7.Gerald R. Grant, Jr. — Direct/Cross/Redirect
722 linesGERALD R. GRANT, JR., Sworn
COURT CLERK: Have a seat. State your name. Spell your last name for the record. Keep your voice up and speak into the mic.
GERALD R. GRANT, JR.: My full legal name is Gerald R. Grant, Jr. Would you like me to spell it? G-e-r-a-l-d, R., G-r-a-n-t, Jr.
DIRECT EXAMINATION BY MR. WATKINS:
MR. WATKINS: Good afternoon, Mr. Grant.
GERALD R. GRANT, JR.: Good afternoon, sir.
MR. WATKINS: How are you currently employed?
GERALD R. GRANT, JR.: I am a computer forensics investigator for the Federal Public Defender in the Western District of New York as well as do independent consulting in computer forensics on my own.
MR. WATKINS: How long have you been working at the Federal Public Defender Office in New York?
GERALD R. GRANT, JR.: This is my 21st year, sir.
MR. WATKINS: What office do you work at?
GERALD R. GRANT, JR.: Western District of New York, which has an office in Rochester, New York, which is the main office, and then Buffalo, New York, which is the branch.
MR. WATKINS: And what is it that you do for the Federal Public Defender Office in the Western District of New York?
GERALD R. GRANT, JR.: I am currently a computer forensics investigator.
MR. WATKINS: How long have you been doing that position?
GERALD R. GRANT, JR.: In that specific title, I have been doing that for five years.
MR. WATKINS: Before that, what did you do for the Federal Public Defender Office?
GERALD R. GRANT, JR.: I was -- started out as what's called a computer systems administrator, so I handled all of the IT for both of the offices. I then moved into a national position and then became the investigator.
MR. WATKINS: Now, you talked that in addition to working at the Federal Public Defender Office you also consult in a private capacity?
GERALD R. GRANT, JR.: Yes, sir.
MR. WATKINS: Again, what kind of capacity is that? What kind of work do you do privately?
GERALD R. GRANT, JR.: That is also computer forensics as well.
MR. WATKINS: How long have you been doing that for?
GERALD R. GRANT, JR.: Actually, that's -- my business has been around since 1990, so well over 30 years on that. And I've been doing forensics for a number of years, even prior to that.
MR. WATKINS: Let's talk about your education and experience. Did you go to school after high school?
GERALD R. GRANT, JR.: I did, yes, sir.
MR. WATKINS: Do you have a degree?
GERALD R. GRANT, JR.: An Associate's in computer programming.
MR. WATKINS: After receiving your Associate's degree, where did you begin working?
GERALD R. GRANT, JR.: I was with a family business after that but then became an employee with CompuAdd. Then I started my own consulting business and then was actually hired by the Federal Defender's Office in Rochester, which is how I became an employee of theirs.
MR. WATKINS: When did you first start working for the Federal Public Defender in Rochester?
GERALD R. GRANT, JR.: As a consultant in 1992 when they first opened and 1994 as an employee.
MR. WATKINS: What exactly is a computer forensics investigator?
GERALD R. GRANT, JR.: As a computer forensics investigator, I deal with any type of electronic equipment, whether it's analyzing, extracting data, performing the forensics, preparing for trial, working with the attorneys.
MR. WATKINS: And these are largely digital devices that you work with?
GERALD R. GRANT, JR.: Everything digital, yes, sir.
MR. WATKINS: Does some of the work you do require particular tools to be done?
GERALD R. GRANT, JR.: There's a number of different forensics tools on the market. Currently, AccessData FTK is one of the leading ones. Guidance Software, EnCase; CelleBrite; UFED, which stands for Universal Forensics Extraction Device. Then there's a number of other smaller utilities that are utilized on a regular basis.
MR. WATKINS: Are you proficient in using all those tools?
GERALD R. GRANT, JR.: Yes. I have been trained in them, and I'm certified in the AccessData FTK as an AccessData certified examiner as well as the CelleBrite Mobile Forensics as a CelleBrite certified logical operator.
MR. WATKINS: Now, those certifications, do those require any kind of ongoing efforts?
GERALD R. GRANT, JR.: Yes. There's always going to be continual training as well as I need to be recertified every two years to make sure that I am well-versed on the new operating systems, new techniques, anything that comes out within the next few years.
MR. WATKINS: In addition to actually analyzing computers and telephones and other digital devices, do you also have experience with cell tower data and cell site locations?
GERALD R. GRANT, JR.: Yes. I've been working with cell site analysis or plotting of the cell tower locations with activity for over ten years. I started with the Federal Defenders with that, working on a number of cases, working with all of the major cell phone vendors: AT&T, Verizon, Sprint, T-Mobile. Worked directly with them. Also worked with a number of cell phone forensics companies to bring those all together. I have been trained on that. I've actually even developed my own training program for the whole Federal Defender organization as well. And I lecture across the country on that.
MR. WATKINS: In addition to cell tower data and cell site location, do you have experience in analyzing social media platforms?
GERALD R. GRANT, JR.: Yes. Most of the major ones: Facebook, Twitter, YouTube, Instagram, all of those.
MR. WATKINS: You touched on this before. But in addition to your duties with the Federal Defender Office and the private consulting, do you also do training and lectures?
GERALD R. GRANT, JR.: All the time. I believe I'm currently over about 90 lectures that I do across the country, a number of them that I do on a yearly basis, to come back and train on all of the technology, including computer forensics, cell phone forensics and cell site analysis.
MR. WATKINS: During your career as a computer forensics investigator, approximately how many cases have you consulted in?
GERALD R. GRANT, JR.: I've been consulting actually prior to becoming a computer forensics investigator because, as I was a CSA, I was also involved heavily in the cases. I would say well over 400 cases with the Federal Defender's Office and well over 2 to 300 privately.
MR. WATKINS: Do you currently have cases that you're consulting on both with the Federal Defender Office and through your private --
GERALD R. GRANT, JR.: Yes, absolutely. I'm currently over a hundred active cases right now with my private consulting, and I'm about 75 to 80, I believe, in the Federal Defender Office.
MR. WATKINS: With your private consulting, is that just criminal cases or criminal and civil?
GERALD R. GRANT, JR.: I do both criminal and civil on the private side.
MR. WATKINS: How many times have you testified at trial?
GERALD R. GRANT, JR.: Sixteen times in court testifying as an expert.
MR. WATKINS: On some of those occasions, has it been about cell site analysis and cell site location?
GERALD R. GRANT, JR.: Yes, it has.
MR. WATKINS: And have you also consulted in preparation for trial about social media platforms?
GERALD R. GRANT, JR.: Yes, I have, sir.
MR. WATKINS: Now, were you contacted by our office to review documents, records, and data extracted in regard to the United States v. Tsarnaev?
GERALD R. GRANT, JR.: I was.
MR. WATKINS: More recently, were you asked to look at various documents, records, and data that were extracted from digital devices for dates connected to this case?
GERALD R. GRANT, JR.: I was, yes, sir.
MR. WATKINS: I'm going to direct your attention first to April 16, 2012, which is the date of the running of the 2012 Marathon. I'm going to show you first what's already in evidence as Exhibit 3000. I'm just going to show you the first page and ask you if you recognize it.
MR. WATKINS: Hold on for one moment.
MR. WATKINS: Do you recognize this -- what I've put before you?
GERALD R. GRANT, JR.: Yes. This is a Twitter account that I looked at, sir.
MR. WATKINS: Your Honor, this has been admitted, so it should be going to the jury.
THE COURT: Okay.
MR. WATKINS: Whose Twitter account is this?
GERALD R. GRANT, JR.: It's one that's considered J_tsar, J, underscore, t-s-a-r.
MR. WATKINS: In your review of documents and other evidence in this case, do you understand that to be connected to Jahar Tsarnaev?
GERALD R. GRANT, JR.: I do.
MR. WATKINS: Have you looked through the entirety of this document?
GERALD R. GRANT, JR.: Not the entirety, but I did look at specific messages, and I did connect to the actual live account.
MR. WATKINS: I'm showing you Page 88 of that document, and I'm highlighting a series of tweets. Have you looked at those tweets on this document in the past?
GERALD R. GRANT, JR.: I have, sir.
MR. WATKINS: On this document, the most recent tweets are at the top, and the oldest tweets are at the bottom, correct, as a general matter?
GERALD R. GRANT, JR.: That is correct, sir.
MR. WATKINS: But none of these tweets has a particular date attached to it, is that correct?
GERALD R. GRANT, JR.: They have a date, sir, but --
MR. WATKINS: I'm sorry. They do not have a specific time on the date that they are attached to, right?
GERALD R. GRANT, JR.: That is correct, yes, sir.
