Read original article here
In the end, most of Duggar's six-day trial rested on the shoulders of just two people — who agree on the what and when, but not the who or how
By Adam Carlson
December 07, 2021 11:21 PM
Either Josh Duggar is innocent or he is guilty.
Either he — over three days in May 2019 — used the desktop computer at his car lot in Arkansas to download and view a succession of images and videos of children (some younger than 10) being sexually abused. Or he was the target of zealous federal agents zeroing in on his last name and ignoring any sign that pointed them elsewhere.
Either the 33-year-old former 19 Kids and Counting star devised an elaborate separate system on that work computer to view the illegal material — using a favorite password and some of the same concepts and programs with which he was known to be familiar — or he was the unwitting victim of a hacker exploiting a serious vulnerability in his work router. Either he was a tech-savvy "power user" fluent in hardware, software and router configurations. Or he was a homeschooled rube.
All of these things cannot be true.
Prosecutors and the defense each spent hours over the last week questioning their respective computer forensic experts as to which scenario was more likely, and why. The dueling testimonies offered by the Department of Justice's James Fottrell, a top government analyst, and Phoenix-based private examiner Michele Bush have become increasingly central at trial, despite earlier suggestions by both the prosecution and defense that Duggar's relatives and former employees with suspicious backgrounds might take the stand. In the end, rather than such a wide-ranging scope, the bulk of the six-day trial's evidence rested on the shoulders of just two people — who agree on the what and when, but not the who or how. The gulf between their versions of reality has grown so wide that, an attorney for the government noted in his cross-examination Tuesday, a defense witness had not even made mention in prior testimony of a key and undisputed piece of evidence pointing to Duggar, even as she poked holes in the prosecution. The debates, illustrated with contradictory screenshots and other analyses, could be exasperating for the lawyers and their witnesses.
"Let's be accurate in what we say," Duggar's attorney Justin Gelfand chided Fottrell late Tuesday after Fottrell resumed the stand to rebut the defense case and came armed with a new stack of screenshots from a simulation he ran to undercut them.
Prodded by Gelfand about certain what-ifs regarding the work desktop's activity two years ago, Fottrell told him, "I don't see how a forensic scientist could use a time machine to go back to May 2019." Now that both sides have rested, and with closing arguments expected Wednesday morning, it will soon be up to the jury to weigh who is more persuasive.
The prosecution cited a litany of time-and-place and other circumstantial evidence as to the criminal activity: records showing Duggar was the only employee at his Wholesale Motors over the relevant period in May 2019; text messages and photos with metadata placing him at or near the lot at the same period; a years-old conversation about setting up a separate operating system on a computer to avoid detection; and a penchant for the anonymous Tor browser and file-sharing programs – both being found on the Linux. And all of that was locked behind a password on the Linux system on the work desktop that matched a password Duggar had used for years for his personal accounts and which contained his birthday. All of this, they said, was buttressed by his history as a boy and teenager of molesting four girls, one as young as 5.
The defense, presenting its case on Monday and Tuesday, stressed all that they did not know: who could have accessed the work desktop through a vulnerable "universal plug and play" setting on the router and, what's more, what to make of the highly unusual decision to technically stream the pedophiliac video files downloaded on the computer. And what was on the other devices at the car lot that, just like the work router, had not been taken into evidence by police and forensically analyzed? These unanswerables, defense attorneys said, were the fault of investigators led too easily to the wrong conclusion. Likening the data from Duggar's devices to a "trail of blood," though, they said it actually led elsewhere and they invited the jury to wonder where.
Against this backdrop, the trial's final witnesses testified on Tuesday before the defense rested.
From the courtroom gallery, a number of Duggar's relatives — sister Joy-Anna Duggar and brother-in-laws Austin Forsyth and Derick Dillard; dad Jim Bob Duggar — watched along with his wife, Anna.
A sketch of Josh Duggar's trial in Fayetteville, Arkansas | CREDIT: JOHN KUSHMAUL
Defense Expert Cross-Examined No one disagrees about the device used or what was on it: From May 14-16, 2019, the desktop in the office at Josh's Wholesale Motorcars downloaded and looked at one large collection of child pornography as well as more than half a dozen similar videos.
Bush, the defense's expert witness, was called to the stand to stress what she still could not conclusively show. After lengthy testimony on Monday under defense questioning where she explored how it was possible, even probable, that Josh's work computer was remotely accessed or hacked, the prosecution cross-examined her Tuesday morning.
William Clayman contrasted Bush's credentials with those of the government's main witness, Fottrell, who has been working at the DOJ for decades. By contrast, Clayman pointed out, Bush has been conducting examinations for about 10 years — but some of that time was even before she graduated college. He also asked her about her background as an expert witness in federal court and about her familiarity with Linux and file-sharing programs.
He brought up — as the defense soon would as well, when Fottrell took the stand a second time — that Bush's expert testimony was shaped in part by what she had heard Fottrell say earlier in the trial. (Fottrell also listened as Bush spoke on the stand and later acknowledged making certain aids for prosecutors in reaction to what she said.)
Clayman used his cross to single out how Bush seemed unconcerned with the breadth of circumstantial links between Josh and the illegal activity on his work laptop. She admitted to not knowing before the trial that the key password, intel1988, included his birth year or that Josh had told investigators during a 2019 search warrant that he had been recently configuring his router — a device the defense says is crucial and mysterious.
