Jonathan VanHouten — Direct
137 linesJUDGE NEWMAN: Call your next witness.
MR. CONRAD: Please the Court? The State calls Jon VanHouten.
The witness, JONATHAN VANHOUTEN, was first duly sworn and testified as follows:
COURT CLERK: Take a seat in the witness stand. State your name again for the record. Spell your last name.
JONATHAN VANHOUTEN: Jonathan VanHouten. V-a-n-h-o-u-t-e-n.
DIRECT EXAMINATION
BY MR. CONRAD:
MR. CONRAD: Mr. VanHouten, where are you employed, sir?
JONATHAN VANHOUTEN: United States Secret Service.
MR. CONRAD: All right, and how long have you been employed there?
JONATHAN VANHOUTEN: This April will be three years.
MR. CONRAD: All right, and are you currently a law enforcement agent?
JONATHAN VANHOUTEN: I am not.
MR. CONRAD: Okay, and you're a civilian employee of Secret Service?
JONATHAN VANHOUTEN: I am.
MR. CONRAD: All right, but you do have a background in law enforcement, correct?
JONATHAN VANHOUTEN: Yes. I retired after twenty-one years with the Columbia Police Department as an investigator. For the last ten years, I was assigned as a digital forensic examiner with the US Secret Service.
MR. CONRAD: Okay, and you were a task force officer --
JONATHAN VANHOUTEN: Correct.
MR. CONRAD: -- during that time?
MR. CONRAD: And you retired from the Columbia Police Department when?
JONATHAN VANHOUTEN: April 20, 2020.
MR. CONRAD: Okay. All right, and in this case you were provided a phone by, I believe, Britt Dove. Is that correct?
JONATHAN VANHOUTEN: Lieutenant Dove, correct.
MR. CONRAD: I'm going to show you State's Exhibit 271. I want to see if you recognize this document, sir.
JONATHAN VANHOUTEN: This is the SLED Law Enforcement -- or South Carolina Law Enforcement Division chain of custody that was submitted to me by Lieutenant Dove.
MR. CONRAD: All right, and do you recognize your signature on that form?
JONATHAN VANHOUTEN: I did sign this form.
MR. CONRAD: All right. What day did you sign that form?
JONATHAN VANHOUTEN: March 21, 2022.
MR. CONRAD: Okay.
MR. CONRAD: All right, at this time the State would move Exhibit 271 into evidence.
MR. BARBER: No objection, Your Honor.
JUDGE NEWMAN: It's admitted.
(CHAIN OF CUSTODY FORM MARKED AS STATE'S EXHIBIT NUMBER 271 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: Okay. I'm going to hand you State's Exhibit 272, and see if you recognize that, sir.
JONATHAN VANHOUTEN: This is an evidence photo that I acquired of the device that was submitted to me.
MR. CONRAD: You took that picture?
JONATHAN VANHOUTEN: I did.
MR. CONRAD: And do we see a sticker on the back of that phone?
JONATHAN VANHOUTEN: There is a yellow sticker on the phone.
MR. CONRAD: And what is it? Can you read that sticker, please?
JONATHAN VANHOUTEN: It appears to be some type of case number, evidence number, identified as an Apple IPhone, the model number with a SIM, and an agency case number.
MR. CONRAD: And if you'll just read the case number and the item number.
JONATHAN VANHOUTEN: 70210204, Item Number 10.
MR. CONRAD: Thank you, sir.
MR. CONRAD: At this time, the State moves Exhibit 272 into evidence.
MR. BARBER: No objection.
JUDGE NEWMAN: It's admitted.
(PHOTO MARKED AS STATE'S EXHIBIT NUMBER 272 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: All right. So, I believe you said March 29th of 2022 is when Lieutenant Dove provided you that phone, sir?
JONATHAN VANHOUTEN: March 21st.
MR. CONRAD: Excuse me, it's the 21st. All right, and why did he bring this to you?
JONATHAN VANHOUTEN: It's my understanding that the phone was locked and SLED requested assistance of the Secret Service to unlock the device.
MR. CONRAD: And the Secret Service at that time, did you have the tools available that could potentially unlock that phone?