MR. WATKINS: Is that consistent with your experience with Twitter?
GERALD R. GRANT, JR.: Correct. When you're looking at a Twitter wall, it just shows the dates.
MR. WATKINS: Now, did you make efforts to determine the actual time that each of those posts was made?
GERALD R. GRANT, JR.: I did, sir.
MR. WATKINS: How were you able to do that?
GERALD R. GRANT, JR.: There's two ways when you're on an actual live Twitter account. You can either hover your cursor from your mouse over the date, and it will display the actual time; or if you click on the message itself and it expands it, it will show the time in the bottom left.
MR. WATKINS: Was there -- is there an additional way using data to determine -- strike that. Was there at least one tweet in this expanded series here that you were not able to get through the live feed?
GERALD R. GRANT, JR.: Correct, there was one, sir.
MR. WATKINS: Is there another way to get that if it no longer exists on the live feed?
GERALD R. GRANT, JR.: If it doesn't exist and there was some type of return from Twitter through a subpoena or a warrant, then that information could contain the actual message and the metadata, meaning the date and time that it was posted.
MR. WATKINS: And did you do that for one of the tweets that we'll talk about in a moment?
GERALD R. GRANT, JR.: I did, yes, sir.
MR. WATKINS: But the rest of them, you got them off of a live feed?
GERALD R. GRANT, JR.: Yes. I was able to open each one, yes, sir.
MR. WATKINS: Your Honor, this should only go to the witness.
MR. WATKINS: I'm going to show you that series of tweets now with the timestamp on them. I'm going to ask you if you recognize them, and then we'll seek to admit them. So I'm showing you first Exhibit 3126A. Do you recognize that as one of the tweets that you determined a time for?
GERALD R. GRANT, JR.: I did, sir.
MR. WATKINS: Once you determined the time, did you also pull it out -- or was it also pulled out in this form for presentation to the jury?
GERALD R. GRANT, JR.: Yes, it was.
MR. WATKINS: And did you verify the timing on this?
GERALD R. GRANT, JR.: I did, sir, yes.
MR. WATKINS: We'll talk a little more about the timing in a minute. But for each one of these you verified in a couple of different ways the actual time that it was posted?
GERALD R. GRANT, JR.: I did, sir.
MR. WATKINS: Your Honor, I'd move to admit Exhibit 3126A.
(Defendant's Exhibit No. 3126A received into evidence.)
MR. CHAKRAVARTY: No objection to time-verifying all of these, your Honor.
THE COURT: Okay.
MR. WATKINS: Showing you 3126B, was that the same? Were you able to verify the time and then verify that this is the substance and the time from the Twitter feed?
THE COURT: How many of these are there, Mr. Watkins?
MR. WATKINS: I'm sorry?
THE COURT: How many of these are there?
MR. WATKINS: There are seven.
THE COURT: I understand there's no objection to any of them. Can we just admit them all, shortcut things a little?
MR. CHAKRAVARTY: That will be fine, your Honor.
THE COURT: I don't know whether that applies to the one that was distinguished by a different way of determining.
MR. CHAKRAVARTY: I think we would want to hear testimony about that one.
THE COURT: So those that are this method can all be admitted, whatever the numbers are.
MR. WATKINS: I'm turning you now to 3126H.
MR. WATKINS: Just for the witness.
THE COURT: So this is the exception?
MR. WATKINS: This is the exception.
THE COURT: Okay. We'll get that done.
MR. WATKINS: Mr. Grant, this particular tweet has no timestamp of its own in the lower left corner, is that accurate?
GERALD R. GRANT, JR.: That is correct.
MR. WATKINS: You have put in a header on this particular tweet a specific time that it was posted in Eastern Daylight Time?
GERALD R. GRANT, JR.: I did, sir.
MR. WATKINS: How were you able to determine when this particular post was posted?
GERALD R. GRANT, JR.: Even though I was unable to find the live posting on the Twitter to be able to open it, I associated this specific tweet with a return, a piece of discovery, that was turned over to us from the government that was either a return from Twitter. It contained all of the individual logged items that were posted on the Twitter account. So what I did is I matched up the exact wording and phrasing to the actual Twitter log record, and then I was able to look at the date and time that it was posted on this particular tweet in that log. It was in what's considered UTC, or Greenwich Mean Time, if you've aware of that. And then I was able to bring that back to the time zone, the Eastern District time zone, along with the Daylight Savings at the time.
MR. WATKINS: And that background data, that underlying data, does it include more than just the time that it was posted? Does it include other information about the post?
GERALD R. GRANT, JR.: Yes. It includes the Twitter number, other information, if it's been forwarded or if it's been retweeted.
MR. WATKINS: Does it also include whether it was posted by web or by a mobile device?
GERALD R. GRANT, JR.: Yes, it does.
MR. WATKINS: To finish up, so this time that you put here you derived from the method that you just went -- took us through?
GERALD R. GRANT, JR.: Yes, I did, sir.
MR. WATKINS: So with that, your Honor, I'd move for admission of 3126H, along with 3126A through F.
MR. CHAKRAVARTY: No objection, your Honor.
THE COURT: Okay.
(Defendant's Exhibit Nos. 3126A-3126F and 3126H received into evidence.)
MR. WATKINS: So now if we may have it for the jury.
MR. WATKINS: I'm going to put a couple of things up here. I want to show you what's been previously admitted as Government's Exhibit 1280. And I'm also going to, next to it, put 3126B, which is one of the tweets that you just talked about.
GERALD R. GRANT, JR.: Okay.
MR. WATKINS: Now, do the substance of these two tweets -- are they identical?
GERALD R. GRANT, JR.: Yes, they are, sir.
MR. WATKINS: Is this time in the lower left-hand corner also identical?
GERALD R. GRANT, JR.: Yes, it is.
MR. WATKINS: But these times, first on the government's and on the one you created, are different. Can you tell me why that is?
GERALD R. GRANT, JR.: Well, there's two things. The 3:42 a.m. that the government put up is an accurate time based on Pacific time. What I did notice though is the showing that it was Pacific Standard Time, that was incorrect only because, at the time of April 16, 2012, the Pacific Coast as well as the East Coast, would be in what's called the Daylight Savings Time. So that would have actually offset it an hour. So the 3:42 is correct, but it's not Pacific Standard Time. It's actually Pacific Daylight Savings Time. Other than that, just for clarification. What I did then is took that time and offset it from the UTC time showing the accurate Eastern Daylight Savings Time at that -- meaning that it's 6:42 a.m. so specifically three hours ahead of the Pacific time.
MR. WATKINS: So if someone were posting tweets from the East Coast, why is it that it would show 3:42 in the bottom corner here?
GERALD R. GRANT, JR.: The 3:42 isn't necessarily from the poster. It's going to be associated with the setting of the actual Twitter account. You can set your Twitter account up as either being in Pacific, Central, Mountain, Eastern time. The actual time is stored at Twitter in UTC time. So it doesn't put an actual local time in there. It does the UTC. And then whoever is viewing these specific tweets, it would display in the time zone that that person is actually viewing the tweets. So somebody in the Eastern District looking at the same tweet would see 6:42, but somebody in Pacific would look and see 3:42.
MR. WATKINS: Now, just as the 3:42 Pacific time, did you take -- did you make efforts to verify that that truly was the date that it was -- the time that it was posted on that day?
GERALD R. GRANT, JR.: I did verify. What I did on the live actual tweet is I opened each one of them while my computer was set to Pacific Daylight -- or the Pacific time zone, and it then matched up to all of the 3:42's and the three hours that were behind. I then reset my computer so that my Twitter account would reflect the Eastern Daylight Savings Time. And those then automatically adjusted the times on the tweets to 6:42 a.m. For purposes of demonstration here, we left them at the Pacific time, and I did the adjustment at the top.
MR. WATKINS: Now, with all that, I want to go through those seven tweets that were made from April 15 to April 17. Showing you 3126A, what time in Eastern Daylight Time, was -- date and time was this posted?
GERALD R. GRANT, JR.: This tweet was posted on April 15, 2012, at 4:58 p.m.
MR. WATKINS: What is the substance of that tweet?
GERALD R. GRANT, JR.: It says, "bout to sleep for like 20 hours."
MR. WATKINS: Going to 3126B, what is the date that this is posted?
GERALD R. GRANT, JR.: Again, this is on April 16, so the next day, 2012, at 6:42 a.m.
MR. WATKINS: So on April 16, 2012, the date of the running of the 2012 Boston Marathon?
GERALD R. GRANT, JR.: Yes, sir.
MR. WATKINS: And this is the tweet we've seen as Government Exhibit 1280. This is 3126B with the Eastern Daylight Time stamp on it, correct?