"I let the evidence speak for itself," Bush told him. Her focus was the forensics, she said. Clayman said there was wide agreement on some key activity, such as the use of a particular anonymous browser that hides someone's internet activity and the use of a particular program to download the sexual abuse materials. Everyone said that that separate, password-protected Linux system would have had to be manually installed on Josh's work computer before the child pornography was accessed.
Yes, Bush said. But she was most interested in the unknowns in this case and in the theory of remote access, which she could not rule out given what she saw on the Linux side: indication that the important programs were possibly installed via a sophisticated technique known as command lines rather than through an app store or online and other signs that the router was vulnerable and the videos were "streamed" despite being downloaded first.
Once Bush realized that, her investigation essentially narrowed in and stopped, she said. No other scenarios were relevant.
"I can't exclude remote access but I can't prove it either," she said, later noting that supporting log files from the Linux part of the computer, which would support or undermine her position, had since been overwritten "The evidence I would need to make that conclusion is no longer available to me," she said.
A courtroom sketch of Josh Duggar's attorney Justin Gelfand in federal court in Arkansas | CREDIT: JOHN KUSHMAUL
As to how remote accessing would work, Clayman said, wouldn't it be strange if the office desktop had been switched over to the Linux system by someone outside the car lot given the sexual abuse material was viewed during business hours? Wouldn't someone at work at the lot, in the office, have seen?
Clayman also highlighted a mistake in Bush's analysis before trial when she said in a court filing investigators had not been able to see a download of child pornography from Duggar's work computer in May 2019 — the incident that first drew them to him — because the download was incomplete. (Nonetheless, police downloaded some of the files successfully.)
"If I can explain my answer…," Bush offered to Clayman as he unremittingly pressed her, in one characteristic exchange. She said she had been confused by the initial police statement.
On the matter of what she did and didn't focus on in her pretrial report and her testimony, Bush said she was hyper-focused on the forensics rather than broader factors outside the devices like the universe of photos from his other devices that linked him to the car lot on the dates in the trial. She again rattled off a list of what she described as concerning clues from her examination, such as the lack of records about how important programs like the anonymous internet browser were installed and the fact that the Linux side of the computer was so small relative to the Windows side with all the car lot records.
But then Clayman asked her if she had definitive proof as to the theories she found so "probable"? "You just don't know," he said. Correct, she said.
And about the car lot's router that has been spotlighted since last week by the defense: If Bush said it could have provided answers about a possible hacker accessing the network via universal plug and play, did she ever ask the defense team or Josh himself to provide it?
"I'm not going out trying to find additional evidence," she said.
She was no less accepting of the prosecution's case. One of Clayman's solutions to how the computer was used was, she said, merely "one of many, many possibilities."
Defense attorney Gelfand, in his re-direct, confirmed with Bush her report was many times longer than the government's (about 100 pages versus about six pages) and had her characterize what universal plug and play could mean in conjunction with the child sexual abuse videos being technically streamed. "The chance that somebody else [not at Duggar's computer] was watching that video is much greater," she said.
Gelfand asked her if she always concluded remote access was involved in other child pornography cases she had examined.
No, she said: "Sometimes I have to argue with the attorneys and tell them, 'This is not a defense. Don't try.' "
After Bush finished, the defense called former local police detective Daniel Wilcox to the stand. He detailed being sent in as an undercover officer in late 2019 to help confirm Josh's whereabouts on the car lot before the search warrant was executed. Gelfand suggested authorities had blinders on in pursuing him versus anyone else at the car lot, though prosecutors, in their cross, had Wilcox explain that the IP address in Josh's name at the car lot was linked to the child pornography.
After a series of conversations in a sidebar with the prosecution and judge (for unclear reasons), the defense then rested.
A sketch of Josh Duggar at his federal trial in Fayetteville, Arkansas | CREDIT: JOHN KUSHMAUL
Key Prosecution Witness Returns In brief rebuttal testimony later Tuesday, the prosecution called the DOJ analyst Fottrell back to the stand where he flatly disagreed with some of Bush's assessments — to the consternation of the defense, who said he was relying on some analysis that was not from the relevant time period. The nitty-gritty testimony — after days of such evidence — boiled down to this: whether or not the file-sharing application used to access the child pornography was easily available on the Linux app store in 2019 or not, and whether there were compelling signs of remote access. Fottrell, like Bush, brought screenshots from a virtualization of his analysis.
He waved off Gelfand's references to Bush's assessment. "I'm not sure how remote access is relevant," he said to a question about streaming the illegal videos, elsewhere again repeating that he did not see a pattern of remote access on the work computer.
Gelfand — sounding audibly skeptical, even piqued by Fottrell's additional testimony that he had not previously mentioned in court — likewise stood firm on the loose thread of the work router and asked Fottrell if he was "still sticking" to his view the router was not relevant. "Not in this case," Fottrell said. It wouldn't have held much permanent data. But, he acknowledged, universal plug and play does create network vulnerabilities.
One thread was not taken up by either side: All of the evidence at Josh's trial shows his work computer spent three days, in a flurry, accessing child pornography and then suddenly stopped on May 16, 2019 — months before agents appeared at his car lot to seize his devices.
And one part of the defense's case was forbidden by Judge Timothy Brooks, who said Bush could not bring up criticisms of the prosecution's use of the text-and-photo metadata from Duggar's phone because she had not done any analysis on it herself and just had an opinion it might be unreliable. After listening to Bush's explanation out of the presence of the jury, Brooks said: "Here she knows the conclusion that she wants to reach and she is looking at possibilities upon possibilities to back into that. And I won't allow that."
Trial deliberations could begin as soon as Wednesday morning.