7.James Tyra — Direct
152 linesJAMES TYRA, duly sworn
COURT CLERK: Have a seat. State your name --
JAMES TYRA: James Tyra.
COURT CLERK: Spell your last name for the record.
JAMES TYRA: T-Y-R-A.
DIRECT EXAMINATION BY MR. WEINREB:
MR. WEINREB: Good morning.
JAMES TYRA: Good morning.
MR. WEINREB: Where do you work?
JAMES TYRA: I work at the FBI, the Federal Bureau of Investigation.
MR. WEINREB: And which branch of it?
JAMES TYRA: Boston field office, Boston.
MR. WEINREB: And what's your assignment there?
JAMES TYRA: My official title is a computer scientist. I'm attached to the cyber squad.
MR. WEINREB: How long have you been there?
JAMES TYRA: About two and a half years now.
MR. WEINREB: And what does the cyber squad do?
JAMES TYRA: We investigate all manner of computer-related crimes, I guess is a good general description.
MR. WEINREB: Where did you work before the FBI?
JAMES TYRA: Prior to the bureau I worked for the MITRE Corporation.
MR. WEINREB: Is that a local company?
JAMES TYRA: It is, yeah. In Bedford, Massachusetts.
MR. WEINREB: What was your job there?
JAMES TYRA: I was a systems engineer.
MR. WEINREB: What does that mean?
JAMES TYRA: It's putting computer systems together, like on the Internet on a larger scale. Making things work together and talk to each other and stuff like that.
MR. WEINREB: What degrees have you earned?
JAMES TYRA: I have a bachelor's degree in computer science as well as a master's degree in computer science.
MR. WEINREB: Are you what the FBI calls a CART tech?
JAMES TYRA: I am, yes.
MR. WEINREB: And what is a CART tech?
JAMES TYRA: CART tech, we've had some minimal training -- so CART tech is usually in conjunction with DEXT, which we call digital extraction technician. We are trained to handle digital evidence, mainly the gathering of digital evidence.
MR. WEINREB: Okay. And are you what's known as -- now, you said "DEXT." That's D-E-X-T?
JAMES TYRA: Yes.
MR. WEINREB: What does that stand for?
JAMES TYRA: Digital extraction technician.
MR. WEINREB: And are you a DEXT-certified technician?
JAMES TYRA: Yes.
MR. WEINREB: When you say "extract digital evidence," say more about -- what does that involve?
JAMES TYRA: Sure. So at a crime scene, a lot of times nowadays you'll encounter a computer or a digital video recorder or things along those lines. We're trained to properly, I guess, handle those as evidence and pull the digital files, if you want to call it, off of those correctly and retain them as evidence.
MR. WEINREB: And just so we're clear, when you're talking about, let's say, a digital video recorder and you pull a digital file off of it, you're pulling video off of it?
JAMES TYRA: Correct. Yes. Yes.
MR. WEINREB: Did you work the marathon bombing investigation?
JAMES TYRA: I did.
MR. WEINREB: Starting when?
JAMES TYRA: Approximately five o'clock the day of the bombing we were at the Westin Hotel.
MR. WEINREB: And what did you do when you -- at the Westin Hotel?
JAMES TYRA: I was part of the team that was reviewing and, I guess, processing digital evidence.
MR. WEINREB: So how -- what was happening? Digital evidence was coming in to the hotel?
JAMES TYRA: Sure. So there was a small conference room that we were in. We were stationed behind what the FBI calls ERT, which is our evidence response technicians. They're sort of the professional evidence-handling people to bring evidence. So a piece of evidence would come in, they would process it. What that means is that they would start chains of custody, give it an item number in our internal tracking system, you know, do all the tracking stuff. As soon as they were happy with their tracking system, they would hand it off to us to start examining what's on here, how do we get it off, how do we preserve the evidence, how do we maintain the integrity digitally. All those sorts of things.