GERALD R. GRANT, JR.: Yes, sir.
MR. WATKINS: Again, what time was this posted, Eastern Daylight Time?
GERALD R. GRANT, JR.: It was posted at 6:42 a.m., Eastern Daylight Time.
MR. WATKINS: Putting before us 3126C, what time was this posted?
GERALD R. GRANT, JR.: This was also posted on April 16, 2012, at 8:38 a.m., Eastern Daylight Time.
MR. WATKINS: That's roughly two hours after the last tweet?
GERALD R. GRANT, JR.: Yes, sir.
MR. WATKINS: What is the substance of this tweet?
GERALD R. GRANT, JR.: It states, "hhmmm, get breakfast or go back to sleep, this is always a tough one."
MR. WATKINS: Showing you 3126D, what is the Eastern Daylight Time timing on this tweet?
GERALD R. GRANT, JR.: This is, again, on April 16, 2012, at 8:45 a.m., Eastern Daylight Time.
MR. WATKINS: The last tweet we saw said, "get breakfast or go back to sleep." What does this tweet say?
GERALD R. GRANT, JR.: This says, "Sleep after breakfast is so much sweeter."
MR. WATKINS: Showing you 3126E, what is the time on that?
GERALD R. GRANT, JR.: That is also April 16, 2012, at 8:45 a.m., Eastern Daylight Time.
MR. WATKINS: So that was within a minute of the last one, right?
GERALD R. GRANT, JR.: Correct. It would have been within the same minute.
MR. WATKINS: The last one said, "sleep after breakfast is so much sweeter." What is the substance of this tweet?
GERALD R. GRANT, JR.: This states, "So breakfast it is."
MR. WATKINS: I'm going to move away from the Twitter post for just a minute and put before you --
MR. WATKINS: This should only go to the witness, your Honor.
MR. WATKINS: -- what I've marked as 3125. And I'm going to scroll through some pages here. Do you recognize what this document is?
GERALD R. GRANT, JR.: I do, sir.
MR. WATKINS: What is it?
GERALD R. GRANT, JR.: It's a log record indicating the card access for admitting into buildings at the University of Massachusetts.
MR. WATKINS: Is there a specific building that this is in regard to?
GERALD R. GRANT, JR.: Yeah. It's the Maple Ridge Hall.
MR. WATKINS: Turning to Page 8 of this document, I'm going to highlight an entry. Is that an entry that you looked at from April 16 of 2012?
GERALD R. GRANT, JR.: It is, sir.
MR. WATKINS: Your Honor, I'd move to admit so much of Exhibit 3125 as includes the page that we're seeing regarding a swipe at April 16th.
MR. CHAKRAVARTY: No objection.
THE COURT: With the certification or not?
MR. WATKINS: I'm sorry?
THE COURT: With the first page certificate or not?
MR. WATKINS: The first page was a certificate.
THE COURT: Right. I'm just asking you if you want that part of the record or not.
MR. WATKINS: I don't believe we need that as part of the record.
MR. CHAKRAVARTY: I think, as a pattern, we haven't been introducing the certs, your Honor.
THE COURT: Fine. Okay. What's the page number?
MR. WATKINS: This is Page 8 of Exhibit 3125, and it will be the only page when it goes to the jury.
(Defendant's Exhibit No. 3125 received into evidence.)
MR. WATKINS: May we publish that to the jury? Before we go to that, I'm going to back up to the last tweet to remind us where we were here.
MR. WATKINS: "So breakfast it is" at 8:45, Eastern Daylight Time, that was the last tweet that we saw?
GERALD R. GRANT, JR.: Correct, sir.
MR. WATKINS: So, now, turning to Exhibit 3125 -- wrong one -- 3125, what is this entry here?
GERALD R. GRANT, JR.: This is a log entry from the University of Massachusetts system that shows that somebody used a card to access the Maple Ridge Hall.
MR. WATKINS: What time did that occur?
GERALD R. GRANT, JR.: At 10:56 a.m.
MR. WATKINS: Nearly 11:00, Eastern Daylight Time?
GERALD R. GRANT, JR.: Correct, sir.
MR. WATKINS: Now, of course, we know that swipes in and swipes -- swipes in are recorded; swipes out are not?
GERALD R. GRANT, JR.: Not on this document, no, sir.
MR. WATKINS: I'm going to go next to 3126H. And what time was this tweet posted?
GERALD R. GRANT, JR.: With my translation, it was 12:46 p.m., Eastern Daylight Time, on April 16th.
MR. WATKINS: What time do you understand runners are generally finishing the Marathon?
MR. CHAKRAVARTY: Objection, your Honor.
THE COURT: Overruled. You may answer it.
MR. WATKINS: If you know, generally what time are people getting to the finish line of the Marathon?
GERALD R. GRANT, JR.: Typically, the Marathon starts off in sections with the females and the male sections in different stagings. But, typically, a little over two hours people will start rolling through. So if the men starts around 10:00 and then there's three stages, you'll see them 1:00, you know, 1:30, 2:00, somewhere in the early afternoon as well.
MR. WATKINS: So looking here at this tweet, this is at 12:46 p.m.?
GERALD R. GRANT, JR.: Yes, it is, sir.
MR. WATKINS: And through that data that you obtained, the backup data here, could you determine whether this was posted by a mobile device or through the web?
GERALD R. GRANT, JR.: It was posted through the web.
MR. WATKINS: And what is the significance of the difference between a mobile device and a web to post tweets?
GERALD R. GRANT, JR.: It indicates that it was posted from a computer that was on an actual web browser versus the app that was on an iPhone or an Android.
MR. WATKINS: So, now, with all that, can you read the substance of that tweet from April 16th at 12:46 p.m.?
GERALD R. GRANT, JR.: Yes, sir. It has the "@" symbol and then the name Enzo, E-n-z-o, underscore, U. And it says, "That's what's up glad to hear that, I'm all right and yea, summers gonna be amazing."
MR. WATKINS: Is there any mention about the Boston Marathon in that tweet?
GERALD R. GRANT, JR.: No, sir.
MR. WATKINS: Showing you 3126F, this is the next day?
GERALD R. GRANT, JR.: Correct, sir.
MR. WATKINS: And at what time is this post?
GERALD R. GRANT, JR.: It translated to 3:15 a.m., Eastern Daylight Time.
MR. WATKINS: What is the substance of this post?
GERALD R. GRANT, JR.: It states, "This was a great weekend."
MR. WATKINS: And in that Twitter post, there's no mention of the Boston Marathon?
GERALD R. GRANT, JR.: No, sir.
MR. WATKINS: No retweets of the Boston Marathon?
GERALD R. GRANT, JR.: No, sir.
MR. WATKINS: I'm going to fast-forward to a couple of dates in 2013. But first I want to do a little refresher about cell phones and cell data and cell towers. I'm going to put on the screen what's been admitted as Exhibits 1167-01 and 3002. So I'm going to put these side by side. First I'm going to go to 1167-01. Do you recognize what this is?
GERALD R. GRANT, JR.: Yes, I do, sir.
MR. WATKINS: What is it?
GERALD R. GRANT, JR.: It's the subscriber billing page for an AT&T call detail record.
MR. WATKINS: I'm going to highlight the top portion of this. Does it indicate who the financially liable party -- the billing party is?
GERALD R. GRANT, JR.: It does. It has the name Dzhokhar Tsarnaev.
MR. WATKINS: Does it also mention how long he's been a customer?
GERALD R. GRANT, JR.: Yes, since December 1, 2012.
MR. WATKINS: Does it indicate a phone number for both home and contact?
GERALD R. GRANT, JR.: It does have a home and work. They're both the same. The number is 857-247-5112.
MR. WATKINS: Is that number consistent with the call detail records that are in Exhibit 3002?
GERALD R. GRANT, JR.: It is, sir.
MR. WATKINS: I'm going to go to 3002 now. And is this the first page of the AT&T call detail records for Dzhokhar Tsarnaev's cell phone, with the last four digits 5112?
GERALD R. GRANT, JR.: It is, sir.
MR. WATKINS: How long is this set of records when printed out in paper form?
GERALD R. GRANT, JR.: The particular set was 515 pages.
MR. WATKINS: I want to focus on the last column here. And do you recognize that?
GERALD R. GRANT, JR.: I do, sir.
MR. WATKINS: What is that that's detailed in the last column?
GERALD R. GRANT, JR.: The last column is part of the individual records that shows the cell tower location that was utilized with that particular piece of activity. It starts out -- the first two numbers indicate basically the cell tower itself or the location that they've designated and then a specific antenna afterwards. Then it follows by two sets of coordinates, the first being the longitude for mapping and then the second being the latitude. They're a little bit backwards. Usually it's latitude/longitude. Finally, the last number would be what's called the azimuth, or the angle, that the sector of the antenna was pointed to.
