This AI Tool Aided in Convicting Individuals of Murder. Then Someone Examined it More Closely
Global Intelligence asserts that its Cybercheck technology aids law enforcement in uncovering crucial evidence to strengthen a case. However, an inquiry shows that the incriminating evidence frequently seems much weaker.
RIGHT AFTER 9 pm on an August evening in 2020, Kimberly Thompson and Brian James drove the car into a driveway in Akron, Ohio, and exited into a hail of bullets. They were injured in the legs, taken to a hospital quickly, and lived. However, Thompson’s 20-month-old grandson, Tyree Halsell, who remained in the car, was shot in the head and fatally injured.
Following the incident, Akron police gathered video evidence from the area and sought the community’s assistance in identifying two individuals who were observed approaching the victims, shooting, and then escaping in a truck. In just a few months, investigators focused on a suspect, Phillip Mendoza, and acquired a search warrant for his cell phone location information from Sprint, as stated in court documents. They additionally issued a geofence warrant to Google, requesting details on devices with GPS, Wi-Fi, or Bluetooth data that positioned them in proximity to the location of the shooting. Both warrants failed to find any evidence placing Mendoza or his devices on the 1200 block of Fifth Avenue, the site of the shooting that night.
The inquiry came to a halt until August 2022, when Akron police obtained a three-page document with the evidence they had been searching for. It originated from a lesser-known Canadian firm named Global Intelligence, which has been providing an exceptional service to law enforcement agencies throughout the United States for several years.
Global Intelligence asserts that its Cybercheck system can purportedly geolocate a person in real time or at a certain point in the past by utilizing open source data—public information available without a warrant—and employing over 700 algorithms, by identifying the wireless networks and access points that the individual’s “cyber profile” has connected with. The founder of the company, Adam Mosher, has sworn that the procedure is fully automated, needing no human involvement from when an investigator inputs fundamental case information into the Cybercheck portal to when the system generates a report pinpointing a suspect and their whereabouts.
If the technology performs as claimed, then Global Intelligence is offering police departments previously unrecognized surveillance abilities for as low as $309 per case that rival the open source tools employed by national intelligence agencies. However, an analysis of inquiries related to Cybercheck from California to New York, founded on hundreds of pages of legal documents, testimonies, interviews, and police reports, indicates that Cybercheck is a significantly less efficient tool—one that has offered evidence in prominent cases that was either clearly erroneous or could not be confirmed through any alternative methods.
Experts in open source intelligence claim that a significant portion of the information that Cybercheck includes in its reports for law enforcement would be unattainable by relying solely on open source data. Certainly! Here’s a paraphrase of the text while preserving the same number of words:
Over the last few months, Global Intelligence’s efforts in Ohio have diminished, as prosecutors ultimately opted against utilizing Cybercheck reports as evidence in various murder cases, including Mendoza’s.
“Either they’re somehow conducting the Minority Report currently, or it’s simply nonsense,” states Stephen Coulthart, director of the Open Source Intelligence Laboratory at the State University of New York at Albany, who assessed Cybercheck reports and transcripts of Mosher’s testimony upon request.
Pending Cases
In a November 2022 trial, Mosher stated that 345 various law enforcement agencies had utilized Cybercheck to perform around 24,000 searches since 2017. Press found over a dozen cases related to Cybercheck, with 13 instances where prosecutors planned to present Cybercheck reports as trial evidence. In two instances where courts permitted Cybercheck reports to be used as trial evidence, murder convictions were achieved.
The agencies we identified utilizing Cybercheck varied from small city police departments to county sheriffs and state law enforcement. The supposed offenses included those connected to child sexual abuse materials, drive-by shootings, and unresolved cases that have plagued neighborhoods for many years. For instance, last year, the New York State Police apprehended a man for murder after obtaining evidence from Cybercheck that supposedly tracked his cell phone at crucial sites on the night of the crime, approximately 20 years prior, as stated in the indictment. The trial for the case is set to begin in 2025.
Although Mosher has provided testimony multiple times regarding Cybercheck, his clarifications about the data sources utilized by the algorithms and the way they arrive at their conclusions do not entirely clarify Cybercheck’s capacity to generate its reports. Global Intelligence did not respond to inquiries regarding who created Cybercheck’s algorithms or what data the firm utilized for their training. When inquired about how the tool could identify that an individual’s cyber profile had connected to a specific wireless network—usually years after the event took place—an unnamed Global Intelligence staff member stated in an email: “There is no singular source of information concerning wireless network interactions.”
