Commonwealth v. Read — Trial ArchiveIan Whiffin - Cross (Part 1)
148 linesMR. ALESSI: If I may have a moment, please set up the—
JUDGE CANNONE: Okay, Mr. Whiffin, I should have told you — you can feel free to stand up and stretch if you want to as well.
MR. WHIFFIN: Okay. Please.
MR. ALESSI: Thank you, your honor. May I proceed with the administrative matters and may I approach?
JUDGE CANNONE: Yes.
MR. ALESSI: Thank you, your honor. Pursuant to a stipulation with the prosecution, I would like to mark and enter into evidence three documents. These are each portions of a March 2025 report prepared by Mr. Whiffin. The first one—
JUDGE CANNONE: So, yes, they can come into evidence. They can come into evidence. There's a stipulation. So we can mark it as the next exhibit if we can.
MR. ALESSI: That's page 29 for the next exhibit.
JUDGE CANNONE: You want them marked separately?
MR. ALESSI: Separately, please.
COURT CLERK: Is it 40?
MR. ALESSI: The next exhibit will be pages 77 and 78 of the same report.
COURT CLERK: Okay.
JUDGE CANNONE: 41.
MR. ALESSI: The third and last is page 43. And page 44.
JUDGE CANNONE: Okay. All set.
MR. ALESSI: Thank you, your honor. May I?
JUDGE CANNONE: Yes, please.
MR. ALESSI: Good afternoon, Mr. Whiffin. I don't believe we've had the pleasure of meeting.
MR. WHIFFIN: Good afternoon.
MR. ALESSI: Cell phone data, when correct and when correctly analyzed, can help tell a story of what may have happened under various circumstances.
MR. WHIFFIN: Correct.
MR. ALESSI: And in cases like this, literally seconds on cell phone data can be significant.
MR. WHIFFIN: Correct.
MR. ALESSI: What I'd like to do is to go back to your PowerPoint presentation and specifically go to the timeline that you had gone through with Mr. Brennan and, rather than repeating everything, there'll be select aspects of the timeline I'm going to reference, and with the court's permission, we will put the timeline back on — that's already in evidence.
JUDGE CANNONE: Okay.
MR. ALESSI: Thank you. So, what I'd like to do is to start with page 70, which we have as 78 of the deck. If you could, Mr. Woll, go to that. And what I'd like to do, if I could please, Mr. Whiffin — draw your attention to the very last entry, which says "loc" at the bottom, location 12:24:38, and it indicates description: first location record showing speed of zero. Do you see that, sir?
MR. WHIFFIN: I do.
MR. ALESSI: And this is the arrival of John O'Keefe's phone at 34 Fairview.
MR. WHIFFIN: Correct.
MR. ALESSI: If we could go to the next page, please. We have up at the top 12:24:59 — about 21 seconds later after arrival — we have device unlock with Face ID.
MR. WHIFFIN: Correct.
MR. ALESSI: Is it possible for anyone other than John to unlock that device with Face ID?
MR. WHIFFIN: If a secondary user was set up.
MR. ALESSI: Do you have any indication that a second user was set up on John's mobile phone?
MR. WHIFFIN: I never looked at that. I'm sorry. I never looked to see if a secondary user was set up.
MR. ALESSI: In terms of the next entry, 12:25:08, it says read message — "you coming here?" with three question marks. What I'd like to do — because you did not note who that was from — I want to go back a few slides so we can identify who that message was from. We could go back to 76, please, Mr. Woll. So, in the last line there — message, reading left to right — 12:20:49, it says message received from someone listed in context as Brian Higgins. Do you see that?
MR. WHIFFIN: Correct.
MR. ALESSI: So, if we could go back to slide 79 — that phone reading the message "you coming here?" is reading the message from Brian Higgins.
MR. WHIFFIN: Correct.
MR. ALESSI: But you didn't note that in the timeline — that that was from Brian Higgins.
MR. WHIFFIN: Correct. No. I was just highlighting the fact that a message was read and that the contents of the message were "you coming here."
MR. ALESSI: But you didn't note in this entry, when it was read by John, that that message was from Brian Higgins.
MR. WHIFFIN: Correct.
MR. ALESSI: Now, the next entry — and again, I'm always going to be leading, reading left to right unless otherwise indicated, sir — is a time of 12:25:09, and it says device locked with lock button.
MR. WHIFFIN: Yes.
MR. ALESSI: You see that, sir?
MR. WHIFFIN: I do.
MR. ALESSI: That requires human volitional conduct. In other words, someone has to actually manipulate their phone and hit it. Right.
MR. WHIFFIN: Correct.
MR. ALESSI: Now, at this particular point, isn't it correct that in your report — that you mentioned in your direct — your March 2025 report, that you had more of a description of what was happening at this time with the phone, namely device bearing shifts to a westerly direction, as location records also show the device moving west from the roadside towards the house. Isn't that what you had in your report?
MR. WHIFFIN: Yes, that's covered in the location section of this report, the PowerPoint.
MR. ALESSI: So, there is no statement in this timeline, under any type, where you had concluded that at this time the record showed that the device was moving west from the roadside towards the house.
