Philip Polkinghorne murder trial: IT experts at odds over Pauline Hanna’s 4am phone data
WARNING: DISTRESSING CONTENT
For a second day in a row, defence lawyer Ron Mansfield and police digital analyst Jun Lee were in a standoff.
Mansfield - representing eye surgeon Philip Polkinghorne, now nearing the end of seventh week of his high-profile murder trial - tried to convince the witness that Pauline Hanna, 63, could have been using her iPhone around 4am on the morning she was found dead. Lee said it simply wasn’t possible.
Mansfield tried again. And again. He received the same response.
“I think I explained that numerous times,” Lee said at one point. “If someone was drafting a message at that time, there has to be a trace of at least that application getting opened.”
By the time lawyers had exhausted their questions of Lee early in the afternoon, the disagreement was no closer to resolution than it had been when Lee first entered the witness box two weeks ago.
STORY CONTINUES AFTER BLOG
Trial adjourns for the day
Vera Alves
Justice Graham Lang has called it there for the day.
Academic psychiatrist David Benjamin Menkes will continue giving evidence tomorrow at 10am.
Hanna had 'whole array' of suicide risk factors the night of her death – defence psychiatrist
Vera Alves
Academic psychiatrist David Benjamin Menkes says it looks like Hanna was having the sleeping aid Zopiclone regularly in the six months before her death, which is "really significant".
He says Zopiclone is prescription-only for a good reason, because it's habit-forming and has a number of possible negative effects, including depression, and a strong interaction with alcohol. People who drink and take Zopiclone are generally more intoxicated than they would be with either Zopiclone or alcohol alone.
Menkes says her GP didn't know about this, and the Zopiclone wasn't supplied by the GP, which conferred a "significant risk of harm".
Mansfield asks what he means by Zopiclone's disinhibiting effect.
Menkes says it refers to behaviour that's normally kept under control or under wraps. That can be positive, like friendliness, or very much the other way in terms of irritation or aggression.
We see that most commonly in this country when people have too much alcohol at the pub, with loud voices and alcohol, he says.
"And sometimes fisticuffs will follow."
What about the impact of a number of nights of poor disrupted sleep, and the drugs and the alcohol? Mansfield asks.
Menkes says the combination would have increased the risk, but whether they had that effect is not possible to say.
As risk factors they would be additive, or even more than additive, he says.
Menkes says the other complicating factor was the fluoxetine, which for some people can increase alcohol intoxication.
"It's like another wildcard in the system," Menkes says.
"It's a whole array of different risk factors which were in combination."
Risk factors in Hanna's personality as well as sleep patterns
Vera Alves
What about sleep deprivation, does that create a risk factor when it comes to depression, anxiety and suicide? asks defence lawyer Ron Mansfield.
Academic psychiatrist David Benjamin Menkes says that absolutely, disturbed sleep is both a symptom of those disorders as well as being an aggravating factor in making them worse.
"It's like a vicious circle," says Menkes.
A particular link has been found with suicidal thinking being increased with seriously disturbed sleep, even just for one night.
In the week before her death, her sleep pattern was very disrupted, which would have contributed to her mood, says Menkes.
What about the loss of someone close to her, does that create a greater risk of suicide? Mansfield asks.
It can do, but not always, and less so when the death is anticipated, says Menkes.
He says her mother died a couple of months before Hanna's death and the death was not unexpected, given her mother had advanced dementia.
"Nonetheless, it's a big event to lose a parent," Menkes says, and the effect on the individual will vary.
Mansfield refers to evidence from her sister Tracey Hanna recounting Pauline describing having attempted suicide in the early 1990s, a disclosure the prosecution says is not supported by medical records or other witneses.
We don't know whether she made an attempt or was just conveying that she was very, very distressed about the loss of her father, says Menkes.
Menkes says the loss of her mother, combined with all the other issues, would be best interpreted as a "combination of risk factors that coincided".
Do we need to include her sensitivity about her weight and appearance with the other risk factors? asks Mansfield.
People with perfectionistic personalities are especially sensitive to embarrassment or humiliation, says Menkes.
'Particularly striking' contrast between Hanna's public and private perceptions – psychiatrist
Vera Alves
Defence lawyer Ron Mansfield asks if stressors in relationships are a factor that can lead to a higher risk of suicide?
Yes, says academic psychiatrist David Benjamin Menkes, also agreeing work stressors are another factor.
"She certainly had plenty of work stress," working long hours, says Menkes. He qualifies that by referring to reports from colleagues she was coping and doing a good job.
People that suffer from depression and anxiety, can they always be expected to disclose that to people they work with? Mansfield asks.
No, and Menkes says this is a clear example of the different sides of that coin. There's plenty of evidence Hanna was performing to a high level and, outwardly, that seemed to be all good. But to several individuals close to her, she also disclosed the fact she was struggling and at one stage felt bullied, burned out and stressed in the workplace, and was having doubts about her performance.
"A real contrast between the public and the private perceptions," he says.
"In her case it was particularly striking."
Menkes says the thoughts of suicide would have been variable over time, and not present all that often. But they occurred repeatedly, he says.
Menkes says he doesn't believe Hanna had a serious depressive illness per se, which would be associated with a dishevelled appearance and a loss of function. But you don't need one to attempt suicide, Menkes confirms.
Vera Alves
During this evidence, Polkinghorne has his head in both of his hands and is looking down at the bench where he is sitting.
Hanna had not seen a GP in more than two years
Vera Alves
Academic psychiatrist David Benjamin Menkes says Naltrexone is meant to reduce the craving for alcohol.
Antabuse is an aversive medication, when people are trying to quit altogether, Menkes explains.
In 2013, a doctor recorded Hanna reported she had been drinking a bottle of wine a night for the previous 10 years, and had experienced repeated blackouts.
Menkes says the combination of factors were fairly convincing evidence for an "alcohol use disorder, with dependence" – i.e. alcoholism, when people have a hard time stopping, and drink most days.
