Digital Forensics Expert: Phone Data Could Crack Nancy Guthrie Kidnapping Case
A digital forensics investigator who analyzed Bryan Kohberger's phone in the Idaho murders case believes similar tactics could be crucial in identifying the abductor of Nancy Guthrie, the elderly mother of Today show host Savannah Guthrie.
How Turning Off a Phone Creates a Digital Clue
While criminals often know to turn their phones off when committing offenses, they are frequently unaware that this very action can become a major clue for law enforcement. Special agents from the FBI's Cellular Analysis Survey Team (CAST) are now meticulously trawling through cell tower data from a wide area around Nancy's Tucson, Arizona home.
"You have to know what normal is to find evil, and this person's phone would be considered the evil," said Heather Barnhart, an expert with Cellebrite and the SANS Institute who worked on the Kohberger case.
Investigators are building a picture of historically normal cellular activity and searching for anything abnormal, such as phones being turned off and then on again during the early hours of February 1, when the kidnapping occurred.
The Critical Timeline and Evidence
Nancy Guthrie, 84, was taken from her home between 1:47 am, when her doorbell camera was disconnected, and 2:28 am when her pacemaker app dropped from her phone. Drops of her blood were found on the front porch, and recovered footage from her Nest doorbell camera showed an unidentified masked suspect standing at her front door.
Barnhart explained that investigators have all the cell phone tower data and are methodically examining which devices entered the area that night, then looking at 'pings' when they leave. They have particular interest in phones showing driving patterns away from the scene, especially if they are not local numbers.
Lessons from the Bryan Kohberger Case
In the Idaho murders case, Kohberger entered 1122 King Road at 4 am where he murdered four university students. His phone, which Barnhart analyzed, was off between 2:54 am and 4:48 am.
"If you think about Bryan Kohberger, his device was turned off, so the tower right near King Road probably wouldn't have picked that up at all," Barnhart said. "But when he left, he turned it on, because most people rely on their phones for navigation."
She added: "Unless these people (Nancy's abductor) knew exactly where they were going their phone will be off and then suddenly ping. So, not just cell towers right by Nancy's home, but take it a few miles out, spread out and look."
The Importance of Reconnaissance Patterns
There is also the possibility that Nancy's kidnapper conducted reconnaissance at her house, which would significantly help digital forensic investigators. Police have already asked neighbors to check their home security systems for suspicious people and vehicles going back to January 1, a full month before the abduction.
"If the person ever scoped out the house in advance, is there an unusual ping to towers?" Barnhart questioned. "So, look at normal behavior. If we live in the same neighborhood, our phones are going to constantly ping that tower. Which ones are outliers?"
She cited an example of a robbery where the only reason law enforcement found the culprit was cell phone tower data showing he had made multiple visits to the area before and after the crime.
Challenges and Advantages in the Investigation
Barnhart emphasized that digital forensics requires patience: "Digital forensics isn't always exciting, and looking through the normal can be really monotonous and take a long time. People, I think, want answers immediately, and I get it, but it's hard to do digital forensics thoroughly."
The process depends on how many towers and phones are in an area. The rural nature of Nancy's home could make the investigation easier than a crime in a densely populated area, though cell service near her home is reportedly poor.
"Cell service isn't good, but even if your cell service isn't good, you could be pinging other towers and your phone's constantly beaconing out," Barnhart explained. "So we need to capture anywhere that those beacons exist to see what is normal and what is not."
Criminal Misconceptions About Technology
While criminals are becoming wiser about how technology can retroactively track them, investigators remain a step ahead. Some criminals still don't realize their phones continue to 'ping' cell towers even when in airplane mode.
"It's a stupid choice by criminals putting your phone in airplane mode, you're still pinging," said Barnhart. "It's still beaconing out so it would have to be completely powered down not to make a ping."
She noted that Bryan Kohberger not only powered his phone down but turned off Wi-Fi and cellular before shutting it down completely. "But that deliberate activity by Kohberger proved intent," she said. "In Idaho, that's how we knew. There is this gap of information where there are no phone pings from his device. It's weird. Him powering off his phone gave us the perfect bookend of his crime."
The Best Hope for Identification
As examiners continue through the tower data, it may represent the best hope for identifying Nancy's abductor. Barnhart expressed confidence in modern investigative methods: "I think this is probably the best chance, in addition to license plate readers and other people's cameras catching footage of cars passing by."
"There's not a perfect criminal out there. Bryan Kohberger thought he was, and clearly we saw he was not," she concluded. "Everyone has cameras. License plate readers are everywhere. So unless you're using a flip phone, you've never touched technology, you enter a house that doesn't have cameras, and you're doing it on foot or horseback, you're going to be found."
She offered reassurance to the family: "It may feel to the family like they're chasing the impossible, (but) with digital, people will be found. There's infinite amounts of data to keep thinking through."