MR. WHIFFIN: Correct. The location latitude/longitude was moving westerly, but at the same time the accuracy was increasing, so it didn't intrinsically prove that the device was moving.
MR. ALESSI: My question, Mr. Whiffin, is straightforward in this sense — I'm just looking for an answer of whether, on this timeline, you included the analysis that you had in your report that the device at this time was moving west from the roadside towards the house. Did you include it in that timeline?
MR. WHIFFIN: No, I left it out of the timeline.
MR. ALESSI: Next entry, 12:27:33. You note that there's a message received from Jen McCabe here — exclamation point, question mark. You see that, sir?
MR. WHIFFIN: Correct.
MR. ALESSI: Now, at this point, you have two people, in just 2.5 minutes — Brian Higgins and Jen McCabe — trying to find out if John is coming to 34 Fairview. Is that a fair conclusion?
MR. WHIFFIN: It appears so.
JUDGE CANNONE: I'll allow it.
MR. ALESSI: Is that a fair conclusion?
MR. WHIFFIN: It would appear so.
MR. ALESSI: So, just because of the colloquy that occurred, I want to repeat the question. Now, at this point, at 12:27:33, you have two people — Brian Higgins and Jennifer McCabe — in just 2.5 minutes, trying to find out if John is coming to 34 Fairview.
MR. BRENNAN: Objection.
JUDGE CANNONE: Sustained. Ask it differently.
MR. ALESSI: Thank you, your honor. Now, at this point, you have two people trying to find out if John is coming to 34 Fairview.
MR. WHIFFIN: Correct.
MR. BRENNAN: Objection.
JUDGE CANNONE: Sustained.
MR. ALESSI: Mr. Whiffin, in terms of the information at this stage, there are two communications with Mr. O'Keefe on this phone — excuse me, I'll rephrase it — there are two communications, one from Jennifer McCabe and one from Brian Higgins.
MR. WHIFFIN: Correct.
MR. ALESSI: Now let's go to the next deck, 80, please, Mr. Woll. This is 12:27:45 — device unlock with Face ID.
MR. WHIFFIN: Correct.
MR. ALESSI: And then right under that is 12:27:48. It says read message, which it says here. And is it correct that that is the message that was sent by Jennifer McCabe?
MR. WHIFFIN: Correct. I'd just like to point out — it says "read" message, not "read" message. "Read" message.
MR. ALESSI: Thank you. And that the fact that Jen McCabe sent that message and that it was read was not indicated in your timeline at this point.
MR. WHIFFIN: Correct. Sorry, repeat that question.
MR. ALESSI: Yes, you did not. It does not appear in that timeline that you've drafted that the message that was read was from Jennifer McCabe. Is that correct?
MR. WHIFFIN: Correct.
MR. ALESSI: Next entry, 12:27:50 — device locked with lock button. Next entry down, 12:29:37 — Doppler pocket state. And I want to be clear: does Doppler pocket state mean that someone takes an iPhone — because up above there's a read message we went through at 12:27:48, so if somebody reads the message and then it goes at 12:29:37 into Doppler pocket state, does that mean someone has for example, put it in their pocket?
MR. WHIFFIN: No.
MR. ALESSI: What does it mean that it's a pocket state?
MR. WHIFFIN: So, the only times that I was able to cause a pocket state to be recorded is when the camera was blocked and when the device received a phone call or was picked up in a particular way so that the device thinks that you're about to try to use it. If the camera is not blocked from the outset, then nothing's recorded at all. And in order to get the pocket state cleared, the camera must be blocked to begin with. So again, you have to receive a phone call with it in your pocket and remove it in order to ...get a pocket state cleared.
MR. ALESSI: Thank you. Because that helped me, because that's exactly where I was going with the next question, which is pocket state cleared. What did you conclude from 29:37 to 29:42 — that it was in pocket state and then pocket state cleared?
MR. WHIFFIN: There was some activity on the device that caused the pocket state to be checked. The device was in a pocket state up until 29:42, uh, when whatever was obstructing the camera was removed.
MR. ALESSI: Next entry is a call at 12:29:44, and that you state is an incoming call from Jen McCabe. So there you do indicate the name, and you say answered 7 seconds. Correct.
MR. WHIFFIN: Correct.
MR. ALESSI: Is the phone at this time — that there's an incoming call from Jen McCabe that is answered — out in front of 34 Fairview?
MR. WHIFFIN: Uh, yes, it would be, according to the location data.
MR. ALESSI: Right. So now we have at 12:29:44 the phone's out in front of 34 Fairview. There's an incoming call from Jen McCabe. It's answered. 7 seconds is how long the duration of the call was. Is that correct?
MR. WHIFFIN: Correct.
MR. ALESSI: And then 12:29:51 incoming call ends, and that's that end of that second 7-second duration. Correct.
MR. WHIFFIN: Correct.
MR. ALESSI: So you've concluded that this was a call that was indeed answered by the user of the phone. Correct.
MR. WHIFFIN: Correct.