MR. WEINREB: And were you, in fact, involved in extracting and reviewing video and photographic and other kinds of computer evidence from devices that were being brought in to the Westin?
JAMES TYRA: I was.
MR. WEINREB: And when you looked at them, what were you looking for?
JAMES TYRA: I mean, they're generically evidence of a crime, evidence of a bombing, stuff like that. It was really, yeah, very generic.
MR. WEINREB: Were you looking for suspects?
JAMES TYRA: Absolutely. Yes.
MR. WEINREB: Were you the only one doing it?
JAMES TYRA: No. No. I mean, at various times we had, depending on what day you're talking about, there were a few people starting to a whole lot of people eventually.
MR. WEINREB: Okay. Now, are you trained in how to do that in a manner that preserves the evidence accurately so that the copies that are pulled off are exact copies?
JAMES TYRA: Yes.
MR. WEINREB: And the people who were with you, to your knowledge do they have the same training?
JAMES TYRA: Yeah. Yeah.
MR. WEINREB: And did you perform that function in accordance with your training so as to preserve the evidence and make exact copies?
JAMES TYRA: Yes.
MR. WEINREB: And as far as you know, was everybody around you doing the same?
JAMES TYRA: Yup.
MR. WEINREB: So what did you do with the video that you extracted after you extracted it and reviewed it?
JAMES TYRA: So we didn't get sort of a good extraction until the next morning back at the FBI field office in Boston. Once we were able to obtain that, we started looking at it, I mean, just reviewing it, seeing what was happening on the video. You know, there was a real big push to answer a lot of questions: What had happened. So --
MR. WEINREB: Before we get ahead of ourselves, so let's stay on the Westin for a minute. So how long did you do this process at the Westin?
JAMES TYRA: From 5 p.m. to approximately midnight, I believe.
MR. WEINREB: Okay. And during that time did you at least make a start on extracting video from a surveillance system that had been obtained from the Forum restaurant?
JAMES TYRA: Yes.
MR. WEINREB: And were you -- so I cut you off earlier, but is that what you were saying you started doing there and finished doing back at the main FBI office?
JAMES TYRA: Yup. Yup. We finished up around midnight and started up again the next day.
MR. WEINREB: All right. And did you extract video from that device?
JAMES TYRA: Yes.
MR. WEINREB: What did it show?
JAMES TYRA: It showed a person approximately five minutes before the bombing walk up to a place in front of the Forum there with a backpack, casually turn, set the backpack down --
MR. BRUCK: We object to the description of evidence that will be admitted. This is -- the witness is characterizing --
THE COURT: No, I think a general description is all right. I mean, the evidence I suspect is going to be offered, and it will be the best evidence of the question. But I think a summary --
MR. BRUCK: I guess my objection is to anything except the general description.
THE COURT: Yes, a general description.
MR. WEINREB: That's fine.
BY MR. WEINREB:
MR. WEINREB: Continue.
JAMES TYRA: In general, it showed someone setting down a backpack and walking away and then a bomb blast going off very shortly after that.
MR. WEINREB: The other day did you review a copy of that same video in my office?
JAMES TYRA: I did.
MR. WEINREB: All right. And was it a fair and accurate copy of the video that you extracted and saw that night from the Forum surveillance system, or the next morning?
JAMES TYRA: Yes, it was.
MR. WEINREB: All right. And was that Exhibit 23?
JAMES TYRA: Yes.
MR. WEINREB: The government offers Exhibit 23.
THE COURT: Any objection?
MR. BRUCK: No objection.
THE COURT: Admitted.
(Government Exhibit No. 23 received into evidence.)
BY MR. WEINREB:
MR. WEINREB: Did you also analyze a GPS device in connection with this investigation?
JAMES TYRA: I did.
(Counsel confer off the record.)
MR. WEINREB: I'm showing you Government's Exhibit 919, 9-1-9, for identification. Do you recognize that?