Precision Evaluations
In 2022, over two years after Halsell was fatally shot in Akron, Cybercheck delivered a report to the police that stated Mendoza’s cyber profile had been detected by two wireless internet devices situated close to 1228 Fifth Avenue after 9 pm. According to Mosher’s testimony, a cyber profile is the collection of names, aliases, email addresses, phone numbers, IP addresses, Google IDs, and various online identifiers that together form an individual’s distinctive digital footprint.
Prosecutors in Summit County charged Mendoza with homicide. However, when Mendoza’s defense lawyer, Donald Malarcik, examined the Cybercheck report, he uncovered an issue. The police department staff member who input the data into Cybercheck’s system reportedly erred: They inquired of the system whether it could find Mendoza at the location on August 20, 2020. The incident of gunfire took place on August 2. Cybercheck had still asserted that it found Mendoza at 1228 Fifth Avenue with 93.13 percent accuracy, despite being mistaken about the day. Even more surprising to Malarcik, at a certain time after submitting the initial report, Cybercheck generated a second report. It was exactly the same in every way as the initial report—from the MAC addresses, which are distinct identifiers for network-connected devices, to the time when Mendoza’s cyber profile supposedly contacted them, and the accuracy assessment—only it contained the right date of the shooting.
The warrants issued to Sprint and Google did not yield any proof that Mendoza’s devices or accounts were present at the location. However, as per Cybercheck’s fully automated algorithms, Mendoza’s digital profile was not only at 1228 Fifth Avenue during the shooting, but it was also at that precise location, at that specific time of day, for an equal duration, connecting to the same wireless networks, 18 days after.
The unnamed employee from Cybercheck who answered the inquiries states that the company supports the accuracy of both reports concerning the Mendoza case. “They noted that it is fairly common to share the same cyber profile using the same device at a location on a different date.”
Malarcik submitted a motion requesting that the prosecutor supply Cybercheck’s software related to another case where a report had been created. He subpoenaed Mosher as well and engaged a digital forensics expert to examine the code and the two Cybercheck reports concerning Mendoza. He claims that all the specialists in an unrelated case supposedly observed were merely a few hundred lines of code designed to build a program for searching public websites for information on a topic—not at all comparable to the over 1 million lines of code and more than 700 algorithms that Mosher has mentioned in pre-trial testimonies.
“Malarcik claims it was akin to performing a Google search.” “What we failed to observe is the hidden ingredient, which [Mosher] asserts is the machine learning that processes these data points and converts them into intelligence that attributes a cyber profile to this location.” “That is something he has never revealed to us.”
Mosher and Global Intelligence did not answer the inquiries regarding Malarcik’s allegations.
Malarcik asked the court to conduct a Daubert hearing to evaluate if Mosher’s testimony regarding Cybercheck’s results was credible enough to be presented as evidence in Mendoza’s trial. Two days prior to the hearing date, prosecutors in Summit County opted not to utilize Cybercheck as evidence. Since that time, the prosecutor’s office has retracted Cybercheck reports in three additional cases involving four men charged with murder, where these reports might have been used as evidence, based on Malarcik and court documents. In early August, Mendoza admitted guilt and received a sentence of at least 15 years from a 15-to-20.5-year term.
“In the trials we conducted with Cybercheck, there were elements that Cybercheck discovered which the on-site detectives also identified,” says Brad Gessner, the chief counsel for the Summit County prosecutor. “Those items corresponded.”
According to Gessner, the office has utilized, or planned to utilize, Cybercheck reports in 10 cases presented to them by the Akron Police Department. The Akron Beacon Journal and NBC News were the initial sources to reveal the county’s utilization of the tool.
The Summit County Sheriff’s Office informed the Akron Beacon Journal this month that it is looking into whether Mosher committed perjury, though no additional information was given.
In different instances—murder cases for Salah Mahdi and Adarus Black—defense lawyers did not dispute the employment of Cybercheck, leading to convictions in the trials. An appeals court upheld both convictions.