MR. WATKINS: Now, with that information -- does this column run through the entire set of records?
GERALD R. GRANT, JR.: It does, sir.
MR. WATKINS: Are there some records where there is no cell tower information?
GERALD R. GRANT, JR.: Yes, correct.
MR. WATKINS: And how would that happen?
GERALD R. GRANT, JR.: It could be the phone didn't register. It could have been a bad signal at the time. It could have been the phone was off. There's a number of different things that would make it not happen.
MR. WATKINS: For the vast majority of the data in these call detail records, are there, in fact, latitude and longitude coordinates?
GERALD R. GRANT, JR.: Yes, there are, sir.
MR. WATKINS: Using those latitude and longitude coordinates, are you able to, through this activity log, determine particular cell tower sites associated with the data?
GERALD R. GRANT, JR.: Yes. Basically, because you have the latitude and longitude, you're able to plot the location of where the tower and/or the antennas are physically located. From there, you can take those two coordinates and put them into a mapping program to show the exact location.
MR. WATKINS: Now, you say "the exact location." That's not the exact location of the phone, is it?
GERALD R. GRANT, JR.: No. It's the location of the physical antenna which could reach out away from the antenna.
MR. WATKINS: As a very general matter -- and I understand all cell towers are different. As a general matter, what is the range of a cell tower?
GERALD R. GRANT, JR.: The range can vary. It depends on the geographical area and how many other cell towers are nearby. In all of my experience, with hundreds of these things, I've seen them anywhere from a half a mile to four miles out.
MR. WATKINS: Is it possible they could be 50 or 100 or 150 miles away?
GERALD R. GRANT, JR.: Physically, the capability of a GSM or an antenna really can't go beyond 26 miles, is what they've considered typical range with interference. It's normally not in an environment or a live environment because if an antenna reached out that far and crossed over other antennas, you would start dropping calls. It would be the equivalent of, if you had a radio station and you were between two cities and you heard the same radio station on that radio, the two different radio stations, you would hear two people talking and it would interfere. With a cell phone, if that happened, it would physically drop the call because there would be too much interference.
MR. WATKINS: Before we move away from Exhibit 3002, when does the call detail records start?
GERALD R. GRANT, JR.: As far as the date?
MR. WATKINS: The date that they began.
GERALD R. GRANT, JR.: The first date in this report is December 11, 2012.
MR. WATKINS: And we've seen that there's an indication that this person had been a customer since December 1 of 2012, right?
GERALD R. GRANT, JR.: That is correct, yes, sir.
MR. WATKINS: So we were talking a minute ago about April of 2012. Would these records have been any help to determine the geolocation of somebody in 2012?
GERALD R. GRANT, JR.: No, sir. They would not go back that far.
MR. WATKINS: Going back to the latitude and longitude, once you've identified the particular cell towers that are involved, are you able to plot that onto a map?
GERALD R. GRANT, JR.: Yes, I was.
MR. WATKINS: How does one go about doing that?
GERALD R. GRANT, JR.: Most of the normal mapping programs -- Google has one; there's Google Earth. There's the Google online. Microsoft has different types. They have maps and streets or streets and roads; also, Delorme. There's a number of different ones out there. As long as the mapping program itself will accept you entering the latitude and longitude in that order, it will plot that coordinate on the map. For my work, I normally use Google Earth, which is a free program that you can download, and it will allow you to plot individual items and then use that as location information.
MR. WATKINS: Indeed, have you done that kind of plotting to a map before in cases?
GERALD R. GRANT, JR.: Almost every case that I do is through that, yes, sir.
MR. WATKINS: Once you've plotted those cell towers, are you able to create an actual map that can be printed and used?
GERALD R. GRANT, JR.: Yes, sir.
MR. WATKINS: In addition to putting on cell site locations, can you also put on points of interest on these maps?
GERALD R. GRANT, JR.: Oh, absolutely. You can key in addresses, or you can actually zoom down to an area and put a marker if you know exactly where that specific point is.
MR. WATKINS: Now, for this case, did you locate particular times and dates for cell phone activity and plot them to maps?
GERALD R. GRANT, JR.: I did.
MR. WATKINS: I want to turn first to January 31, 2013. The screen you see, Exhibit 11 --
MR. WATKINS: This has already been admitted, your Honor.
THE COURT: It has, all right.
MR. WATKINS: Showing you Exhibit 1159, which documents the purchase of two pressure cookers at the Macy's Square One Mall in Saugus, Massachusetts, have you looked at this document before?
GERALD R. GRANT, JR.: I have, sir, yes.
MR. WATKINS: Let me see if I can get a -- does it indicate a specific time that the transaction occurred?
GERALD R. GRANT, JR.: Yes. The time is in military. 20:38 would indicate that it's 8:38 p.m.
MR. WATKINS: On the other side of the screen, I want to show you Government's Exhibit 1152-06. Do you recognize, as a general matter, what this is?
GERALD R. GRANT, JR.: I do, sir.
MR. WATKINS: What is it?
GERALD R. GRANT, JR.: This is a physical plotting of what's called GPS track points that were pulled from a GPS device. Those individual points, as the GPS is running, keeps track of its location plus the date and the time. And those are able to be imported into a mapping program to show the actual path of travel.
MR. WATKINS: And you did not prepare this map, correct?
GERALD R. GRANT, JR.: No, I did not.
MR. WATKINS: Did you actually go into the GPS to verify each point on this map that was plotted?
GERALD R. GRANT, JR.: I did not, sir, no.
MR. WATKINS: But taking a look at the exhibit, what does it indicate in regard to the plots that the government did here?
GERALD R. GRANT, JR.: It indicates that the actual GPS device itself stopped at 8:13 p.m. near a particular address. In this case it was 1201 Broadway, which relates to the Square One Mall in Saugus. It also indicates that the travel then resumed at 8:42 p.m. So it knows when it stopped and then when it started back up again.
MR. WATKINS: Is that consistent with what we saw over here, the purchase?
GERALD R. GRANT, JR.: Yes, sir. If you look, it's -- 8:38 was that purchase. So that would have been when the transaction was completed. And then, within four minutes, you see the device moving again.
MR. WATKINS: So this GPS that was ultimately recovered from a Mercedes tracks this purchase?
GERALD R. GRANT, JR.: It appears to be.
MR. WATKINS: Correlates to that purchase?
GERALD R. GRANT, JR.: It correlates, yes, sir.
MR. WATKINS: Now, using those times, the 8:38 p.m., were you able to go through Exhibit 3002, the call detail records, to find cell phone activity around those times?
GERALD R. GRANT, JR.: Yes, sir, I did.
MR. WATKINS: And did you find cell phone usage on January 31st in the evening?
GERALD R. GRANT, JR.: I did, sir.
MR. WATKINS: Once you found data on -- from the call detail records, were you able to locate the cell towers that they were associated with?
GERALD R. GRANT, JR.: Yes, sir. I utilized that same latitude and longitude GPS information that was associated with the activity and plotted that location on Google Earth.
MR. WATKINS: So this, again, is on January 31 of 2013 at the same time the Square One Mall purchase was being made?
GERALD R. GRANT, JR.: It was around that time, yes, sir, not exact time.
MR. WATKINS: This should just go to the witness, your Honor.
MR. WATKINS: Showing you what's been marked Defendant's Exhibit 3127, do you recognize that?
GERALD R. GRANT, JR.: I do, sir.
MR. WATKINS: How do you recognize it?
GERALD R. GRANT, JR.: This is an exhibit that I prepared in preparation of my testimony.
MR. WATKINS: What does this exhibit document?
GERALD R. GRANT, JR.: It documents the location of the Macy's store at the Square One Mall as well as the location of the cell towers that were associated with the activity of the cell phone that ended in 5112.
MR. WATKINS: In regard to the Square One Mall, just some housekeeping, how were you able to determine an address for the Square One Mall that you put on this map?
GERALD R. GRANT, JR.: There's two pieces of information to pull up location of a store. One, on the receipt itself or the actual transaction, it did show that it was -- the store name was Square One. More importantly, though, on the third column, it actually showed the store location number, which in this case was 226. I was able to utilize Google and do a search of the actual store website and was able to find the address of that particular store and the location based on that.
MR. WATKINS: Your Honor, I'd move Defendant's Exhibit 3127 into evidence.
MR. CHAKRAVARTY: No objection, your Honor.
THE COURT: Okay.
(Defendant's Exhibit No. 3127 received into evidence.)
MR. WATKINS: May it be published?
MR. WATKINS: So, again, this is a map that you prepared?
GERALD R. GRANT, JR.: Yes, sir.
