Yeah. If there's a device that is registered or paired to the vehicle, it will automatically connect to that vehicle.
MR. BARBER: And finally I just want to ask about -- you had mentioned in your direct testimony that there's sometimes you can get location data. Were you able to get location data from the vehicle?
DWIGHT FALKOFSKE: From the infotainment we had limited location data, and there was some location data recovered from the Onstar module.
MR. BARBER: And do you recall, was there any location data recovered for the day of June 7th of 2021?
DWIGHT FALKOFSKE: There was no location data recovered on June 7th.
MR. BARBER: And, in fact, there wasn't any for June 6th or June 8th either. Is that correct?
DWIGHT FALKOFSKE: I would have to verify those dates, but it's in essence on the date of interest of June 7th there was no location data.
MR. BARBER: Your Honor, I apologize. I forgot to please move Defendant's Exhibit 90 into evidence, I believe without objection.
MR. CONRAD: No objection.
JUDGE NEWMAN: It's admitted.
(REPORT ON VEHICLE MARKED AS DEFENDANT'S EXHIBIT NUMBER 90 WAS RECEIVED INTO EVIDENCE.)
MR. BARBER: No further questions, Your Honor.
JUDGE NEWMAN: Any redirect?
MR. CONRAD: Nothing from the State, Your Honor.
JUDGE NEWMAN: Thank you. You may step down.
DWIGHT FALKOFSKE: Thank you, sir.
(The witness exited the stand.)