With Naltrexone, she was able to reduce her drinking and was pleased about that. But in 2013, a doctor found controlled drinking wasn't working, so prescribed Antabuse.
There's another note about her drinking in March 2019, saying it was above the recommended limit and was of clinical concern.
Around Christmas 2019, Hanna phoned her GP crying, saying her mother was in hospital and her husband had left her, and she was having suicidal thoughts.
Mansfield asks if Menkes is aware of crisis team reports in which Hanna said over the phone she had considered driving into an oncoming truck. He was, and confirms there was no follow-up from her medical practitioner, checking she had gone to a psychologist.
The last time her GP had seen her in person was January 2019. She did not see a GP again in the 26 months leading up to her death.
Given the continued requests for scripts for the medications discussed, what can you say about the follow-up care?
"Well, it seems like there wasn't enough of it, given the problems that she had," Menkes says.
Vera Alves
Academic psychiatrist David Benjamin Menkes is now moving on to the other drug Hanna was taking, with the trade name Antabuse, says Mansfield.
Menkes says that was only prescribed twice, in 2013 and 2014.
That was in relation to the treatment of alcohol abuse, Menkes confirms.
A doctor had made the decision to move her from Naltrexone to Antabuse because controlled drinking was no longer the goal, and she was recommended to attempt abstinence from alcohol.
In 2004, a dose of Prozac was increased from 20mg per day to 40mg per day, Menkes confirms, for several years, before it came back down to 20mg.
In 2004, there's a record saying "severe depression, lots of relationship strife".
In 2011, the dose was reduced to 20mg per day, the trial hears.
Other than the referral in 2019 to the crisis team made by her GP after Hanna expressed suicidal thoughts, there's no record of her seeing any other outside psychiatrist or counsellor about her apparent suicidality?
Menkes says as far as he's aware, that's correct.
Back to Duromine/phentermine. Records show a continuing concern about her weight from 2001, Menkes says.
Was she ever referred to anyone to assist her with her views regarding her weight? asks Mansfield.
Menkes isn't aware. Her weight varied between 60kg and 70kg, within the normal range, says Menkes.
Was she always weighed from the medical notes you saw?
No, says Menkes, but his understanding is she had always been of normal weight.
On April 29, 2013, there's a reference from a psychiatrist recommending she receive counselling due to her use of phentermine, but there's no evidence of that happening, the trial hears.
The indications for prescribing phentermine were "pretty thin", Menkes says.
If a patient continues asking for it despite no therapeutic need, what should be the response? asks Mansfield.
A plan should be made to discontinue the drug with counselling support, the witness says.
Menkes says her interest in maintaining a healthy weight, just like her dress sense and self care, were all pointing in the direction of her being concerned about her appearance. Her use of weight-loss medication was helping with that.
Menkes adds she would have stayed on Duromine/phentermine because she would have developed a tolerance and would have had withdrawals if she stopped taking it.
Psychiatrist discusses Hanna's history with prescription medication
Vera Alves
Academic psychiatrist David Benjamin Menkes has produced a report for the court, including a summary of Hanna's medical history.
From October 24, 2001, to the date of her death, Menkes identified medications she was prescribed.
He talks about Prozac, full name fluoxetine hydrochloride – Hanna had 67 scripts for that over 20 years, taking it consistently over that period.
Fluoxetine is one of the SSRI anti-depressants, or Selective Serotonin Reuptake Inhibitors. It's been around since the late 1980s as the prototype SSRIs. It's reasonably well-tolerated and moderately effective for both depression and anxiety, Menkes says.
Hanna was referred several times to a psychiatrist, but only ended up seeing one three times in 2013. She had been referred before that, but there's no record of her attending, Menkes says.
If someone is receiving Prozac, should a psychiatrist be involved? asks Mansfield.
It depends on the patient, says Menkes. Sometimes one is required but sometimes a patient is fine with primary care.
On to phentermine, which Hanna also took. It's an appetite suppressant. Hanna received 55 scripts of that medication, starting at the end of 2010.
It's a restricted medication with significant side effects and is subject to abuse. It is only to be used as part of a weight management programme for people who are seriously overweight, which she wasn't, and for a maximum of three months, Menkes says.
Phentermine is an amphetamine, which are appetite suppressants but can keep people awake and produce a degree of mood instability, he says.
Menkes says people might find they get a bit grumpier in response to irritation and frustration. But equally, amphetamines can make people seem positive and full of energy.
"They make people feel good, at least in the short term."
How do Prozac and Duromine (the brand name for phentermine) interact? asks Mansfield.
Menkes says he doesn't believe there's a fixed or established pattern for their interaction. It's also not uncommon to take them together, he says.
Would a depressed and anxious person taking Prozac and duromine together have any adverse effects? asks Mansfield.
Menkes says a lift in mood might not last very long. People might also be more likely to become anxious and agitated when they're on amphetamines, Menkes says.
Defence calls new witness
Vera Alves
Defence lawyer Ron Mansfield has called David Benjamin Menkes.
He's been waiting to give evidence since Friday and Mansfield apologises for the inconvenience.
As with all expert witnesses, Mansfield is producing his CV, and will go through it.
Menkes is a middle-aged man with an American accent, wearing a black velvety coat.
He's an academic psychiatrist, living in Raglan.
Menkes graduated from the Yale School of Medicine in 1982.
He's maintained a long interest in drugs and their mechanism of action, having completed a PhD in pharmacology at Yale.
Since 1989, he's worked as a consultant psychiatrist in the UK and New Zealand.
Menkes has a professional interest in anti-depressants, anti-psychotics and hypno-sedatives, i.e. anti-anxiety and sleeping drugs.
He's published over 160 peer-reviewed scientific papers, the jury hears.
He's participated in government advisory committees with Medsafe and Pharmac.
His expertise relates to the adverse affects of drugs and their interactions with each other and with alcohol, he confirms.