MR. WATKINS: Can you circle where the Square One Mall is in relation to this map?
GERALD R. GRANT, JR.: Okay. Based on my plotting, I marked the location of the Square One Macy's up in the northern part of the map.
MR. WATKINS: Can you circle where the activity on the -- Dzhokhar Tsarnaev's 5112 phone was?
GERALD R. GRANT, JR.: Yes, sir. That activity was down south around the location of the University of Massachusetts.
MR. WATKINS: And how did you know that it was close to the University of Massachusetts?
GERALD R. GRANT, JR.: With the Google Earth program, once I plot those latitude and longitude information, I can zoom correctly right into an actual street level. So I was able to zoom right down, pull in and actually look right at the university.
MR. WATKINS: Between those two spots in Saugus and in Dartmouth, at the University of Massachusetts, is Boston and Cambridge, correct?
GERALD R. GRANT, JR.: Yes, sir.
MR. WATKINS: Now, during that period of around 8:38 in the evening, is there any indication that Dzhokhar Tsarnaev's 5112 telephone was in the Saugus area?
GERALD R. GRANT, JR.: No, sir.
MR. WATKINS: Is there any indication that Dzhokhar Tsarnaev's 5112 telephone was -- ever left the Dartmouth/New Bedford area?
MR. CHAKRAVARTY: Objection to form, your Honor. This is leading.
THE COURT: Overruled.
GERALD R. GRANT, JR.: Could you repeat it just so I'm --
MR. WATKINS: Yes. Is there any indication that Dzhokhar Tsarnaev's 5112 phone left the Dartmouth/New Bedford area on the evening of January 31, 20 --
GERALD R. GRANT, JR.: No, sir. All activity was related to cell towers around the University of Massachusetts.
MR. WATKINS: You anticipated my next question, I think. You plotted some points. You have not plotted all of the points for that day?
GERALD R. GRANT, JR.: Not on this map, sir, no.
MR. WATKINS: Indeed, you have all the plots for the entire call detail record, correct?
GERALD R. GRANT, JR.: I do, sir, yes.
MR. WATKINS: Your Honor, may I have just for the witness?
MR. WATKINS: I'm putting before you another -- a page from a document that's been identified as Defendant's Exhibit 3130. Have you seen this before?
GERALD R. GRANT, JR.: I have, sir, yes.
MR. WATKINS: I'm going to scroll through this. What is it called?
GERALD R. GRANT, JR.: It's called a patron history.
MR. WATKINS: What do you understand this to be?
GERALD R. GRANT, JR.: This is the log file of when a person uses what's called a meal card and they go to participating restaurants, stores, patrons of that, and can swipe that card to purchase items.
MR. WATKINS: Did you --
MR. WATKINS: Your Honor, I'd move for admission of this page of 3130.
MR. CHAKRAVARTY: No objection, your Honor.
THE COURT: It's Page 4?
MR. WATKINS: Page 4 of Exhibit 3130.
(Defendant's Exhibit No. 3130 received into evidence.)
THE COURT: All right. May it be published to the jury?
MR. WATKINS: What does this indicate about what happened with Dzhokhar Tsarnaev's meal swipe card?
GERALD R. GRANT, JR.: The highlighted area shows two actual transactions on January 31, 2013. One is at 6:54 p.m., indicating that the participant, or Wendy's, was activated.
MR. WATKINS: Just to circle around again, 6:54, purchase for lunch. A cell phone was around the area of UMass Dartmouth and a purchase in Saugus was being made at 8:38?
GERALD R. GRANT, JR.: Correct, sir.
MR. WATKINS: I want to move next to March 6 of 2013. We've heard about a trip to New Hampshire to buy BBs. I want to show you first Government's Exhibit 1161-02 and 1161 -- let's do it this way -- 1161-03. Have you seen these documents before?
GERALD R. GRANT, JR.: I have, sir.
MR. WATKINS: And what are they?
GERALD R. GRANT, JR.: These are receipts from two specific stores, which would be Wal-Mart stores.
MR. WATKINS: Turning first to 1161-02, what is the date and time of the purchase there?
GERALD R. GRANT, JR.: This is actually the terminal idle. The purchase is a little further down. But it's at March 6 -- I apologize for that. Yes. March 6th, at 15:22:11, military time, which would indicate 3:22 p.m.
MR. WATKINS: Were you able to determine which Wal-Mart store this purchase took place at?
GERALD R. GRANT, JR.: Yes, I was. On the receipt itself -- and you can see it here -- the store itself, all of the receipts indicate a specific Wal-Mart store number, in this case 2399. You can go right to the internet, to the Wal-Mart.com, put in "/" store and then "2399," and it will actually take you to the address and everything of that store. So they're broken down on their website by store number.
MR. WATKINS: Going to this other receipt, start from the end. First, were you able to determine what Wal-Mart store this was?
GERALD R. GRANT, JR.: Yes. As you can see up top here, this indicates that it's Store 1796, which would be the Amherst, New Hampshire, store.
MR. WATKINS: Can you determine the time of this particular purchase?
GERALD R. GRANT, JR.: Yes. Down below here, you can see, again, this was on March 6, 2013. Military time is 17:34:06, indicating at 5:34 p.m.
MR. WATKINS: Next I'm going to show you Government's Exhibit 1152-07. This is a GPS recovered from a Honda Odyssey plot from March 6, 2013, that same day that BBs were purchased. Have you looked at this exhibit before?
GERALD R. GRANT, JR.: I have, sir, yes.
MR. WATKINS: Again, you did not prepare this. This is a government exhibit?
GERALD R. GRANT, JR.: That's correct, sir.
MR. WATKINS: Having looked at it, are the times that have been plotted out consistent with the locations and the purchases that you saw?
GERALD R. GRANT, JR.: Yes, they are.
MR. WATKINS: Using those dates and times from the government exhibit, were you able to go to Exhibit 3002 and determine where Dzhokhar Tsarnaev's 5112 cell phone was?
GERALD R. GRANT, JR.: Yes, I was.
MR. WATKINS: This should only go to the witness, your Honor.
MR. WATKINS: And did you plot those locations using Google Earth to a map?
GERALD R. GRANT, JR.: I did, sir.
MR. WATKINS: And did you also put on the two Wal-Marts at issue?
GERALD R. GRANT, JR.: I did, sir, yes.
MR. WATKINS: This map that you see before you is Defendant's Exhibit 3128. Is that accurate as to the Dzhokhar Tsarnaev 5112 cell phone and the two Wal-Marts?
GERALD R. GRANT, JR.: It is correct, sir, yes.
MR. WATKINS: Your Honor, I'd move for admission of Defendant's Exhibit 3128.
MR. CHAKRAVARTY: No objection.
THE COURT: Okay.
(Defendant's Exhibit No. 3128 received into evidence.)
MR. WATKINS: May we publish that to the jury?
MR. WATKINS: So take us through this exhibit. What does this indicate about where Dzhokhar Tsarnaev's 5112 cell phone was while purchases were being made in New Hampshire?
GERALD R. GRANT, JR.: Again, I utilized the AT&T call detail records, and I took the specific items and the latitude and longitude of activity, plotted that on this map, which indicates the location of the cell towers that would have been the ones that were associated with the specific items.
MR. WATKINS: And down at the bottom is the activity for that phone?
GERALD R. GRANT, JR.: Yes, it is. I can indicate it by circling it here.
MR. WATKINS: And how does that compare to the purchases that were made at the Manchester and Amherst Wal-Mart stores?
GERALD R. GRANT, JR.: As you can see up at the top, we have the Manchester here and then the Amherst here, indicating the distance between the two.
MR. WATKINS: Given your knowledge of cell phone and cell tower distances, is it at all possible that a phone could be up in the New Hampshire area at the time of those purchases given this data?
GERALD R. GRANT, JR.: It would not be -- no, it could not reach the towers.
MR. WATKINS: During this time on March 6 of 2013, is there any indication that Dzhokhar Tsarnaev's 5112 phone was in the Cambridge or Saugus -- Cambridge area?
MR. WATKINS: Is there any indication from March 6th data that Dzhokhar Tsarnaev's telephone ever left the Dartmouth/New Bedford area?
GERALD R. GRANT, JR.: There is no evidence, no, or indication.
MR. WATKINS: That's all I have, your Honor.
CROSS-EXAMINATION BY MR. CHAKRAVARTY:
MR. CHAKRAVARTY: Good afternoon.
GERALD R. GRANT, JR.: Good afternoon, sir.
MR. CHAKRAVARTY: We haven't met, have we?
GERALD R. GRANT, JR.: No, we have not.
