Police Blotter: Web searches lead to murder conviction

A San Francisco Bay Area man who gunned down a mother walking with her four-year-old child was convicted in part based on his Web searches for handguns, silencers, and videos showing real-life murders.

Declan McCullagh Former Senior Writer
Declan McCullagh is the chief political correspondent for CNET. You can e-mail him or follow him on Twitter as declanm. Declan previously was a reporter for Time and the Washington bureau chief for Wired and wrote the Taking Liberties section and Other People's Money column for CBS News' Web site.
Declan McCullagh
5 min read

Police Blotter is a regular CNET report on the intersection of technology and the law.

What: California man appeals his murder conviction, saying incriminating Internet searches should not have been introduced as evidence.

When: State appeals court rules on February 5.

Outcome: First-degree murder conviction upheld.

What happened, according to court documents and other sources:
On October 19, 2006, Alia Ansari was walking with her four-year-old daughter to pick up her other children at Glenmoor Elementary School in Fremont, a city in the San Francisco Bay Area.

At approximately 2:30 p.m., witnesses heard a gunshot-like noise, followed by a child screaming. Ansari was found dead with a gunshot wound to the face, with her daughter weeping by her side.

Besides the daughter, there were no other witnesses to the actual shooting, but three witnesses saw a man run to an older black Toyota and speed off.

Police stopped a car matching that description driven by Manuel Mares within half a mile of the murder, less than 10 minutes after the shooting. Ansari's daughter initially said she recognized Mares as the shooter, but made inconsistent statements later, including that she did not know the difference between a truth and a lie.

Laboratory tests found gunshot residue on gloves recovered from Mares' car and on his T-shirt and pant leg. But no gun, silencer, or ammunition was ever found, even after a search of his residence.

What makes this case relevant to Police Blotter is the forensic examination of the computer that was seized from Mares' home.

On October 8, less than two weeks before the shooting, the forensic analysis suggested that Mares conducted Web searches with phrases including "firearms," "anarchist cookbook," "make silencer," "handgun," "homemade silencers," and "how to make silencer."

Mares also visited a Web site showing how to make disposable silencers, and, three days later, searched on the site FortLiberty.org for information about silencers, body armor, and explosives. (Today, at least, FortLiberty.org features commentary from a broadly conservative, pro-Second Amendment perspective.)

On October 15, four days before the shooting, Mares searched for the phrase "Faces of Death" and apparently ended up at FacesOfDeath.com, which sells DVDs advertised as the most "bizarre and grisly death scenes ever recorded." He looked at descriptions for Faces of Death III ("blood and guts on the German Autobahn") and Faces of Death IV ("a Columbian wedding party that turns into a bloody massacre").

Searching for information on handguns and firearms is, of course, perfectly legal; no less an authority than the U.S. Supreme Court has ruled that the Second Amendment protects an individual right to keep and bear arms. Even silencers are legal to own in a majority of states, although they're strictly regulated by the Bureau of Alcohol, Tobacco, Firearms, and Explosives. Possessing them legally requires an application process, fingerprinting, a background check, and a special federal tax payment.

Mares claimed that the trial court should not have allowed evidence of his Internet searches to be admitted as evidence, arguing that there was no proof a silencer was used and the Web logs were unfairly prejudicial.

In a ruling February 5, the California Court of Appeal (First District) disagreed, and upheld Mares' sentence of 53 years to life for first degree murder.

As computer forensics becomes commonplace, Web searches reconstructed from seized computers have begun to appear in more criminal prosecutions. In a similar case in January 2009 that Police Blotter covered at the time, Google searches related to gunshot wounds were used to secure a murder conviction. They were invoked in the case of a San Francisco area investment banker who claimed he believed he killed a deer instead of a person.

Police Blotter has chronicled a 2006 case involving a wireless hacker ("how to broadcast interference over Wi-Fi 2.4 GHZ") and a 2008 case involving a woman convicted of murdering her husband ("decomposition of a body in water"). Searches in a 2005 murder case included "neck," "snap," and "break."

By default, Web browsers store information about what Web sites users have visited and what searches they conducted. Firefox, for instance, stores the information here under Windows:
\Documents and Settings\[user name]\Application Data\Mozilla\Firefox\Profiles\[random text]\history.dat

Once that browser history file is located, Web activities can be reconstructed using a program like ODESSA (The Open Digital Evidence Search and Seizure Architecture), the SANS forensic toolkit, or Guidance Software's EnCase Forensic.

If you're interested in sweeping away your electronic tracks, CNET's Download.com features utilities like Webroot Window Washer and R-Wipe and Clean. Most browsers feature some method of erasing the history--but a skilled examiner may, of course, be able to reconstruct deleted files that are not overwritten.

Excerpts from the opinion of the California appeals court:
The day before the shooting, on October 18, an Hispanic male driving a car similar to defendant's fired five or six shots at a DHL van driven by Rodney White. This shooting also occurred in Fremont. White chose two pictures from a photographic line-up, one of which was defendant's. White, who owned many guns, testified that the shots sounded like they came from a weapon smaller than a .357 or a .44...

Defendant contends the trial court erred by admitting evidence of his Internet searches for firearm silencers. He claims there was no evidence the shooter used a silencer and admission of the searches was therefore prejudicial...

There is no issue of admitting evidence of a particular type of silencer in contradistinction to evidence of a different type said to be used in the crime. Here, the evidence was of searches for silencers in general. This evidence was relevant because, contrary to defendant's claim on appeal, there was evidence to suggest a silencer was used to kill Alia Ansari. Several witnesses heard a popping noise, as opposed to a gunshot. And White, whom defendant shot at the day before the killing, testified the gun sounded like a smaller caliber than the type of weapon actually used in the killing. This suggests the possibility that the weapon used by defendant was quieter than it should have been--because defendant was using a silencer.

Defendant does not formally challenge, with citation to specific applicable authority, the admissibility of the evidence that he viewed the "Faces of Death" videos. This was improper character evidence and should not have been admitted. But any error is harmless...

Thus, defendant's Internet searches for silencers in the weeks before the killing were pertinent to his state of mind regarding premeditation and deliberation, and evidence of the searches was properly admitted.