Vera Alves
Defence IT expert Atakan “Artie” Shahho was asked what the difference is between the data you'd get from Cellebrite versus the raw data.
"When you break a phone open, you lose data," Shahho says.
The court earlier heard that Cellebrite and GrayKey, another tool used to get into and extract data from phones, can cause the loss of data in parts of the phone.
Questioning continues regarding Hanna's phone log data
Vera Alves
Defence lawyer Ron Mansfield is back on his feet for some more questions. Defence IT expert Atakan “Artie” Shahho's phone keeps beeping through the video-link.
"I need a good computer technician," he jokes.
He then explains that his iPhone has a setting whereby messages from his family bypass the silent mode on his phone.
Mansfield then refers to the continuation of the Cellebrite report, recently disclosed to the defence by the police. It starts late on the morning of April 5, 2021.
There are entries drawn from Hanna's phone from 11.55am to 8pm on April 5.
You've confirmed you would expect emails and iMessages to still be coming through to the phone, but those aren't user initiated, correct? Mansfield asks. So is there any device event log entries included within any of that data by way of a log entry?
Shahho says he believes he saw one log entry for a calendar appointment, for 8pm.
Is there any device event log entries recorded in it? asks Mansfield.
"Not that I can see," says Shahho.
So we don't see the screen come on, go off, or move? asks Mansfield.
No, says Shahho.
The point of this is that Mansfield produced a photo showing the screen had been turned on about 5pm on April 5. There's no corresponding entry in the logs, says Shahho. Similarly, there were no device logs showing the screen coming on when the defence says the messaging app was used about 4am. This was seized on by police as evidence against the defence theory, but Shahho says the absence of 5pm logs shows there are gaps in the data.
Is there any data that you don't have access to as far as you're aware? asks Mansfield.
That's hard to answer, because he doesn't know what else police have, beyond the Cellebrite extractions, says Shahho.
Vera Alves
Crown prosecutor Alysha McClintock refers the witness, defence IT expert Atakan “Artie” Shahho, to another email, sent by Pauline Hanna to colleagues around the same time.
It was sent on the evening of April 14, 2020. In fact, seven minutes beforehand, McClintock says.
Did this email come up in your search?
Shahho says he doubts it, because it's a work email, and doesn't include the search terms he used.
McClintock says it includes a discussion about masks and PPE equipment.
The email from Hanna to a colleague, project manager Sharon Alabastro, says: "Dear Sharon I know but the second one is not N95." Hanna managed logistics for the Covid response in Auckland.
It appears there's an issue with PPE at this time, says McClintock.
That's all for McClintock's cross-examination of Shahho.
Crown resumes cross-examination of defence's IT expert
Vera Alves
Auckland Crown solicitor Alysha McClintock resumes her cross-examination of defence IT expert Atakan "Artie" Shahho, who is appearing via video link on the five screens here in Courtroom 11.
Shahho confirms he's been sent 26 pages via email.
McClintock says she and Mansfield have reached an agreement as to how to handle these emails.
Shahho says he chose a number of wellbeing-related words to search her emails, like depressed, God and help, to come up with a number of emails that he then presented to the court. To recap – one was a despairing email she sent herself a year before her death about the difficulties of her role in the Covid response.
McClintock asks if he has a captured record of his search terms. He does not.
"I've got a very good memory. I work off my memory all the time," says Shahho.
To recap, here's the email, read to the court a couple of days ago. It was sent on April 14, 2020:
“I am never good enough despite my efforts - today is the 25th day in a row - but I am not adding any value,” she wrote. “I want desperately to tell someone and cry and ask for help but everyone seems to think I’m amazing and does not want to know that I have foibles and failings.
“I have tried to bring up with Philip but he tells me he hasn’t got time to go over the negative tonight = he has enough. I must stand on my own two feet but I don’t know today if I have two feet or what they look like.
“So I have had 3 glasses of wine and a beautiful dinner thanks to PJP - but I don’t know what to do with myself.. So I will go to bed and not sleep. V. unusual for me - and it builds up - who knows what might follow. Have to tell someone even if no- one but God ever sees this.”
Trial about to resume
Vera Alves
Court is about to resume. Members of the public are filtering back in.
Crown and defence disagree on Hanna's phone log data – What does it all mean?
Vera Alves
If you're asking what all this technical back-and-forth is about, you're not alone.
It all boils down to the two contacts Polkinghorne's defence team say Pauline Hanna looked up and selected about 4am on the morning of her death, April 5, 2021.
The defence IT expert Atakan "Artie" Shahho says this means she would have at least selected the contacts from within the messaging app, and possibly also drafted and then deleted messages to them. They were her husband and the daughter of a family friend.
The police digital forensic analyst Jun Lee says the defence has misinterpreted an automatic security look-up procedure to suggest the phone's messaging app was used. In fact, it was an automatic background security process. We know that, says Lee, because there are no corresponding device logs showing the phone being moved and switched on.
To counter that, Shahho and the defence have said the device log data also does not show any logs on the afternoon of April 5, when a police photo of the scene clearly shows Hanna's phone screen having been switched on. As a result, Shahho has begun today questioning the accuracy of the data logs police relied on. The prosecution says Shahho has not seen the raw data, just the data from Cellebrite, the tool used to analyse the phone.
Crown presses defence witness on phone logs
Vera Alves
Can you point us to device event entries that sit behind the logs from April 5 demonstrating how somebody got into the phone in order to start to type something? asks Crown prosecutor Alysha McClintock.
"I would have to go in there and pull out the database and extract all the data and put that into a table," says defence IT expert Atakan “Artie” Shahho.
"So the answer's no?" asks McClintock.
Not right now, says Shahho.
"There's holes in the reports," he says.
You're not saying anything was typed and deleted, are you, you're just saying messaging was opened and a number selected? McClintock asks.
Shahho says that if the content of the text field was entered and removed, it wouldn't have saved.
