Connecting the digital dots to catch the 'Craigslist Killer'
When police responded to the April 14, 2009 murder of a young woman in an upscale Boston hotel, they had little to go on. Besides the victim, who was found face down in the doorway of her room, her hands bound with plastic ties, with three 9-mm bullet wounds to the hip, lung and heart, they found blood on the carpet, a spent bullet casing, a cell phone and a Gucci bag containing the identification of a 26-year-old New York woman named Julissa Brisman.
Within a week, though, police had their man: a 23-year-old second-year Boston University medical school student named Philip Markoff, who would soon become known as the “Craigslist Killer.”
The dramatic story of how they cracked the case, through a combination of lucky breaks, dogged police work and a trail of traditional and digital forensic evidence, was told Saturday to a spellbound audience at the ABA Techshow’s plenary session program, On the Trail of the Craigslist Killer: A Case Study in Digital Forensics.
Co-presenters Sharon Nelson and John Simek, president and vice president, respectively, of Sensei Enterprises, a digital forensics, information security and information technology firm in Fairfax, Va., walked the audience through the case step-by-step from the discovery of Brisman’s body to Markoff’s suicide in jail while awaiting trial in August 2010.
It is a tale, Nelson said, of murder, bondage, robbery, betrayal and suicide that perfectly illustrates the interplay between digital and forensic evidence at the heart of a modern police investigation. And as Nelson spun out the tale, Simek slipped in lessons for lawyers who might seek similar access to the digital information—and for anyone concerned about just how much data is gathered on individuals, and how easy it might be for someone to get it.
Investigators got their first big break in the case when they turned on Brisman’s phone, which was unlocked, and found a missed call from her friend Beth in Denver, who later told police that she arranged trysts for Brisman, who was working as a masseuse for men she met through Craigslist ads. Beth said Brisman had had a 10 p.m. appointment with a man who went by the name Andy M. and gave police his phone number and email address.
Detectives caught another break when they secured hotel surveillance photos of a young man in a black leather jacket and a New York Yankees cap entering and leaving the hotel around the time of the murder. They showed the photos to another masseuse who had been robbed at gunpoint and bound with plastic ties at a nearby hotel by a man she met through a Craigslist ad four days earlier. She positively identified the man in the photos as the same man who had attacked her.
Within a few hours of Brisman’s murder, police found the Craigslist ads for both women. Before long (and with some FBI assistance), they learned the phone numbers the man had used to communicate with the two women belonged to two prepaid, disposable phones that had been bought at an area store and that the IP address for the email account he used to arrange his liaison with Brisman, which was created shortly before the murder, was registered to a man named Philip Markoff in suburban Quincy.
Two days after Brisman was killed, another woman working as an exotic dancer was attacked at a Holiday Inn Express in Warwick, R.I., by a man who had responded to an ad she had placed on Craigslist. Police identified photos of a man caught on the hotel’s security camera as the same man they were looking for in Brisman’s murder.
Once they had the man’s name, police turned to Facebook, where they came across a wedding page created by Markoff’s finance, Megan McAllister, about their pending nuptials. Everything suddenly fell into place.
Police launched a stakeout of the couple’s apartment. And when Markoff went to a nearby grocery store, they followed behind, dusting everything he touched, including the handle of his grocery cart, for fingerprints to compare with the one good print they recovered at the scene of the first attack.
On April 20, six days after Brisman was killed, police pulled over the couple’s car as they drove to a casino in Connecticut and arrested Markoff. Though McAllister kept insisting that Markoff was innocent, a search of the couple’s apartment turned up a treasure trove of evidence, including a 9-mm semi-automatic handgun hidden in a hollowed-out copy of “Grey’s Anatomy,” a New York driver’s license in the name of Andrew Miller, bullets matching those used to kill Brisman taped to the back of a dryer, plastic ties, a stash of women’s underwear, a black leather jacket and Yankees cap and a pair of brown leather shoes with Brisman’s blood on them.
Sixteen months later, on what would have been the first anniversary of his wedding, Markoff succeeded in his fourth attempt to commit suicide in jail by slashing the arteries in his neck and legs with a homemade scalpel he had fashioned from a pen and by stuffing toilet paper down his throat so he couldn’t be resuscitated if he was found alive. He had written Megan’s name in blood on the wall of his cell.