MR. CHAKRAVARTY: I just wanted to clarify the circumstances of your being here. You said that you work both for the Federal Defender's Office as well as you free-lance in your private company?
GERALD R. GRANT, JR.: Yes, sir.
MR. CHAKRAVARTY: Are you paid for your service in this case?
GERALD R. GRANT, JR.: I come here as a representative of the Federal Defender Office, so my regular salary would cover that.
MR. CHAKRAVARTY: So let's first start with some of the discussion that you were giving us with regard to tweets.
GERALD R. GRANT, JR.: Yes, sir.
MR. CHAKRAVARTY: Twitter. A lot of what you know about Twitter is from your own experience using the platform, is that right?
GERALD R. GRANT, JR.: Using it and working with, also, other discovery and returns from Twitter accounts.
MR. CHAKRAVARTY: Okay. But you don't have any specialized training in how to deal with Twitter, do you?
GERALD R. GRANT, JR.: Not specifically to Twitter or from Twitter, no, sir.
MR. CHAKRAVARTY: So you're just using your experience, your use of Twitter itself, as well as your review of materials that were provided by Twitter in this case with regards to the defendant's Twitter account?
GERALD R. GRANT, JR.: That is correct, sir.
MR. CHAKRAVARTY: And so Twitter provides the timing of its tweets in a form that's under the Universal time or UTC, which is about four hours greater -- further along -- it's Greenwich Mean Time, I should say?
GERALD R. GRANT, JR.: Right, yes, sir.
MR. CHAKRAVARTY: Like the time it would be in England compared to the time it would be here in Boston?
GERALD R. GRANT, JR.: Yes. And it's offset differently depending on Daylight Savings or not.
MR. CHAKRAVARTY: You really made the calculations from those times that the Twitter told you, and you created the exhibits that Mr. Watkins asked you to authenticate today?
GERALD R. GRANT, JR.: Yes. They were verified through UTC time, yes, sir.
MR. CHAKRAVARTY: So one of the tweets actually wasn't still existing on the Twitter feed. And that's the one you had to rely on the Twitter information for?
GERALD R. GRANT, JR.: Yes. The information that was returned, correct.
MR. CHAKRAVARTY: But the rest of the tweets you talked about were all tweets around the day, Patriots' Day 2012, the day of the Boston Marathon?
GERALD R. GRANT, JR.: Correct, sir.
MR. CHAKRAVARTY: So there was a tweet before, and then there were a few tweets the day before and then a few tweets the day after?
GERALD R. GRANT, JR.: Yes, sir.
MR. CHAKRAVARTY: Those tweets are, as they appear, except for that one, in the full Twitter listing that Mr. Watkins showed you, I think, 3001, I believe?
GERALD R. GRANT, JR.: Correct, sir.
MR. CHAKRAVARTY: So you don't know what the defendant was doing when he wasn't tweeting that day, right?
GERALD R. GRANT, JR.: You mean, like, in between the times?
MR. CHAKRAVARTY: Right.
GERALD R. GRANT, JR.: No, I have no idea, sir.
MR. CHAKRAVARTY: So you don't know that he actually did go to the Marathon later that day?
GERALD R. GRANT, JR.: I have no knowledge of that.
MR. CHAKRAVARTY: If he went in the afternoon and he hung out with his friend Steve Silva, you wouldn't know that unless there was a tweet at that time, right?
MR. WATKINS: Object.
THE COURT: Overruled.
GERALD R. GRANT, JR.: I would have no knowledge of that, no, sir.
MR. CHAKRAVARTY: Did he tweet during the Boston Marathon?
GERALD R. GRANT, JR.: There was a -- the one tweet was around 1:00. Yeah, there was. Let me see. I would have to look at the actual exhibit again, if I could.
MR. CHAKRAVARTY: Do you have those in front of you?
GERALD R. GRANT, JR.: I do if that's okay if I go through them.
MR. CHAKRAVARTY: Mr. Watkins, I might need your help in presenting your exhibits. 3126H, I think.
GERALD R. GRANT, JR.: Okay.
MR. CHAKRAVARTY: Is this the tweet, the one that just put up as 3126H, this is the tweet that you're referring to?
GERALD R. GRANT, JR.: I'm not seeing anything right now. Correct. That is one, as you can see, based on the UTC time in the log. It was translated into 12:46 p.m. Eastern Daylight Time.
MR. CHAKRAVARTY: What you know about that tweet is that the user J_tsar tweeted this tweet using a web browser?
MR. CHAKRAVARTY: So a web browser is opposed to a mobile phone app, correct?
GERALD R. GRANT, JR.: It's a standard -- yes, like Internet Explorer or Safari or something like that.
MR. CHAKRAVARTY: That's what Twitter tells you, that he used a web browser versus an --
GERALD R. GRANT, JR.: An iPhone.
MR. CHAKRAVARTY: Correct?
GERALD R. GRANT, JR.: Correct.
MR. CHAKRAVARTY: Does it tell where that web browser was used?
GERALD R. GRANT, JR.: No, it does not.
MR. CHAKRAVARTY: So it doesn't tell you whether it was the browser on a phone, right?
GERALD R. GRANT, JR.: It could be if the phone was plugged in or logged in as the browser, yes, sir.
MR. CHAKRAVARTY: Well, if you have a smart phone, say you have an iPhone, you have an Safari browser on the iPhone, don't you?
GERALD R. GRANT, JR.: Correct.
MR. CHAKRAVARTY: You have an Android version. You might have Firefox. You might have the Android version of an internet browser. You might have Internet Explorer, right?
GERALD R. GRANT, JR.: Correct.
MR. CHAKRAVARTY: And so, in fact, if you log into Twitter on a browser using your mobile phone, it comes up as a browser tweet, doesn't it?
GERALD R. GRANT, JR.: Correct.
MR. CHAKRAVARTY: So this doesn't tell you much more than he tweeted at about 1:00 in the afternoon on April 16, 2012, right?
GERALD R. GRANT, JR.: Correct.
MR. CHAKRAVARTY: Now, can we go to 3126B, please?
MR. CHAKRAVARTY: Now, this was the tweet which you corrected the time for. This was also tweeted out on that Marathon Monday, correct?
GERALD R. GRANT, JR.: Yes, sir.
MR. CHAKRAVARTY: Early in the morning, right?
GERALD R. GRANT, JR.: Correct.
MR. CHAKRAVARTY: And it was a quote, in quotation marks, correct?
GERALD R. GRANT, JR.: Correct.
MR. CHAKRAVARTY: And I think you referred to the UMass Dartmouth swipe card records to show that Dzhokhar Tsarnaev swiped into a dorm room at Maple Ridge Hall a couple hours after this, I think three hours after this; is that fair to say?
GERALD R. GRANT, JR.: It's fair to say, yes, sir. I don't know exact time but, yes.
MR. CHAKRAVARTY: A little later that morning?
GERALD R. GRANT, JR.: Correct.
MR. CHAKRAVARTY: So you don't know at what time after this tweet Jahar Tsarnaev went up to Boston, the 45-or-minute-so ride, right?
MR. WATKINS: Object to the form of the question, your Honor.
THE COURT: Overruled.
GERALD R. GRANT, JR.: Can you repeat it, sir?
MR. CHAKRAVARTY: Is it about 45 minutes to get from UMass Dartmouth to Boston?
GERALD R. GRANT, JR.: I'm not familiar, but it appears about that time, yes, sir.
MR. CHAKRAVARTY: And so you don't know at what time he left UMass Dartmouth to go to Boston, do you?
MR. WATKINS: Objection.
THE COURT: Sustained.
MR. CHAKRAVARTY: You don't know where he picked Steve Silva up, either at UMass Dartmouth or in Cambridge?
MR. WATKINS: Objection.
THE COURT: Sustained.
MR. CHAKRAVARTY: In fact, when was the next time that Jahar Tsarnaev swiped back into UMass Dartmouth?
GERALD R. GRANT, JR.: I would need to look at the records, if I could, sir.
MR. CHAKRAVARTY: Please do if we have the exhibit.
GERALD R. GRANT, JR.: So the next swipe after the 4/16 would have been on 4/17 at 1:38 a.m.
MR. CHAKRAVARTY: 1:38 a.m.?
GERALD R. GRANT, JR.: Yes, sir.
MR. CHAKRAVARTY: So it's possible that Jahar Tsarnaev left UMass Dartmouth, went to the Marathon with his friend Steve Silva, and came back in the early morning hours of the next day?
MR. WATKINS: Objection.
THE COURT: Rephrase it.
MR. CHAKRAVARTY: Based on the records that you just described, is it possible that Jahar Tsarnaev went to the Boston Marathon during Patriots' Day and returned early in the morning the next day?
GERALD R. GRANT, JR.: When you say "based on the records," you're talking about the swipe cards?
