The abductor of Nancy Guthrie could be caught using tactics that were crucial in the Bryan Kohberger case, according to a digital forensics investigator who analyzed the Idaho killer’s phone.
While criminals know to turn their phones off when committing an offense they are less aware of how going dark can also be a major clue for law enforcement.
Special agents from the FBI’s Cellular Analysis Survey Team (CAST) will now be trawling through cell tower data from a wide area around Nancy’s Arizona home, building up a picture of historically normal activity and looking for anything abnormal, such as phones being turned off and then on again in the early hours, when the kidnapping happened.
‘You have to know what normal is to find evil, and this person’s phone would be considered the evil,’ Heather Barnhart, an expert with Cellebrite and the SANS Institute, who worked on the Kohberger case, told the Daily Mail.
Today star Savannah Guthrie’s elderly mother, Nancy, was abducted from her home in Tucson, Arizona on February 1 and FBI special agents are painstakingly going through cell phone tower data to find her kidnapper
Nancy, the mother of Today show host Savannah Guthrie, was taken on February 1 between 1:47 am, when her doorbell camera was disconnected, and 2:28 am when her pacemaker app dropped from her phone.
Drops of her blood were found on the front porch and eerie footage, recovered from her Nest doorbell camera, showed an unidentified masked suspect standing at her front door.
Barnhart said investigators have all the cell phone tower data and would be methodically going though which devices entered the area on that night, and then also looking at ‘pings’ when they leave.
They will have a particular interest in phones with pings showing that they were driving away, and especially if they were not numbers from the area.
In the Idaho case, Kohberger entered 1122 King Road at 4 am where he murdered Kaylee Goncalves and Madison Mogen, both 21, and Xana Kernodle and Ethan Chapin, both 20.
His phone, which Barnhart analyzed, was off between 2:54 am and 4:48 am.
‘If you think about Bryan Kohberger, his device was turned off, so the tower right near King Road probably wouldn’t have picked that up at all. But when he left, he turned it on, because most people rely on their phones for navigation,’ she said.
‘Unless these people (Nancy’s abductor) knew exactly where they were going their phone will be off and then suddenly ping. So, not just cell towers right by Nancy’s home, but take it a few miles out, spread out and look.’
Left to right: Kaylee Goncalves, Madison Mogen (on Kaylee’s shoulders), Ethan Chapin and Xana Kernodle
Bryan Kohberger deliberately shut off his phone at the time he committed his crime
There is also the possibility that Nancy’s kidnapper could have done reconnaissance at her house, which would help forensic digital investigators.
Police have already asked neighbors to check their home security systems for suspicious people and vehicles going back to January 1, a full month before the abduction.
Barnhart said: ‘If the person ever scoped out the house in advance, is there an unusual ping to towers? So, look at normal behavior. If we live in the same neighborhood, our phones are going to constantly ping that tower. Which ones are outliers?’
She used the example of a robbery in which the only reason law enforcement found the culprit was cell phone tower data showing he had made more than one visit to the area.
‘He scoped it out. Then, the day of the robbery, his cell phone pinged again, and then he came back an additional time to check on it. So it was that repeated behavior of someone that typically doesn’t belong in that area.’
She added: ‘You need to do a sprawling look around Nancy. I would look at all routes leaving and entering her neighborhood, and try to get that tower data, which I’m sure they’re already doing.
Heather Barnhart, an expert with Cellebrite and the SANS Institute, said cell phone tower data was a key tool in the hunt for Nancy Guthrie’s abductor
The abductor’s phone would have ‘pinged’ a cell tower when they turned it back on
‘Digital forensics isn’t always exciting, and looking through the normal can be really monotonous and take a long time. People, I think, want answers immediately, and I get it, but it’s hard to do digital forensics thoroughly. And to me, they’re doing a thorough job, and that’s why it’s taking this long.
‘If you’re Verizon, if you’re AT&T, if you’re T-Mobile, there are different formats that the data exists in, so you need an investigator that knows how to look at all the different formats of tower data to parse it and make it normalized. The public has to be patient, and know that people are trying to dig through and find something that doesn’t belong.’
She said the process also depends on how many towers and phones there are in an area.
The rural nature of Nancy’s home would make it easier than a crime in ‘a really populated area that’s constantly busy near a university, so there’s kids who are up all night.’
However, the cell service near Nancy’s home is poor.
‘Cell service isn’t good, but even if your cell service isn’t good, you could be pinging other towers and your phone’s constantly beaconing out,’ Barnhart said.
‘So we need to capture anywhere that those beacons exist to see what is normal and what is not.’
The rural nature of the area around Nancy’s home may help digital forensic investigators
While criminals are getting wiser to how technology can be used to retroactively track them, investigators are still a step ahead.
Some criminals continue not to realize their phones ‘ping’ to cell phone towers while on airplane mode.
‘It’s a stupid choice by criminals putting your phone in airplane mode, you’re still pinging. It’s still beaconing out so it would have to be completely powered down not to make a ping,’ said Barnhart.
‘Bryan Kohberger not only powered his down, he turned off Wi-Fi, turned off cellular, and then powered it down like he was trying to completely get rid of his digital footprint.’
But that deliberate activity by Kohberger proved intent.
‘In Idaho, that’s how we knew,’ said Barnhart. ‘There is this gap of information where there are no phone pings from his device. It’s weird. Him powering off his phone gave us the perfect bookend of his crime, and really proved his intent to do harm to those kids in that house.’
Nancy, 84, Savannah Guthrie’s mother, was last seen by her family on January 31. She was reported missing the following morning and has not been seen or heard from since
As examiners go through tower data, it may be the best hope for identifying Nancy’s abductor.
‘I think this is probably the best chance, in addition to license plate readers and other people’s cameras catching footage of cars passing by,’ said Barnhart.
‘There’s not a perfect criminal out there. Bryan Kohberger thought he was, and clearly we saw he was not. Everyone has cameras. License plate readers are everywhere. So unless you’re using a flip phone, you’ve never touched technology, you enter a house that doesn’t have cameras, and you’re doing it on foot or horseback, you’re going to be found.
‘It may feel to the family like they’re chasing the impossible, (but) with digital, people will be found. There’s infinite amounts of data to keep thinking through.’