MR. CONRAD: And did SLED have those tools, at least on that date?
JONATHAN VANHOUTEN: At that time they did not.
MR. CONRAD: Okay. All right, and what tool did you use to attempt to unlock that phone?
JONATHAN VANHOUTEN: For this -- for my unlock attempt, I used a tool called Cellebrite Premium.
MR. CONRAD: Okay, and Cellebrite Premium is a way to potentially break into bro -- excuse me, locked phones, correct?
JONATHAN VANHOUTEN: That is the only use for that tool.
MR. CONRAD: All right, and just generally speaking, how does a Cellebrite Premium attempt to unlock a locked phone?
JONATHAN VANHOUTEN: It uses its proprietary software and attempt to brute force the device.
MR. CONRAD: Okay, and what does brute force mean?
JONATHAN VANHOUTEN: Brute force is if we don't have the code, we will attack the device, attack the data on the device to try to brute force the pass code to unlock the device.
MR. CONRAD: And a device that's locked, why does it need to be unlocked for you to access the data? What underlying conditions exist that prevents you from seeing the data?
JONATHAN VANHOUTEN: Well, for Apple IPhone devices there are two types of locks: there are before first unlocked, and after first unlocked. Before first unlocked is the phone is either powered down, it's been turned off and rebooted, or a code has been entered in too many times incorrectly. If you were to -- an analogy for -- if you think of it as a bank vault before forced unlock, at which we have to brute force the device, it's like the big steel door.
MR. CONRAD: Okay, and the underlying data is encrypted, correct, otherwise?
MR. CONRAD: And you would not be able to read that data, correct?
JONATHAN VANHOUTEN: I have to unlock the device to get to the data to decrypt it.
MR. CONRAD: And so Cellebrite Premium, you said, attempted to do a brute force unlock, correct?
MR. CONRAD: And ultimately was that attempt successful?
JONATHAN VANHOUTEN: It was. It was successful because I generated a predefined dictionary to attempt first prior to the tool using its own dictionary.
MR. CONRAD: Okay, and what do you mean by that? What does that mean?
JONATHAN VANHOUTEN: Well, humans are creatures of habit. They like to use numbers that are relevant to them. Most people will use their date of birth and anniversary, a child's birth, the death of a parent as the access code. So, what we do generally is we get as many social engineered codes or dates that are relevant to the particular phone that we will attempt first. Once that attempt is no longer viable, the tool will use its own dictionary to start a hard core group force process.
MR. CONRAD: And absent kind of getting lucky with a preceded number, if the Cellebrite Premium has to brute force its way through and unlock a phone, how long would that take?
JONATHAN VANHOUTEN: So with a four digit phone, if you had a four digit numeric PIN code, we are limited to an attempt of 146, maybe 145 attempts per day. So, a four digit code has a maximum possible numeric value of 10,000 attempts. So, at 146 attempts to day, it would roughly take a little over two months to 68 days to unlock that phone. Adding two extra numbers to a six digit, going from a four digit to a six digit, there are approximately 1 million possibilities now. And 146 attempts per day, it could take upwards 19 years.
MR. CONRAD: All right. Now, you said that it could only do 146 attempts a day. Is that correct?
JONATHAN VANHOUTEN: Based on technology at the time, and current technology is progressing, so it is getting faster.
MR. CONRAD: Okay. Why is the software limited to just 146 attempts a day?
JONATHAN VANHOUTEN: This is a security protocol chip built into Apple. It limits the timeframe that somebody can attempt to brute force a device. The first -- it's an average of one attempt every 15 minutes.
MR. CONRAD: All right, but ultimately you said you seeded several numbers into Cellebrite Premium to give it some potential guesses first before just start going through all of the other ones, correct?
JONATHAN VANHOUTEN: Yes. Once I start the brute force process, there is an option for me to enter my own dictionary or numbers that are relevant -- that I think is relevant to the user of the device. In this case, I entered a number that successfully unlocked the phone rather quickly.
MR. CONRAD: Okay, and what was that number associated with?
JONATHAN VANHOUTEN: I believe the number was associated with the date of birth of Paul Murdaugh.