Mansfield has an issue with the next topic McClintock wants to ask about, the prosecutor tells the trial.
So we are taking the afternoon adjournment early and there'll be a discussion in chambers about that.
Pauline Hanna's phone data 'doesn't make sense' – IT expert
Vera Alves
Defence IT expert Atakan “Artie” Shahho is now reading the document he's just been provided. He says it only has information for April 5, from 11am to 8pm.
But that's not the raw data, says Crown prosecutor Alysha McClintock.
Jun Lee, the police forensic analyst, said that the raw data should show someone going into the phone and using it – if someone had indeed used the phone about 4am on April 5, she says.
"And it's not there," the prosecutor says.
Have you ever looked at the raw data? McClintock asks.
In this particular sense, probably not, says Shahho.
"The device logs don't make sense, and that's what I was telling Mr Mansfield earlier," he says.
The chunk of information missing from April 4 to April 8 doesn't make sense, says Shahho.
But you haven't looked at the raw data behind it, have you? McClintock asks. And Lee says the lack of activity in that raw data shows the phone was not opened early on April 5.
Shahho again says he disagrees with Lee's findings.
Vera Alves
Defence IT expert Atakan “Artie” Shahho confirms what he's saying is that someone has gone in to try to send something to the daughter of their family friend, who has suppression, and Polkinghorne, using Hanna's phone about 4am on April 5.
But there are no logs from the raw data of the device being unlocked? asks McClintock.
Shahho says there's nothing from April 4 to April 8.
Have you looked at the raw data? asks McClintock.
I was provided the Cellebrite extractions of which I extracted everything possible, says Shahho.
But McClintock says Jun Lee, the police forensic analyst, has gone beyond the Cellebrite data and looked at the raw data. Have you looked at the raw data? she asks.
The Cellebrite report itself contains the raw data, Shahho says. The information in that data shows the look-ups were done on April 5.
So, asks McClintock, where are the device events that support what you say, showing the phone being unlocked at the time?
This is what I'm trying to say, Shahho says. There's no device information at all from April 4 to April 8. (Earlier, he said he would have expected to see device information from the phone being moved and turned on, on the afternoon of April 5, as police photos show it had been. He then suggested things were missing from the police data.)
Crown questions defence's 'ethical hacker' witness
Vera Alves
Auckland Crown solicitor Alysha McClintock is on her feet.
She says she's arranging for a document to be emailed to the the witness, defence IT expert Atakan “Artie” Shahho, containing a different Cellebrite report.
Cellebrite is the software police use to clone and examine phones.
Where do you work from? asks McClintock.
Shahho says he works from home, having closed his offence around Covid.
How many employees at your company?" asks McClintock.
"Three brothers," says Shahho.
Have you ever worked in forensics in law enforcement? asks McClintock.
Shahho says he's worked in conjunction with the Australian Federal Police relating to taking sex crime material off devices. But he confirms he's never worked directly for a law enforcement organisation.
"When you call yourself an ethical hacker, who do you ethnically hack for?" asks the prosecutor.
For his clients and for people wanting to get into devices they're locked out of, he says.
When you say Pauline Hanna has gone into her phone on April 5, to be clear, you can't say who's used it, just someone was using her phone? asks McClintock.
Shahho says the information he has is that only Hanna had access to her password and phone.
McClintock says no, at one point Polkinghorne told a friend he had access to his wife's passcode.
Pauline Hanna's phone's messaging app opened morning of her death, defence expert maintains
Vera Alves
When the Cellebrite application is used to gain access to a phone, or GrayKey, can that affect a report and its accuracy
Defence IT expert Atakan “Artie” Shahho says when you "jailbreak" a phone, i.e. access it in a not-normal way, things can happen to the data, Shahho says.
"It's an unknown, to tell you the truth, because it changes by the day."
Companies like Apple do not favour companies like Cellebrite, which work to circumvent their security, Shahho says.
The fact the look-up process came from iMessage suggested someone had opened the iMessage app on the morning of April 5, Shahho says.
"The iMessage application won't do it on its own," says Shahho, adding it would be user-initiated.
'Quite peculiar': Defence expert alleges data missing from logs produced by police of Hanna's phone
Vera Alves
Defence IT expert Atakan “Artie” Shahho returns via video link from Sydney.
So in short, asks defence lawyer Ron Mansfield, what do you say to police digital forensic analyst Jun Lee's evidence that there were no other events recorded in the device's log after the evening of April 4, and before April 8?
Shahho says the last entry for April 4 was 10.47pm and there are no device entries until April 8.
"That's quite peculiar," says Shahho.
Mansfield then refers to a booklet of police photos, showing Hanna's phone with its leather cover open and the screen on, about 5pm on April 5.
The phone waking up and receiving text messages – as the photos show it had done – was not recorded in the data logs, says Shahho.
"It perplexes me," says Shahho, because if the device logs are correct, then they should show entries from April 5.
There should also be other logs before April 8, if the records are correct, says Shahho.
Police said Airplane mode was switched on close to the time it was seized, Mansfield says.
Shahho says it only affects data coming in and out, but wouldn't stop the phone recording movement or its display coming on and off.
Shahho again says the lack of an Airplane mode on/off log is "perplexing", given what police said.
Shahho says his point is "there's missing data between the fifth and the eighth [of April]".
Trial about to resume after lunch adjournment
Vera Alves
Court is about to resume with more evidence from the defence IT expert Atakan “Artie” Shahho.
Before lunch, he confirmed it was his view Hanna's phone was used to open and then abandon messages without sending them to two contacts around 4am on the morning of her death, on April 5, 2021. It's a view contrary to that of police digital forensic analyst Jun Lee.
Todd Murray
Court is breaking until 2.15pm.
Todd Murray
Lee says that's not right, Mansfield says: that the 4am log entries are a random process running in the background with no user input.
"I don't agree with that, " says Shahho.