MR. CHAKRAVARTY: The swipe card.
GERALD R. GRANT, JR.: I do not know where he would be anywhere between those times based on this.
MR. CHAKRAVARTY: Let's say beyond the swipe card records, is there any other data that you're aware of that would contradict that?
MR. WATKINS: Objection, your Honor.
THE COURT: No. You may answer that.
GERALD R. GRANT, JR.: There's phone activity where the 5112 is in that area down by UMass.
MR. CHAKRAVARTY: At some point later in that day?
MR. CHAKRAVARTY: And then --
MR. WATKINS: Can we clarify which day, please?
MR. CHAKRAVARTY: On Patriots' Day on April 26th?
GERALD R. GRANT, JR.: On 4/16.
MR. CHAKRAVARTY: 4/16.
MR. WATKINS: What year?
MR. CHAKRAVARTY: 2012.
GERALD R. GRANT, JR.: 2012, yes, sir.
MR. CHAKRAVARTY: And you don't know whether he went to the Marathon that day or not, do you?
GERALD R. GRANT, JR.: I'm not aware of any of that information, no, sir.
MR. CHAKRAVARTY: Now, let's talk about the exhibit --
PAUL BRUEMMER: Mr. Bruemmer, if you can call up 1167?
MR. CHAKRAVARTY: Let's talk about some of those phone records you were just referring to.
MR. CHAKRAVARTY: Your Honor, if we could have the government's terminal?
MR. CHAKRAVARTY: Mr. Watkins showed you this exhibit, which is the subscriber information for that phone number, AT&T number ending with 5112, is that right?
GERALD R. GRANT, JR.: That is correct, sir.
MR. CHAKRAVARTY: And this shows that it's subscribed to Dzhokhar Tsarnaev, but it lists an address of 69 Carriage Drive, New Bedford, correct?
GERALD R. GRANT, JR.: It does, yes, sir.
MR. CHAKRAVARTY: You know that was the address of the defendant's friends, Dias Kadyrbayev and Azamat Tazhayakov, right?
GERALD R. GRANT, JR.: Actually, I wasn't aware. I just knew it as an address. I didn't know who it was.
MR. CHAKRAVARTY: Did you review the phone records?
GERALD R. GRANT, JR.: I reviewed the phone record. I knew that it was the Carriage Street, but I didn't know the details of that address.
MR. CHAKRAVARTY: You must have known that this was a family plan that involved both Dzhokhar Tsarnaev as well as his friends, Dias Kadyrbayev and Azamat Tazhayakov?
GERALD R. GRANT, JR.: I was aware there were other phones that were associated with this account, yes, sir.
MR. CHAKRAVARTY: In fact, the account had a balance that hadn't been paid, and the cell phone service had been deactivated at the time of the Boston Marathon, is that correct?
MR. WATKINS: Objection, your Honor. It's far beyond the scope. I mean, he's not going to know.
GERALD R. GRANT, JR.: I -- I don't know. I mean, I can't say whether it was terminated or not. I wasn't -- where I see it says "suspended," I don't know when. I would assume at some point after 4/19.
MR. CHAKRAVARTY: Well, you suggested you had some familiarity with these records.
GERALD R. GRANT, JR.: Yes, sir.
MR. CHAKRAVARTY: Did you know -- did you review the records of the other phone numbers associated with this account?
MR. WATKINS: I'm going to object, your Honor. Beyond the scope.
THE COURT: Overruled.
GERALD R. GRANT, JR.: I did look at the other numbers, yes, sir.
MR. CHAKRAVARTY: Now, with respect to this phone, do you know what kind of a phone it was?
GERALD R. GRANT, JR.: The physical phone?
MR. CHAKRAVARTY: Physical phone.
GERALD R. GRANT, JR.: I'm not quite sure, but I think it may have been an iPhone. If not, I think it may have been an Android. I don't know the actual physical phone because I did not see them. I didn't have access.
MR. CHAKRAVARTY: None of the records that you reviewed from the telephone company told you whether it was an iPhone?
GERALD R. GRANT, JR.: I didn't see anything that indicated that, no.
MR. CHAKRAVARTY: You described earlier that you've been trained in cell site -- historical cell site location analysis, is that right?
GERALD R. GRANT, JR.: Correct, sir.
MR. CHAKRAVARTY: You received that training sometime back in 2008, 2009, is that right?
GERALD R. GRANT, JR.: The training has been ongoing. And then if other options are available for training, I take those as well as develop my own training and teaching, yes, sir.
MR. CHAKRAVARTY: You described that you went -- you were on the so-called lecture circuit before. Does that mean you were speaking?
MR. WATKINS: Objection, your Honor, please, the characterization.
THE COURT: Go ahead.
MR. CHAKRAVARTY: Does that mean you were presenting; you were teaching others or you were receiving trainings?
GERALD R. GRANT, JR.: Both. There were times that I went and heard lectures from others and got certificates as well as talked with the cell phone companies and also developed and taught it.
MR. CHAKRAVARTY: So you've gone to AT&T? You've received training from AT&T as to how to handle their cell phone records?
GERALD R. GRANT, JR.: Not from AT&T. I worked closely with a representative, an engineer, from T-Mobile on a couple of cases. And we went through all the plotting processes to make sure that we were actually the same.
MR. CHAKRAVARTY: You know that AT&T and T-Mobile actually do things differently, right?
GERALD R. GRANT, JR.: As far as what? I'm not quite sure what you mean.
MR. CHAKRAVARTY: In terms of the cell site location data that they present.
GERALD R. GRANT, JR.: The data looks differently, yes. It's going to be presented differently.
MR. CHAKRAVARTY: In fact, even the technology that they use, especially on a 4G system, with regard to figuring out which cell site and what the azimuth is for each cell site; you know that's different, too, right?
GERALD R. GRANT, JR.: Correct. Each one is going to have a different one depending on where the location of the antenna is.
MR. CHAKRAVARTY: So you actually haven't had training with AT&T on how to read their records specifically for purposes of historical cell site analysis?
GERALD R. GRANT, JR.: I'm aware of it, and it includes the actual latitude and longitude of the physical antenna. So there is nothing beyond -- if we're plotting just that location, that is the only information that would be needed.
MR. CHAKRAVARTY: So you haven't had any training specifically with regards to AT&T -- that AT&T has provided with regard to how to do cell site analysis on their records?
GERALD R. GRANT, JR.: Not specifically from AT&T, no, sir.
MR. CHAKRAVARTY: So if you had, you would have known that AT&T does not provide reliable data usage records that's useful for cell site analysis; did you know that?
GERALD R. GRANT, JR.: I'm aware that the data -- because it's in hour blocks. I'm aware of that, yes, sir.
MR. CHAKRAVARTY: You're aware that it's not a reliable indicator of where a phone is at a time that the record shows that data usage was used?
GERALD R. GRANT, JR.: I'm not aware of that, no.
MR. CHAKRAVARTY: So if we can call up 3127, please, your Honor, Mr. Watkins' computer?
MR. CHAKRAVARTY: So this was 3127A, a plot that you prepared that shows the defendant's phone down in Dartmouth on the evening of January 31 of 2013, is that right?
GERALD R. GRANT, JR.: Correct.
MR. CHAKRAVARTY: And you used, to show that the phone was down in Dartmouth at the time of a purchase of a pressure cooker in Macy's in Saugus, you showed two entries. One is a 6:50 p.m. -- sorry -- 6:50 p.m. outbound text?
GERALD R. GRANT, JR.: Uh-huh.
MR. CHAKRAVARTY: And the other is a 9:03 p.m. data usage, correct?
GERALD R. GRANT, JR.: Correct.
MR. CHAKRAVARTY: And so if the data usage is not reliable from AT&T, then we really should be focusing on the text; would that be fair to say?
GERALD R. GRANT, JR.: It would be fair, yes, sir.
MR. CHAKRAVARTY: So the distance between Saugus and Dartmouth at about 7 or 8 p.m. on January 31st is less than an hour, isn't it?
GERALD R. GRANT, JR.: I do not know that, but I would have to refer to you on that.
MR. CHAKRAVARTY: Now, in addition to the fact that there was an outbound text from that phone number, from the 5112 number, did you happen to look at some of the -- you said, I think, you looked at all of the other call data, and you plotted it out for the 5112 phone, isn't that right?
GERALD R. GRANT, JR.: Previously, yes, sir.
MR. CHAKRAVARTY: And so you know that, in fact, this outbound text that he sent was a text to Tamerlan Tsarnaev, didn't you?
GERALD R. GRANT, JR.: I'm aware of that, yes, sir.