MR. ALESSI: Now, let's go to, um, Mr. Woll, 81, which is starting... ...up at the top of 12:31:47. There is, as you indicate, an iMessage received from someone with a contact named Jen McCabe. You see that, sir?
MR. WHIFFIN: I do.
MR. ALESSI: Can you just state for the jury what an iMessage is?
MR. WHIFFIN: An iMessage is essentially a text message sent primarily from iPhone to iPhone via the Apple servers, not like an SMS message which goes through carriers.
MR. ALESSI: Is it correct that the message that was received from Jen McCabe — from a contact Jen McCabe — says "pull behind me"?
MR. WHIFFIN: Correct.
MR. ALESSI: And then at 12:31:52 we're back to Doppler pocket state. Correct.
MR. WHIFFIN: Correct.
MR. ALESSI: Now let's go to the next entry, which is deck 82. It's under health type. And what I... ...want to do is see if we can clarify — the Commonwealth on direct examination and multiple times referred to this as "healthcare data." Do you remember hearing that "healthcare data" term?
MR. WHIFFIN: I do.
MR. ALESSI: Is that a correct term? Is it "healthcare data" or is it "health data"?
MR. WHIFFIN: It's "health data."
MR. ALESSI: So it's incorrect to refer to this as "healthcare data." Correct.
MR. WHIFFIN: Health care data is encompassed within Apple Health, but primarily if we're talking about steps being taken, it would just be "health data."
MR. ALESSI: Right. So the correct parlance is "health data." Yes. Correct. Particularly when we're getting to steps. Is that correct?
MR. WHIFFIN: Correct.
MR. ALESSI: It's important to be precise... ...about the parlance.
MR. WHIFFIN: Yes.
MR. ALESSI: So in this entry at 12:31:56, you state that there's the start of a health event, quote, "36 steps / 25 m." Correct.
MR. WHIFFIN: Correct.
MR. ALESSI: Is it accurate to say that because we're in the United States and we don't work on the metric system, that 25 m is about 84 feet? Are you able to make that calculation?
MR. WHIFFIN: It's approximately that. Yeah.
MR. ALESSI: Right. Would you accept approximately 84 feet? So, as we discussed — meters, we can go to feet — about three times 25.
MR. WHIFFIN: I would accept approximately three times 25. Right.
MR. ALESSI: So, in your report of March 2025, isn't it correct that for this time, you stated that the device began moving for a period of 20 seconds.
MR. WHIFFIN: Correct. Uh, yes.
MR. ALESSI: So again, your conclusion from your analysis is: with these 36 steps the device at this point began moving. Correct.
MR. WHIFFIN: Correct.
MR. ALESSI: Next entry: 12:32:03 pocket state cleared. Correct.
MR. WHIFFIN: Correct.
MR. ALESSI: So does that mean that there's some human activity going on — interaction with the phone — or not?
MR. WHIFFIN: It could have been a received phone call. It could have been movement of the phone, to be lifted, but something has happened.
MR. ALESSI: But something's happened.
MR. WHIFFIN: Yeah.
MR. ALESSI: Next: 12:32:04 device unlocked with face ID. Correct.
MR. WHIFFIN: Correct.
MR. ALESSI: And then at 12:32:05 it states "application focus messages." Yes. Can you clarify what that means in terms of what is happening with... ...the phone, for the jury?
MR. WHIFFIN: Yep. So at 32 minutes and 5 seconds the messages application was in focus on screen. So it was the application that was being used by the user at that time.
MR. ALESSI: Now the next entry is message 12:32:06 and it states read message, "pull behind me." Correct.
MR. WHIFFIN: Correct.
MR. ALESSI: Now, you don't indicate who that message is from in your timeline, but that's the message that was sent by Jennifer McCabe at 12:31:47. Correct.
MR. WHIFFIN: Correct.
MR. ALESSI: Next entry is application lock at 12:32:09. And you've got here "end application focus." And then you say device lock with lock button for the last time. Correct.
MR. WHIFFIN: Correct.
MR. ALESSI: So... ...that's again pressing the side button on the iPhone that locks it. Correct.
MR. WHIFFIN: Correct.
MR. ALESSI: And that requires human conduct, human interaction with the phone. Correct.
MR. WHIFFIN: Correct.
MR. ALESSI: And then the next entry under health data at 12:32:16 — that is 7 seconds after the lock — it's the end of the health event of 36 steps, 25 m, and as we agreed, approximately 84 feet. Correct.
MR. WHIFFIN: Correct.
MR. ALESSI: So in terms of the steps, I want to turn to some further information with regard to your previous — the report that you mentioned on direct, which is the March 2025 report. Your honor, your honor indicated a time for the break and I'm going to go... ...into a little bit of a different area. Would you like me to keep going?
JUDGE CANNONE: All right, Mr. Alessi. Um, folks, we'll stop. Turn on lights, please. Thank you. Mr. Whiffin, we need you back here. All right, jurors, we're going to recess for the day. Please do not discuss this case with anyone. Don't do any independent research or investigation into the case. If you happen to see, hear, or read anything about the case, please disregard it and let us know. And please be very careful with your social media. All right, we'll see you tomorrow morning. I'll see counsel at sidebar.