Apple was grilled by the EU about people having access to people's contacts, Shahho says, and the company had to come out and say they weren't doing it.
"It has to come from the user," the witness says.
So the Apple server doesn't just go into our phones and check our contacts, uninitiated by the user? asks Mansfield.
Correct, says Shahho.
Todd Murray
Shahho says the research he's done on Hanna's phone data shows a message was "abandoned" by her phone about 4am on April 5.
So all you're telling us, says Mansfield, is that a valid name or number has been selected, but no text has been entered, and then the message has been abandoned?
Correct, says Shahho.
Todd Murray
So your point, says Mansfield, is if you go into a new message, then the identity look-up service will occur?
"It's invoked, exactly right," says Shahho.
Todd Murray
Shahho says that if he were to pick up an iPhone now, open the messages app and create a blank iMessage, and then put a random number in, he would do a look-up and Apple would come up and see if that's an iMessage-capable number.
If it was, the message would come up in blue, if not, it would come up in green.
Todd Murray
Mansfield takes the witness to an exhibit. It's the two log entries from Hanna's phone on April 5, 2021, reporting the iMessage identity server has been used.
What does that record and tell us? the defence lawyers asks.
Shahho says the identity look-up service is always looking towards the Apple servers. The iMessage application is doing an authentication process on a phone number.
At 4am and 26 seconds, on April 5, iMessage is doing an Apple authentication process, saying the app needs to know the number and needs to confirm it's valid, active and whether it's an iMessage-based service or an SMS service.
The identity look-up service goes and gets that information from the Apple service, the witness says.
So it goes off to Apple, pulls back that information and "essentially gives it the tick of approval", Shahho says.
Todd Murray
Shahho says the Apple systems he uses are in his DNA.
"You get to be very familiar with the back-end," the witness says.
Todd Murray
Shahho says he's a database developer by trade, and does a lot with hardware as well.
Todd Murray
There remains disagreement between the two of them regarding the use of the identity look-up service.
But before that, Mansfield is back to his qualifications.
Shahho confirms he owned the first Apple Mac, released in 1984, and he has used Apples since then, alongside PCs.
Mansfield says police forensic analyst Jun Lee worked for Samsung (whose phones use the Android system, unlike the iOS used by iPhones. Pauline Hanna used iPhones.)
Shahho says Android is completely different.
He confirms he's a registered Apple developer and has been since 2008.
Apple make both the software and hardware and are renowned for being security-conscious. That's why they've got a "cult following" in professions such as law and medicine, Shahho says.
Being a registered Apple developer gives him access to Beta Apple software before it's released to the wider public.
Shahho says he's been using iOS 18 since June, which is yet to be released to the public.
Defence recalls Sydney IT analyst
Todd Murray
Ron Mansfield KC has recalled defence IT analyst Atakan "Artie" Shahho.
Justice Graham Lang tells the jury we'll sit until 1.15pm.
Shahho is appearing from Sydney via video-link.
"Welcome back," says Mansfield.
Shahho confirms he's observed the evidence of Jun Lee yesterday and today.
Todd Murray
No further questions from the Crown.
"Thank you Mr Lee, you'll be relieved to know that concludes your evidence. Unplug your computer and you're free to step down," says Justice Lang.
Todd Murray
If Hanna went into the phone and unlocked it in order to use it, would there be a record of her unlocking the phone and going into the app? McClintock asks.
Lee says yes, there would be a few logs resulting from that step.
Are there any device events in the raw data to support the phone being unlocked or used (early on April 5, as alleged by the defence)? asks McClintock.
No, says Lee.
In your view, has Airplane mode got anything to do with how we interpret the identity look-up service data? McClintock asks.
No, says Lee.
You were asked about your qualifications, says McClintock, do you hold a degree?
Yes, says Lee, he has a Bachelor's Degree in Computer Information Systems, majoring in computer and network security.
Crown questioning 'just a few matters'
Todd Murray
Auckland Crown solicitor Alysha McClintock is on her feet and says "just a few matters from me, you'll be pleased to know".
The background service, does it sometimes marry up with when a message is sent, and sometimes not? asks McClintock.
Yes, says Lee, that's why I said it was randomly done.
Todd Murray
That ends Mansfield's cross-examination.
Mansfield probes missing log entries from when phone was turned on
Todd Murray
Mansfield refers the witness and jury back to a booklet of police photos taken at the scene on April 5, about 5pm.
Lee confirms he told us earlier that when the screen comes on, that's recorded in the logs.
A photo referred to by Mansfield shows the screen of Hanna's phone on.
Where is the log entry showing the screen coming on then? asks Mansfield.
Lee says he wasn't asked to examine that.
Mansfield asks what the explanation is for there not being a "display on/off" log entry from 5pm on April 5, showing the screen being turned on by a police officer?
"I can't see it being recorded there," says Mansfield.
Lee doesn't answer.
If we go above that, says Mansfield, at 10.47pm on April 4, it says "display on/off", just after the phone was plugged in to charge.
The lawyer says again he can't see any corresponding entry for the afternoon of April 5, when police turned the phone on.
Lee doesn't immediately answer but refers to the printouts of the logs.
"According to this paper... I agree with you on that," Lee eventually says.
(This questioning relates to the police claim the lack of a "display on/off" entry in the phone's logs at 4am means Hanna's phone couldn't have been used to draft the messages at 4am, as alleged by the defence.)
Does the device not always accurately record these things? asks Mansfield.
You can't rely on one database, says Lee. There's hundreds of databases in the phone, he adds.
Todd Murray
Justice Lang says as he understands Lee's evidence, GrayKey extracts the data and Cellebrite analyses it, hence the different times in the logs.
Todd Murray
Mansfield has produced a document with logs from April 8, when police conducted an extraction on Hanna's phone, three days after her death.
He says some of the times don't correlate with when the extraction is understood to have occurred.
Lee says there are a number of databases and sub-databases within phones.