MR. CHAKRAVARTY: In fact, he had had a previous text with Tamerlan Tsarnaev and a text after this one with Tamerlan Tsarnaev that evening?
GERALD R. GRANT, JR.: I'm aware of the one previously. I'm not aware of the one after, no, sir.
MR. CHAKRAVARTY: Are you aware that they spoke for over, I think, four minutes earlier that day --
GERALD R. GRANT, JR.: I did not look at that detail, no, sir.
MR. CHAKRAVARTY: -- on the phone? That wouldn't surprise you if there was a call between the two on January 31st for about four minutes and 19 seconds?
GERALD R. GRANT, JR.: I can't say that it wouldn't surprise me, but I'm not aware of it.
MR. CHAKRAVARTY: Now, when you identify an entry from -- that you create a plot for, that tells you that there was some phone activity with a tower located where it's shown on the plot at a certain time, correct?
GERALD R. GRANT, JR.: Correct, sir.
MR. CHAKRAVARTY: It doesn't tell you who was using the phone, right?
GERALD R. GRANT, JR.: No, sir.
MR. CHAKRAVARTY: It doesn't tell you how far away that person was from the tower, right?
GERALD R. GRANT, JR.: Correct.
MR. CHAKRAVARTY: And it doesn't tell you what the location data is about the other person with whom they're communicating, correct?
GERALD R. GRANT, JR.: No, sir, it does not.
MR. CHAKRAVARTY: Now, did you do a similar analysis for Tamerlan Tsarnaev's phone?
GERALD R. GRANT, JR.: As far as -- what do you mean a similar --
MR. CHAKRAVARTY: Plotting where his phone was at different times.
MR. WATKINS: Objection, your Honor.
THE COURT: Sustained.
MR. CHAKRAVARTY: One moment, your Honor.
MR. CHAKRAVARTY: You were asked several questions about the Boston Marathon in relation to the Twitter information. In fact, the last wave of the Boston Marathon starts at about 10:40 a.m., is that right?
GERALD R. GRANT, JR.: Yes. I am to believe that, yes, sir.
MR. WATKINS: Your Honor, I'm going to object. The government objected on this before.
MR. CHAKRAVARTY: I think the door was opened, your Honor.
THE COURT: Yeah. You can have it. Go ahead.
MR. CHAKRAVARTY: After the elite runners come in in about two hours, a little over that, the Marathon continues for several hours after that; isn't that fair to say?
GERALD R. GRANT, JR.: Yes, because the first runners are going to come in, and others are going to come in afterwards, yes, sir.
MR. CHAKRAVARTY: In fact, you know that around 2:49 in the afternoon the Marathon is still going, correct?
GERALD R. GRANT, JR.: I believe so, correct.
MR. CHAKRAVARTY: So if somebody attended the Marathon in the afternoon, they still would have been able to observe the runners as well as participate in the activities?
GERALD R. GRANT, JR.: I would believe so, yes.
MR. CHAKRAVARTY: If we could go to 3128, please, Mr. Watkins?
MR. CHAKRAVARTY: This was the other plot that you did for March 6, 2013, correct?
GERALD R. GRANT, JR.: Yes, sir.
MR. CHAKRAVARTY: Again, you used the GPS data that was in a government exhibit, and then you plotted onto that where the defendant's cell phone was the evening of March 6th, correct?
GERALD R. GRANT, JR.: Correct.
MR. CHAKRAVARTY: Now, with regards to these purchases up at the Wal-Marts, they were of BBs, is that right?
GERALD R. GRANT, JR.: I believe so, yes.
MR. CHAKRAVARTY: You saw the receipts just a little while ago, and they matched up in time?
GERALD R. GRANT, JR.: Yes, sir.
MR. CHAKRAVARTY: You don't know whether -- or, rather, you do know that there was no video or anything else identifying Tamerlan Tsarnaev as the purchaser of those BBs, right?
GERALD R. GRANT, JR.: I'm not aware of, no.
MR. CHAKRAVARTY: You don't know where Tamerlan's phone was at that time, do you?
MR. WATKINS: Objection.
THE COURT: Sustained.
MR. CHAKRAVARTY: And you don't know who then actually purchased those BBs, do you?
MR. WATKINS: Objection.
THE COURT: Sustained.
MR. CHAKRAVARTY: You don't know what vehicle was up there at that time, do you?
MR. WATKINS: Objection.
THE COURT: Sustained.
MR. CHAKRAVARTY: Is there anything in the data that you reviewed in your preparation for this case that shows that it was Tamerlan that made those purchases?
GERALD R. GRANT, JR.: No, I did not see anything that would corroborate that in any way.
MR. CHAKRAVARTY: With regard to the Macy's purchase, there was also no videotape for the Macy's pressure cooker purchase, correct?
GERALD R. GRANT, JR.: I'm aware of that, yes, sir.
MR. CHAKRAVARTY: You didn't review any videotape that --
GERALD R. GRANT, JR.: No, sir, no.
MR. CHAKRAVARTY: Now, the defendant and his brother communicated on other days that components of the bombs and other things were purchased, correct?
GERALD R. GRANT, JR.: I believe so. I didn't go through all of the detail of who contacted who. I was looking more of location information.
MR. CHAKRAVARTY: In fact, even on April 14th, the day before the Marathon bombing --
MR. WATKINS: I'm going to object, your Honor.
THE COURT: Sustained. Beyond the scope.
MR. CHAKRAVARTY: Just one moment, your Honor.
That's all I have, your Honor.
MR. WATKINS: Just a couple.
REDIRECT EXAMINATION BY MR. WATKINS:
MR. WATKINS: Showing you Exhibit 3002 -- you have many years of experience as a computer forensic investigator, correct?
GERALD R. GRANT, JR.: Yes, sir.
MR. WATKINS: You don't need to have several years of a computer forensic investigator to be able to plug in longitude and latitude into a Google Earth program, correct?
GERALD R. GRANT, JR.: No, sir. They're numbers, yes, sir.
MR. WATKINS: They are just two numbers, and really anybody can do that, is that correct?
GERALD R. GRANT, JR.: That's correct, yes.
MR. WATKINS: You were able to use some more sophisticated tools in order to map it, but anybody could punch these into Google Maps and come up with a location, right?
MR. CHAKRAVARTY: Objection, your Honor.
THE COURT: Overruled. Go ahead.
MR. WATKINS: No training from AT&T, T-Mobile or anybody else is really necessary to get those coordinates?
GERALD R. GRANT, JR.: Correct.
MR. WATKINS: 3127, 9:03 p.m. data usage for 5112, would it be possible for the Dzhokhar Tsarnaev 5112 phone to be anywhere else but the UMass New Bedford area and hit off a cell phone tower at 9:03 p.m.?
GERALD R. GRANT, JR.: Based on the records that came from AT&T, it would put that tower there, yes, sir.
MR. WATKINS: Mr. Chakravarty asked you about the distance in time between New Bedford -- or, I'm sorry, Dartmouth and Saugus; do you remember that?
GERALD R. GRANT, JR.: Yes, sir.
MR. WATKINS: He suggested it was less than an hour, and you don't know?
GERALD R. GRANT, JR.: I'm not familiar with the area of the drive.
MR. WATKINS: You're from Rochester. Why should you be?
GERALD R. GRANT, JR.: Correct.
MR. WATKINS: But neither you nor Mr. Chakravarty knows exactly how long it takes to get to the Square One Mall?
GERALD R. GRANT, JR.: I wouldn't know that and any traffic could even make a difference.
MR. WATKINS: One could do that by going to Google Maps, as we all do, and --
MR. CHAKRAVARTY: Objection, your Honor. Leading.
THE COURT: Sustained.
MR. WATKINS: For any place, one could determine the time it takes to go from one spot to another using Google Maps, correct?
MR. CHAKRAVARTY: Objection.
THE COURT: Go ahead. You may answer that.
GERALD R. GRANT, JR.: Yes. You can take two points and Google Maps, Google Earth, a beginning and ending, and it will map out an estimated time.
MR. WATKINS: So if the government wanted to prepare an exhibit --
MR. CHAKRAVARTY: Objection, your Honor.
MR. WATKINS: -- to talk about how long it took, they could do that very easily?
THE COURT: The objection is sustained.
MR. WATKINS: I have no nothing further, your Honor.
THE COURT: Anything else?
All right, sir. Thank you. You may step down.
GERALD R. GRANT, JR.: Thank you.
THE COURT: I think that's as far as we'll go today with the evidence, jurors. Another productive day. We'll moving along. Again, I urge you to avoid any conversations about the matters at issue among yourselves or anybody else. Avoid any investigations and of course any news reports. Have a good evening. We'll see you tomorrow morning.
(Whereupon, at 3:30 p.m. the trial recessed.)