The email account used to send a purported ransom demand to the family of Irish-French teen Nora Anne Quoirin after her disappearance last year was found to be deactivated, possibly to conceal the fraud attempt, a senior police investigator testified at the Coroner’s Court today.
Federal Commercial Crime Investigation Department (Cybercrime and Multimedia) investigating officer Deputy Superintendent Hazizi Abd Samad said the account’s status was obtained from analysis conducted on the purported sender’s email address on September 14, 2020.
“Based on my assumption and experience, if an email address no longer exists, it would mean that the email creator made the decision to erase it.
“Such behaviour in many cybercrime-related cases, is attributable to frauds run by scammers,” Hazizi, who is the 32nd witness in Quoirin’s inquest, told Coroner Maimoonah Aid.
Hazizi was called to testify after the court was previously informed that Quoirin’s family had received an email demanding for a ransom amounting to two Bitcoin (BTC) — equivalent to RM23,000 at that time — on August 7, 2019.
Witnesses had then told the court the email was later found to be a scam that purportedly originated from Virginia, United States.
Today, Hazizi also confirmed the intended recipient of said ransom email as the Lucie Blackman Trust, a charity and support group.
As the officer assigned to analyse the email, Hazizi said he utilised open-source software to examine the email’s header when he was instructed to do so on September 11, 2020.
Hazizi also told the court he was unable to determine when the account was deactivated but added that further information on the creation and deletion of the account could be obtained from Microsoft Corporation as it was registered under the Hotmail webmail service then.
He explained that this could be performed through a Mutual Legal Assistance request made through the Attorney General’s Chamber.
When asked if one could spoof the creation of an email, Hazizi said it was plausible since it is a free webmail service and that users are not necessarily required to provide detailed information to verify their existence.
Testifying as the 31st witness, Federal Commercial Crime Investigation Department investigating officer Inspector Nur Adli Md Saari also told the court how the email’s sender had used a layering method to mask their transactions and avoid detection.
“On August 13, 2019, I received instructions from my superior to conduct an analysis on a Bitcoin wallet address named in the email received by Quoirin’s family.
As part of his analysis, Nur Adli said he made a deposit to see where the trail led, with the suspect transferring said deposit the next day to several other wallet addresses.
“In layman’s terms, as an investigating officer, I was tasked with following the money trail,” he said.
He also said initial investigations on the wallet address revealed that it was newly created with no transaction history whatsoever.
“I found that the pattern used by the email sender leaned towards the modus operandi used by scammers to take advantage of their victims by demanding ransoms in the form of Bitcoin.
“Based on the layering method and how the email was written, it is a known tactic used by scammers,” he added.
Meanwhile, search-and-rescue operation volunteer M Magenderan, who testified as the 30th witness at the inquest, described the journey from the resort where the teen had gone missing to where the body was found as surrounded by dense vegetation and with no visible walking trails.
“A lot of people had no clue as to how to get into the area where the body was found,” he said in Tamil to the coroner through a court interpreter.
He said the area where Quoirin’s corpse was discovered was located within an oil palm plantation roughly north-east of The Dusun Resort where she had stayed.
Magenderan said he was somewhat familiar with the area as he last visited the area between 2003-2004 when it was still a rubber estate then.
Magenderan earlier told the court how he learned of Quoirin’s disappearance, and how he spent his entire life living in the nearby Kampung Pantai located several kilometres from the resort where the teen went missing.
He explained that he was initially approached by a group of hikers who asked whether he could join them in the search for the missing teen since he lived in the nearby village on August 12, 2019.
“There was a makeshift hut by the river, which I believed was used by people who hunt birds in the area, but no one was there when we passed by.
“After going past the hut, I heard a woman’s shout and headed towards it before stumbling upon a body not far from where she was standing. I also got a closer look to see if she was really dead,” he said, adding that he could recognise Quoirin’s hair and face from the missing poster he saw.
Following that, Magenderan said he then contacted a People’s Volunteer Corp (Rela) personnel to inform him of the discovery, who then contacted Magenderan’s father to guide the authorities to the plantation due to poor cellular network coverage in getting the initial call through.
He also confirmed prior incidents of people going missing in the vicinity, but most of them comprised hikers at the nearby Gunung Berembun who were found alive days later.