Lee then gives a lengthy technical aside.
Mansfield says he's only asking about the discrepancies in the times in Lee's notes.
The notes aren't wrong, says Lee, but the log entries are drawn from two different machines/systems – GrayKey and Cellebrite.
Todd Murray
The public gallery is about as empty as it as ever been at any point of the six-and-a-half weeks of the trial.
Mansfield and police analyst implacably opposed after hours of cross-examination
Todd Murray
To recap: Ron Mansfield KC and police digital forensic analyst Jun Lee remain implacably opposed after hour upon hour of cross-examination.
The lawyer and police analyst circle the point and talk at cross purposes at times but never budge from their respective positions.
Mansfield, citing the defence analyst Atakan “Artie” Shahho, says the iPhone's identity look-up service indicates Pauline Hanna's phone was used to draft two messages on the morning of her death to the daughter of a family friend, and to her husband.
No it doesn't, says Lee, the look-up service runs in the background as a security procedure.
And, says Lee, there's no signs of the phone being activated or used when the defence says the drafts were sent (this is also disputed by Shahho).
The jury has returned and the cross-examination of Lee continues.
Todd Murray
Are you close to the end, Mr Mansfield? asks Justice Lang.
Yes, says Mansfield, but there appears to be more to go.
"We've been going an hour and a half so we'll take the 15-minute break," the judge says.
Court will resume about 12.10pm.
Todd Murray
Mansfield is now citing log entries in the data that do not seem to correspond to when Airplane mode was turned off, on one occasion.
To recap – police used similar log entries to suggest Polkinghorne put his phone into Airplane mode in the early hours of April 5, not switching it on again until just before he called police to report his wife had hanged herself.
"My point is the log entries don't always record device events," says Mansfield, saying when Airplane mode came off on one occasion, there was not a corresponding log entry.
Lee says he disagrees.
Todd Murray
Now Mansfield moves to a summary of the Airplane mode events.
He is asking about logs that seem to relate to a flight on March 10, 2021.
Lee agrees the logs seem to show Hanna is flying that day and has turned Airplane mode on and then off some hours later.
The lawyer cites another example, and Lee agrees with Mansfield that Hanna knows how to use Airplane mode.
Todd Murray
Mansfield is now asking about movement data recorded by the phone.
Lee agrees it shows the phone is on her and moving a bit before 11pm on April 4, 2021.
Could it be going from the bedroom downstairs to the laundry? asks Mansfield.
"Perhaps that's a bit contentious," the lawyer adds.
Todd Murray
If there isn't recent communication from one number to another number, then the phone's identity look-up service checks the number or the email to check if it's an Apple device? asks Mansfield.
Can you break down the question a bit? asks Lee.
Mansfield says he's saying the identity look-up service is used by an iPhone to check whether a contact is Apple and whether iMessage can be used, or if SMS needs to be used.
Lee says it's relevant to both incoming and outgoing messaging.
That's my point, says Mansfield.
Mansfield says it's only used to check infrequently used numbers, where there hadn't been recent messages. That's why the identity look-up service is not linked to all communications, the lawyer says.
To recap – police have used the lack of evidence of the identity look-up service running when messages are sent to show that in their view it's not linked to the drafting or sending of a message, as the defence alleges.
Mansfield used the look-up service to suggest Hanna's phone drafted two messages on the morning of her death, to her husband and the daughter of a family friend.
Todd Murray
The jurors are doing their best to follow the evidence, leafing through the dense evidence contained in phone logs.
Todd Murray
Mansfield has moved on and the cross-examination has again become mired in technical details with the witness and lawyer talking at cross-purposes.
Judge interjects – 'that's really the nub of it'
Todd Murray
During one lengthy question from Mansfield, Justice Lang interjects and says I'm sorry, you just cannot put a question like that.
Lee again says the data does not support the identity look-up service being linked to the drafting of messages, as claimed by the defence.
"We're not going to get beyond that it seems," Mansfield says.
"Well, that's really the nub of it, isn't it?" Justice Lang says.
Todd Murray
Lee says what he's trying to explain is the database shows a long list of numbers representing mobile phone numbers, email addresses and so on.
His point appears to be that the identity look-up process scans and checks many numbers, not those that someone is drafting a message to. That can be seen at a database level, Lee says.
As I understand it, this is essential an index of all the iMessage numbers and email addresses that have been used by the iPhones messaging app? asks Mansfield, saying it doesn't explain if it's a background activity or a user prompted activity.
If the phone is checking through that, when the user is using the phone, it's checking a number against that record? asks the lawyer.
No, says Lee, explaining that there are seven records for Polkinghorne's phone number.
On Mansfield's logic, that indicates, according to Lee, that his number would only have been checked seven types in the life of the phone, which would not make sense, given the frequency of messaging between husband and wife.
Todd Murray
Lee explains the evidential records of the identity look-up service only displays one number of a phone number.
If you look into the raw data, it contains more numbers, which the video will show, he says.
Todd Murray
Lee confirms he put Airplane mode back on after it connected to the Apple server.
Mansfield asks what was achieved by connecting the phone.
Lee explains the point of it was to remove the Middlemore Hospital Mobile Device Management (MDM) before further extraction of data could be undertaken.
That allowed the GrayKey tool to extract the data, find the password and crack into it. Once the data is extracted, it's processed via Cellebrite, software used by police to create a clone of devices for police to examine.
Mansfield says his point is there is no other background checking of contacts on the phone since April 5, 2021 – the day of Hanna's death.
Lee reveals he now believes there was not.
Those look-ups were for the numbers of the daughter of a family friend, and for Polkinghorne, Lee agrees.
Now the trial is going to be played a video.
Todd Murray
So did you end up getting the Pin for the phone? asks Mansfield.
No, says Lee, we used GrayKey after the phone was unlocked to "brute-force" the phone, a term for one technique used to break through a phone's Pin security.
Mansfield is questioning the dates and times and contents of Lee's notes.