Since that time, judges managing the murder trials of Javion Rankin, Deair Wray, Demonte Carr, and Demetrius Carr have decided that Cybercheck cannot be presented as evidence unless Global Intelligence provides the defendants with access to its source code. Nonetheless, the Summit County Prosecutor’s Office challenged multiple rulings, and in September, an Ohio appeals court determined that the trial court made an error by dismissing the Cybercheck reports as evidence for factors not connected to the technology’s efficiency.
In different jurisdictions, Press discovered that prosecutors have similarly chosen not to utilize Cybercheck reports or have dismissed charges against defendants after defense lawyers examined the evidence and Mosher’s statements.
In 2021, sheriff’s deputies in Midland County, Texas were looking into the murder of a woman whose charred body had been discovered in a field by the roadside. Deputies arrested Sergio Cerna, the woman’s former boyfriend, on unrelated charges. When they examined his phone, as stated in an affidavit, they discovered text messages where he threatened the victim, including messages that said, “Your car will be set on fire, and then you’ll be next.” However, they were unable to locate evidence that positioned Cerna close to the crime scene.
The sheriff’s office sought assistance from Cybercheck and obtained a report stating that the algorithms had concluded, with 97.25 percent accuracy, that Cerna’s cyber profile had activated a wireless LaserJet printer close to the crime scene on the day the victim’s body was discovered. Prosecutors aimed to present the report as evidence in Cerna’s trial, but his defense sought a Daubert hearing. Midway through the hearing and prior to the defense’s opportunity to cross-examine Mosher, assistant district attorney Lisa Borden chose to omit Mosher’s testimony and the Cybercheck report from the trial.
“We would have required the ability to verify that data,” she states, but by the Daubert hearing, the printer referenced by Cybercheck in its report was nowhere to be found. According to court records and Global Intelligence, that was the first and only Daubert hearing that Cybercheck has experienced in the nation.
In March, a jury in Midland County found Cerna guilty and sentenced him to life imprisonment. Cerna’s lawyer stated he would challenge the conviction.
In Colorado, inquiries regarding Mosher and Cybercheck came before prosecutors dismissed the charges and sealed the records against a defendant in what authorities described as a child sexual abuse material (CSAM) case. Upon discovering that the district attorney’s office intended to introduce Cybercheck evidence during the trial and call Mosher as an expert witness, defense lawyer Eric Zale engaged private investigators to examine Mosher’s history.
Mosher informed the Boulder County court that he had earlier provided expert witness testimony in two CSAM cases in Canada, as stated by Zale and in an appeal brief submitted by Malarcik for a different client where a Cybercheck report was included in discovery. However, following communication from Zale’s investigator, the Canadian prosecutors in one of those instances reached out to the prosecutor in Boulder County to inform them that Mosher had never been summoned to testify in any role. The defendant, connected to Mosher, had admitted guilt on the trial’s opening day. A prosecutor acquainted with the other Canadian case informed the court that no charges were ever filed against the individual whose trial Mosher stated he testified in front of a judge.
Zale claims that Mosher is “exploiting this sort of coveted technological breakthrough to trick local law enforcement, judges, prosecutors, and honestly some defense attorneys” into depending on Cybercheck’s technology.
Mosher did not reply to the request for comments on Zale’s allegations. Global Intelligence did not contest that Mosher asserted he had provided expert testimony in the two Canadian cases.
“Mr. Mosher believed he had to communicate all court-related activities, including providing statements about an investigation,” noted the unnamed employee from Global Intelligence. “Different prosecutors have examined this issue in other trial contexts, concluding that this incident was more a case of miscommunication rather than any kind of misconduct.”
No Proof of Purchase
The difficulties in Ohio and Texas have centered around a unique feature of Cybercheck that sets it apart from other digital forensic tools: The automated system lacks retention of evidence that backs its conclusions. As Mosher has sworn in various jurisdictions, Cybercheck does not document the origins of its data, the methods it uses to connect different data points, or how it exactly determines its accuracy rates.
In Mendoza’s situation, for instance, it remains unclear how Cybercheck established that the email address “ladypimpjuice625@aol.com” was associated with Mendoza. Global Intelligence also did not clarify how the system established that Mendoza’s cyber profile had activated the wireless devices around 1228 Fifth Avenue.
Mosher stated that Cybercheck only retains information it considers pertinent to the investigation during its search process, and all of this is incorporated into the reports it automatically creates for investigators. Any additional information, even if it contradicts regarding the ownership of a specific email address or online alias, is allegedly handled by the algorithms and utilized to determine the accuracy scores featured in Cybercheck’s reports, though it isn’t stored.