MR. CONRAD: Okay. All right, and so once you successfully unlocked the phone, what did you do with it?
JONATHAN VANHOUTEN: I notified Lieutenant Dove that the phone successfully unlocked. I advised him that I was going to be getting a full file system extraction since I still have the phone in my possession. Lieutenant Dove provided me with an external hard drive to place the extraction on, at which time I did.
MR. CONRAD: Okay. So, you did a full file extraction and placed that on a hard drive, correct?
JONATHAN VANHOUTEN: Correct.
MR. CONRAD: Now, did you examine the contents of that full file extraction?
JONATHAN VANHOUTEN: I did not. SLED has their own examiners. We did the extraction for them, but they analyzed the phone.
MR. CONRAD: And so the data you placed on a hard drive and provided to Britt Dove, is that substantially the exact same data that you extracted from Paul's phone?
JONATHAN VANHOUTEN: It is.
MR. CONRAD: Has it changed in any significant manner?
JONATHAN VANHOUTEN: It has not.
MR. CONRAD: I'm going to hand you State's Exhibit 273. Do you recognize that document, sir?
JONATHAN VANHOUTEN: This is a South Carolina Law Enforcement Division chain of custody where I returned the phone to Lieutenant Dove.
MR. CONRAD: Do you recognize your signature on there?
JONATHAN VANHOUTEN: I do.
MR. CONRAD: And what date did you sign that?
JONATHAN VANHOUTEN: March 24, 2022.
MR. CONRAD: All right, and you then provided Paul's phone back to Lieutenant Dove, correct?
JONATHAN VANHOUTEN: Correct.
MR. CONRAD: All right.
MR. CONRAD: At this time, the State would move to enter Exhibit 273 into evidence.
MR. BARBER: No objection.
JUDGE NEWMAN: It's admitted.
(CHAIN OF CUSTODY FORM MARKED AS STATE'S EXHIBIT NUMBER 273 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: Okay, and I'm going to show you what's been marked as ID -- I believe this is 274. Do you recognize that item, sir?
JONATHAN VANHOUTEN: Yes. This is the phone I received.
MR. CONRAD: Okay, and that sticker on back?
JONATHAN VANHOUTEN: It matches the photograph that I took.
MR. CONRAD: Okay. The photograph we put into evidence, the sticker on this phone matches that, correct?
JONATHAN VANHOUTEN: It does.
MR. CONRAD: Okay. All right. One last question, Mr. VanHouten. There have been a couple of questions about Faraday bags in this trial. What is a Faraday bag, sir?
JONATHAN VANHOUTEN: A Faraday bag is -- basically what it is is a bag that shields electronic signals from entering or exiting the bag.
MR. CONRAD: Okay, and what is the danger -- by placing a phone in a Faraday bag, what is the danger you're trying to prevent?
JONATHAN VANHOUTEN: We're attempting to prevent a remote wipe or remote destruction of the data on the device.
MR. CONRAD: Once law enforcement takes a phone into evidence or custody, are there other ways to prevent a remote wipe?
JONATHAN VANHOUTEN: Absolutely. Powering the phone down completely, not leaving it plugged to a charger, removing a SIM card. Or the easiest is place the phone in an airplane mode. It will disable the cellular data and WiFi signal.
MR. CONRAD: And you said that the danger is the phone could be remote wiped.
JONATHAN VANHOUTEN: Yes. Somebody with the account user name and password could log into the I-cloud account and set a remote signal. That signal will remain on the tower or in the -- on the network until the phone is reactivated. So, yes, somebody would have to have the user name and the password to log in to commit that offense.
MR. CONRAD: Okay, and was the phone that you did an extraction of, was it wiped when you received it?
JONATHAN VANHOUTEN: It was not.
MR. CONRAD: Okay.
MR. CONRAD: Nothing further from the State for this witness.
JUDGE NEWMAN: Cross-examination?
MR. BARBER: No questions, Your Honor.
JUDGE NEWMAN: Thank you. You may step down.
(The witness exited the stand.)
JUDGE NEWMAN: We will recess until 1 -- until 2:15, recess until 2:15. Please do not discuss the case.
(The jury left the courtroom.)
(A lunch break was taken.)