Mansfield says his notes end on April 7, saying Lee was given the go ahead from Middlemore and the investigation team to connect to the investigation source. Do you not make notes at the time? asks Mansfield, after Lee says he wrote the notes last night.
Not notes of every second, says Lee.
Defence focuses on the unlocking of Hanna's iPhone
Todd Murray
Mansfield is back on his feet.
Last night, the defence received a video via the police and Crown, he says. Did that originate from you?
No, says Lee, it was from Detective Senior Sergeant Chris Allan (the officer in charge of the case).
He doesn't know when it was made.
At 10.06am the defence received an email of Lee's notes, says Mansfield. They relate to the iPhone's identity look-up service which Lee says was an automatic, background security process, not a sign of the phone being used to draft a message, as claimed by the defence.
The note says the phone arrived cold and locked with unknown Pin.
Cold either means the phone had been turned off or restarted, Lee explains. If it's cold, you can lose authentication and won't be able to access everything on the phone, he says.
The note goes on to say there was a failed attempt to "brute force" the Pin.
Initial access was made with GrayKey, a tool police use to try break into phones, Lee's note says.
Lee says he used GrayKey.
A subsequent note says the iPhone had a six-digit code and its Mobile Device Management (MDM) operated off a server at Middlemore Hospital.
"Righto," says Mansfield.
On April 7, Lee had spoken to a detective about the fact the phone was MDM-locked, meaning their tools couldn't get into the phone to extract the data, so they would have had to talk to IT at Middlemore Hospital. The concern was that the phone would then connect to the server.
Lee explains that when police spoke to IT at Middlemore, they could push a command through over the network, but the phone would need to come out of Airplane mode.
Lee's note then says the phone went out of Airplane mode so it could receive the signal from Middlemore.
Did this happen on April 7 or April 8? asks Mansfield.
(To recap – the phone's identity look-up service ran on April 8, a fact used by police to support their argument the look-up feature is not linked to message drafting, as the defence IT expert says).
The action was performed on April 8, Lee says.
The trial resumes
Todd Murray
Police digital forensic analyst Jun Lee is back in the witness box for more cross-examination.
Yesterday, defence lawyer Ron Mansfield KC took aim at the fact Lee had previously worked for Samsung, specialising in issues with the Korean conglomerate's Android phones, as a way to question his ability to know if Hanna's Apple iPhone was drafting the messages the defence IT expert said it did.
Justice Graham Lang apologises to the jury for the delayed start.
Todd Murray
The families of Pauline Hanna and Philip Polkinghorne are filtering into court, followed by the members of the public who come to watch proceedings each day and the trial is set to get under way.
Trial to resume at 10.30am
Todd Murray
It appears the trial will now resume at 10.30am, for administrative reasons.
Todd Murray
'Go Phil!' calls out supporter as accused eye surgeon arrives at court
Todd Murray
Philip Polkinghorne has arrived at court with his sister Ruth Hughes and lawyer Ron Mansfield KC ahead of proceedings resuming before the smaller jury about 10am.
A juror was discharged yesterday for personal reasons unrelated to the trial – she had immovable commitments, the trial heard.
When Polkinghorne walked into court this morning alongside Mansfield, a member of the public waiting in the corridor outside Courtroom 11 called out "go Phil!"
She declined to comment further when approached by the Herald.
Defence continues - focus on Pauline Hanna's phone on day she died
Todd Murray
At 10am, police forensic digital analyst Jun Lee will return for yet more cross-examination from defence lawyer Ron Mansfield KC.
Yesterday, Lee endured a sustained interrogation from Mansfield on the vexed question of whether Hanna’s phone was used to draft two messages, to a family friend and her husband, at 4am on the morning of her death.
Police and the prosecution say it was not, and the so-called draft iMessage was actually an automatic security look-up procedure. Lee was a Crown witness first called weeks ago then recalled towards the end of the defence case.
Defence IT expert Atakan Shahho, an Apple specialist from Sydney, maintains it was used to draft a message.
The cross-examination dove into the weeds yesterday and at times became mired in technical detail.
One thing became clear – neither Lee nor Shahho are budging from their positions.
After Lee’s cross-examination is complete, Mansfield looks set to call his final defence expert witnesses. On the basis of his opening address, they include a psychiatrist and a pathologist.
It remains an open question as to whether the defence case will finish today.
Yesterday, Justice Graham Lang discharged one of the jurors, because of immovable personal commitments he feared could make the jury feel like they had a limited time to reach a verdict.
The judge did not specify the nature of her commitments when speaking in open court.
"The other issues you face in your life are much more important,” Justice Lang said.
The trial will now continue with a panel of three men and eight women.
Before the juror was discharged, Auckland Crown solicitor Alysha McClintock cross-examined Olav Nielssen, the Sydney psychiatrist earlier called by the defence who said Pauline Hanna had several risk factors for suicide.
Nielssen said Hanna’s previous suicide attempt would have raised her risk of future suicide 100-fold, according to the search, which her sister Tracey Hanna said she had disclosed in the early 1990s after a fight with her mother.
None of Pauline’s other family or friends who gave evidence had heard of this attempt.
McClintock asked if the research he referred to was based on verified suicide attempts via hospital records.
Nielssen said it was, and confirmed he had seen no hospital records suggesting she was admitted for treatment after a suicide attempt. Her sister said Hanna had held her wrists up after disclosing the attempt, but Nielssen confirmed he’d seen no scarring there in the autopsy photographs.
Other risk factors cited by Nielssen were her history of mental health issues, in 2019 she told a GP she’d considered driving into a truck, but was put off by fear and thoughts of family.
Nielssen also said her use of alcohol with the sleeping pill zopiclone would have had a distinct disinhibiting effect.
McClintock later turned the tables on Nielssen, asking about Polkinghorne’s risk factors for homicide.