“When you inquire whether we maintain all the artifacts and data we crawl—we realistically couldn’t, as it’s zettabytes of information,” Mosher testified during the Texas Daubert hearing on January 19, 2024. A zettabyte equals over 1 trillion gigabytes.
Mosher stated that Cybercheck isn’t required to display its methodology since its findings are based on open-source information that anyone with adequate open-source intelligence (OSINT) training can access online.
“If you provide that [Cybercheck] report to a competent investigator familiar with cyberspace and machine learning, they will attain the identical findings,” Mosher stated during Adarus Black’s murder trial in Summit County.
Rob Lee is an expert in OSINT and serves as the chief of research and faculty leader at the SANS Institute, a top provider of infosec and cybersecurity training. As per Mosher’s résumé and court statements, he completed over a dozen training courses at the SANS Institute before establishing Global Intelligence.
At the request, Lee and a group of researchers at the SANS Institute examined Cybercheck reports and the system descriptions provided by Mosher under oath. It is claimed that it’s very improbable for certain details in the reports to be obtained from sources available to the public.
To identify when a specific device has pinged a wireless network, an analyst must either physically capture the signal or gain access to either the device or the network logs, neither of which are available as open source, Lee states. Such access necessitates a search warrant.
“Lee states that the absence of peer review and transparency in [Cybercheck’s] algorithmic methods raises doubts about the legitimacy, adequacy, and legality of the datasets utilized for precise profiling and geolocation.” “The assertion of reaching this degree of accuracy solely with open source data, lacking additional validation and clarity in the tool’s methodologies and data origins, is extremely dubious and problematic.” An employee from Global Intelligence states that law enforcement collaborates with “industry analysts and specialists in the open source intelligence field who are manually verifying and supporting intelligence information from our reports.” They state that “investigations and prosecutions only progress based on the evidence collected by agencies and confirmed after supporting Cybercheck intelligence.” The company’s reply failed to respond to assertions that particular data, like if a device linked to a certain Wi-Fi network, is generally not obtainable through open source methods.
“Entirely Incorrect”
In the Black murder trial held in November 2022, Mosher stated that Cybercheck had conducted about 1,900 searches for suspects’ past locations and roughly 1,000 searches for their current locations since January 2021. Of the 2,900 searches, Mosher testified that there was just one instance where the person was not found at the location Cybercheck indicated for their cyber profile.
However, during interviews with Press and in emails acquired by Press via public records requests, several of Cybercheck’s law enforcement clients claim that the company’s technology delivered information that investigators could not verify or that contradicted trustworthy sources.
In January, Mark Kollar, an assistant superintendent at the Ohio Bureau of Criminal Investigation (BCI), sent an email to Cybercheck regarding a search warrant his agency had executed with an email provider to obtain details about an account that Cybercheck connected to a suspect. “The email service claims that the email mentioned in the Cybercheck report is non-existent and has never been,” Kollar stated.
The Ohio BCI, part of the state attorney general’s office, signed a $30,000 trial contract with Cybercheck in August 2023 and sent over a dozen cases to the company, according to Steve Irwin, a spokesperson for the attorney general’s office. “BCI has yet to obtain results for numerous cases, and some of the leads generated have not been successful,” he states. “Because of the absence of generated investigative leads, BCI does not plan to engage in another contract with the firm.”
In 2022, the Yakima County Sheriff’s Office in Washington entered into an $11,000 contract to submit 20 cases to Cybercheck. “I believe we still have access to Cybercheck, but it’s not being utilized,” wrote Casey Schilperoort, the sheriff’s public information officer, in an email. “I was informed that we get little or incorrect information.”
In an informal email thread where investigators from various agencies exchanged their insights about the technology, which Press acquired via a public records request, Aurora, Colorado detective Nicholas Lesnansky noted that Cybercheck had flagged an individual as a suspect in one of his department’s murder investigations because the person’s cyber profile connected with a router situated at a relevant address. “Detectives visited the resident of that house who has resided there for over 20 years and has never owned a router by that name, so we cannot verify their information,” Lesnansky stated. Neither Mosher nor Global Intelligence replied to the inquiry regarding Lesnansky’s allegations.