JAMES TYRA: Yes, I do.
MR. WEINREB: Is that the GPS device that you examined?
JAMES TYRA: I believe it is, yes. Yup. Yeah.
MR. WEINREB: What did you do with this device?
JAMES TYRA: Basically we called our headquarters office, the specialists who work who are trained and have more knowledge than me, frankly, on GPS devices. We told them what model we had and we asked them what the proper procedure was. It turned out this model was relatively simple and that it plugs into any computer and shows up like a thumb drive. So we put what we call a write blocker -- standard procedure is just to put a device that blocks writing to things -- and we hooked it up to one of our analysis computers and extracted the contents of the GPS.
MR. WEINREB: And the purpose of the write block is to prevent any data from being put into the GPS --
JAMES TYRA: Yup. Exactly.
MR. WEINREB: -- so that stays the same. And you just pulled it off the GPS?
JAMES TYRA: Correct.
THE COURT: Just to be clear, it's W-R-I-T-E, write?
JAMES TYRA: Yes.
THE COURT: Correct? I mean, it's a homonym. I just wanted to be sure everyone understood it was blocking writing.
Go ahead.
MR. WEINREB: Okay.
BY MR. WEINREB:
MR. WEINREB: And the data that you pulled off, did it -- what is the data that you pulled off the device?
JAMES TYRA: I think you would call them GPS tracks, which is basically a set of GPS coordinates that were taken very quickly. So it ends up being a plot of some time and location.
MR. WEINREB: So it's where the GPS has been at various times?
JAMES TYRA: Exactly.
MR. WEINREB: And did you plot those -- are those sometimes called "waypoints"?
JAMES TYRA: Yeah, yeah, yeah.
MR. WEINREB: And did you plot those waypoints for various times and dates on a series of maps?
JAMES TYRA: Yes, at one point I did do that.
MR. WEINREB: I'm showing you what's been marked for identification as Exhibit 1152-03 --
JAMES TYRA: Uh-huh.
MR. WEINREB: -- 1152-05, and 1152-06. Do you recognize those?
JAMES TYRA: Yes, these look like what I pulled off.
MR. WEINREB: Okay. So these are three maps that have a series of dots plotted along them. Is that correct?
JAMES TYRA: Yes.
MR. WEINREB: All right. And the dots that are plotted along them, are those waypoints that were extracted from the GPS device that you analyzed?
JAMES TYRA: I believe so, yes.
MR. WEINREB: Thank you. And do they -- to the best of your recollection today, does that fairly and accurately represent the waypoints that you pulled off for those particular dates and times?
JAMES TYRA: I didn't memorize everything but this looks familiar to what I pulled off, yes.
MR. WEINREB: Excuse me one second, your Honor.
(Counsel confer off the record.)
MR. WEINREB: Agent Tyra -- I'm sorry. Not "agent" but Mr. Tyra, you talked a little bit about the procedures for evidence handling and preservation and particularly the ones that the CART examiners use, the evidence examiners use.
JAMES TYRA: Yes, I'm not a CART examiner; we're just DEXT-trained, but yes.
MR. WEINREB: Okay. But you're one of the people who, as you've said, pulls digital data off devices?
JAMES TYRA: Yes.
MR. WEINREB: And were there other people, not just at the Westin doing that, but other people in the investigation doing that in other places?
JAMES TYRA: Yeah. Absolutely.
MR. WEINREB: All right. And to the best of your knowledge was everybody following the same sets of procedures for doing it to preserve and maintain the integrity of the evidence?
JAMES TYRA: Yes.
MR. BRUCK: I object to how this witness would know what other people were doing.
THE COURT: Overruled.
You may answer it.
JAMES TYRA: Yes.
MR. WEINREB: No further questions.
MR. BRUCK: No questions.
THE COURT: All right, sir. Thank you. You may step down.
(The witness is excused.)
MR. MELLIN: The United States calls Alan Hern.