The prosecutor asked if when he's assessing an offender's risk profile for violent offending, whether one of the key things he'd look at is evidence of prior violence?
"Yes," said Nielssen.
And in a male offender, any evidence that was put in front of you of a non-fatal strangulation of a woman, would that be a red flag for a violence profile for an offender?
Yes, the circumstances of previous violence would be relevant, he said.
The couple's family friends John and Pheasant Riordan both said Hanna had described Polkinghorne having previously placed his hands on her neck as part of what they understood to be a strangulation threat.
And would drug use be factored into an offender risk profile?
Yes, that's a big risk factor, he agreed.
And financial strain, is that a risk factor too?
He again agreed.
In his questions-in-reply, Mansfield asked Nielssen who is the type of professional who would undertake a profile of Polkinghorne and his homicide risk?
That would be psychologists or psychiatrists within the criminal justice system, he said, i.e. not him, a psychiatrist who has done a lot of work and research around suicide.
Polkinghorne murder trial day 30 - will defence case close today?
Todd Murray
Welcome to the Herald’s live coverage of the third sitting day of the seventh week of the murder trial of Philip Polkinghorne, the Remuera eye surgeon accused of killing his wife Pauline Hanna and staging the scene to look like a suicide.
His defence still has a couple of experts left to call to support their case Hanna hanged herself amid work pressures and longstanding mental health issues.
Polkinghorne trial - September 12
Todd Murray
Warning: Some readers might find the contents of this live blog distressing.
KEY POINTS:
- Retired eye surgeon Philip Polkinghorne has pleaded not guilty to murdering wife Pauline Hanna at Easter 2021.
- The Crown alleges Polkinghorne, 71, strangled his wife and staged her death to look like a suicide at their Remuera home. The defence says there is no evidence of a homicide.
Polkinghorne defence expert pans Crown's staged suicide theory
Psychiatrist says Pauline Hanna had dangerous cocktail of suicide risk factors
Steve Braunias at Polkinghorne trial: Let us interrogate supernatural beings
Herald reporter George Block is filing live from the Auckland High Court. Follow our live updates below.
STORY CONTINUES
Polkinghorne, now 71, is accused of having fatally strangled his wife of 24 years before staging the scene at their Remuera home on April 5, 2021, to look like a suicide by hanging. Prosecutors have alleged he had been using some of the $13,000 worth of methamphetamine found inside the home when he lashed out at Hanna, possibly getting on her back and choking her as she slept in a separate bedroom.
Although the Crown is not required to establish a motive, much of the circumstantial case has focused on the surgeon’s extravagant spending on sex workers and his alleged “double life” with Sydney escort Madison Ashton, who exchanged intimate WhatsApp messages with him in the days following his wife’s death.
The defence, which has been calling witnesses for just over two weeks now, has insisted that Hanna killed herself just as the scene suggested. She had a long history of depression, an intensely stressful job that some witnesses have said she was struggling with and was taking what a psychiatrist has described as a dangerous combination of sleeping pills, weight loss drugs, anti-depressants and alcohol.
But the overall themes of the trial have been bogged down for the past two days as the defence has continued to intensely focus on the activity of Hanna’s phone between 4am and 4.05am on the morning of her death.
The defence has suggested that she was on the phone at that time and that she went into the messaging app, perhaps contemplating drafting a goodbye note before suicide. No messages were ever sent and no drafts were found on her phone, but phone logs show the phone twice running an “iMessage identity lookup” service at that time. The service looked up her husband’s phone and the phone of a friend’s teenage daughter - checking to see if they were also Apple devices, which would allow iMessages to be sent rather than standard texts.
The point of contention was whether Hanna had to be actively using the phone for the “iMessage identity lookup” to run or whether the identity check ran randomly in the background. Lee was adamant that both situations could apply generally, but on that morning all indications showed that the phone was in sleep mode and not being used. Mansfield disagreed.
And so they circled for hour after hour, remaining implacably opposed.
Lee added that it wasn’t just those two numbers being looked up by the phone around 4am. He showed jurors a video of him going into the phone’s downloaded logs on a computer. Although Polkinghorne’s phone number and the teen’s number were the ones initially listed, drilling down more into the data showed numerous other phone and email contacts, he said as he narrated the video from the witness box. It was another indication that it was a background function, he said.
Jurors took a late lunch break so that Mansfield could then recall his own expert: Atakan “Artie” Shahho, who has run an IT company out of Australia since 1988. Shahho first gave evidence on Tuesday but specifically avoided questions on the 4am matter so that the Crown expert could first finish his testimony on the subject.
Unlike Lee, Shahho told jurors he has been a registered Apple developer since 2008. He’s been an Apple aficionado since the company launched the first Mac desktop computer in 1984, he said.
“It’s a familiarity thing, Mr Mansfield,” the witness said when asked why being an Apple developer made him a better expert witness. “It’s in my DNA... You get to be very familiar with the back end.”
Shahho said he’d been researching the issue of the 4am logs since it came to light several weeks ago. He’s come to the conclusion, he said, that “a message was created but never sent”.
“The number would have been typed in and then it [the message] was abandoned,” he explained.
Shahho disagreed with Lee’s contention that it could have run in the background. Apple “got grilled by the European Union” a few years back for allegedly having access to people’s contacts and the company replied, “We don’t do that,” Shahho told jurors.
So the identity lookup, he surmised, “is user-initiated on the phone”.
Shahho is less than 30 minutes into today’s testimony and the Crown has not yet had a chance to cross-examine him on the issue.
He is expected to return to the witness box after jurors finish their late lunch break.
Craig Kapitan is an Auckland-based journalist covering courts and justice. He joined the Herald in 2021 and has reported on courts since 2002 in three newsrooms in the US and New Zealand.
The Herald will be covering the case in a daily podcast, Accused: The Polkinghorne Trial. You can follow the podcast at iHeartRadio, Apple Podcasts, Spotify, through The Front Page feed, or wherever you get your podcasts.