In another Aurora case concerning the deadly shooting of a 13-year-old, Global Intelligence personnel were “firm” that Cybercheck had revealed the murderer, yet Lesnansky’s inquiry was indicating a person he viewed as a more probable suspect. “They subsequently devised a scenario involving a gang initiation in which the individual they had pinpointed was driving the person I believe to be more likely involved,” Lesnansky noted. “I am skeptical that the suspect identified by Cybercheck and the other person I believe to be more probable are commuting together, as one has had their home attacked multiple times by the other.”
In the same email thread, Heather Collins, an intelligence analyst in the special victims unit at the Mississippi Bureau of Investigation, mentioned that she employed Cybercheck in a case involving a missing juvenile. “They provided us with details about potential ‘suspects,’ and it turned out to be entirely incorrect.” We found the missing juvenile through alternative methods. “They squandered our time.”
Mosher did not answer the inquiries regarding Collins’ claim that the information supplied by Global Intelligence was inaccurate.
In some instances, Cybercheck seems to have generated correct information, though investigators were not always able to respond to it.
Joe Moylan, the public information officer for the Aurora Police Department, states that his agency has asked Cybercheck for details on five cases, and that in two of those instances, the technology was “helpful to the investigations,” though no arrests were made as a consequence.
In 2017, 9-year-old Kayla Unbehaun was taken. For years, the police department in South Elgin, Illinois pursued Unbehaun and her noncustodial mother, Heather Unbehaun, who faced kidnapping accusations, tracing them to Georgia, where they encountered a dead end. At that time, the department entered into an agreement with Global Intelligence, and Sergeant Dan Eichholz obtained a Cybercheck report indicating that Unbehaun and her mother were in Oregon, he states. It was a new lead; however, since Cybercheck failed to present any evidence backing its conclusions, Eichholz was unable to utilize the report to secure a search warrant.
In 2023, Unbehaun was finally brought together with her father when a worker at a consignment store in Asheville, North Carolina, identified her mother from an image featured on the Netflix series Unsolved Mysteries. Once Unbehaun was found, Eichholz discovered during the subsequent investigation that, until a few months prior, the two had actually been residing in Oregon.
“I wouldn’t say it wasn’t usable, but I couldn’t simply take their data and run with it,” Eichholz states. “That was consistently our obstacle.” “Alright, you’ve provided me this information, but I still need to confirm and verify and handle my part with search warrants.” The case of child abduction involving Heather Unbehaun is still in progress.
Any Assistance They Can Receive
Cybercheck has expanded to law enforcement agencies nationwide due to extensive marketing promotions and referrals from satisfied users. However, in interviews with the Press and the email communications we reviewed, there was scant proof that law enforcement agencies pursued or obtained evidence to back up Global Intelligence’s assertions about the capabilities of its technology.
Prosecutors like Borden from Midland County mentioned they became aware of Cybercheck due to its application by law enforcement in their area. And when it arose in a case, they allowed the opposing court system to determine its legitimacy.
“It was a new technology, and my curiosity piqued, so I thought, ‘Let’s give it a shot and find out how far we can go,’” Borden states. “I appreciate that it wasn’t brought up in my case, and that I didn’t require it for my conviction.”
Emails indicate that Global Intelligence sales representatives frequently proposed to process police department cases through Cybercheck at no cost to showcase the technology. They also mentioned instances that Global Intelligence identified as high profile and that Cybercheck allegedly contributed to resolving, without directly naming the cases or offering proof that Cybercheck had any impact on the investigations.
Emails retrieved from the Ohio Bureau of Criminal Investigation indicate that investigators were initially eager to find out what details Cybercheck could offer regarding their cold cases. They also presented Global Intelligence sales representatives to various law enforcement agencies throughout Ohio. That excitement appears to have assisted in persuading other agencies to have confidence in the company.
Gessner, representing the Summit County Prosecutor’s office, mentioned that when his department deliberated on utilizing Cybercheck evidence, it sought input from the Ohio BCI’s cybercrimes unit. “They mentioned, yes, that it is reasonable … we lack the technology for this, but we would be eager to have it.” County prosecutors also contacted the SANS Institute, he notes, and were informed that the institute didn’t “handle this kind of work.”
However, while it has retracted evidence that Cybercheck supplied, Gessner states that the Summit County Prosecutor’s Office is inquiring with other firms if they can perform similar open-source locating as Global Intelligence promoted.
“We aim to keep avenues open that could lead to the truth in our cases,” he states.
