Once the merits of the case are vetted, I don't think it will materialize.
I would be surprised if there is any legal basis for it, unless there is more to it than in the very short little snippet.
ETA: From what we know, was there anything improper done by Bradley?
IMHO, after reading Mr. Bradley's news release, he did nothing improper at all, in fact when the NetAnalysis and CacheBack discrepancies came to his attention, he immediately put things in motion to fix/mitigate the problem. Immediately contacted the OCSO and the Prosecution. And the DT was well aware of the problem, and Baez presented the descrepancies during the trial. There was no wrong-doing on the prosecutions' behalf. And it most certainly isn't exculpatory evidence, IMO.
Here is Mr. Bradley's news release:
In the recent case of the State of Florida vs. Casey Anthony, a recovered Firefox 2 history from Unallocated Space became the focal point of the State's case surrounding arguments of "premeditation". During the course of the trial, two different reports were tendered by members of the Orange County Sheriff's Department (OCSD). One was created using NetAnalysis dated August 2008. The other was created using CacheBack Version 2.8 RC2 in December 2009.
What came out at trial was a discrepancy between the two reports with regards to the Visit Count of 84 visits a "chloroform.htm" at "sci-spot.com". The NetAnalysis report was tendered by the Defense under Direct Examination of OCSD's lead forensic examiner. The CacheBack report had already been tendered by the State during Direct Examination of the developer of CacheBack (me) one week earlier.
As a result of this "discrepancy", a lot of confusion and presumptions have arisen. The first presumption is that NetAnalysis was the "correct report" and CacheBack was faulty. While admittedly true that CacheBack had some issues with the Visit Count and was missing some records, BOTH software products failed to fully parse the entire mork database file by some few hundred records.
On July 11, 2011, Digital-Detective.co.uk posted a public blog to discuss the discrepancy issue and provided a tutorial on the Mork file format in contrast to "the other tool". Since the article refers to the Casey Anthony trial and the issue at hand, the author might as well have simply said "CacheBack" and be straight about it. As a result, I feel compelled to set the record straight once and for all. I therefore need to shed some light on exactly what transpired that led to the issues at hand.
The following is a timeline of events that took place since the beginning of the investigation through to and including the final days of the trial:
AUG 2008 - NetAnalysis was used to parse the Firefox 2 history file that OCSD recovered from Unallocated Space. This report listed 8,878 records. The actual mork file contained 9,075 records. This report was disclosed as evidence.
DEC 8, 2009 (16 months later) - While attending a CacheBack course in Orlando, members of the OCSD stated that NetAnalysis was NOT able to parse the FF2 file. They also cited issues with Daylight Savings conversion with the tool. CacheBack 2.8 at the time could only parse part of the file so I was asked to try and re-tool the function so that it could fully parse the FF2 file.
DEC 10, 2009 - I completed the updates to the best of my abilities at the time for CacheBack 2.8 RC2 and turned over the results to OCSD. I urged OCSD to manually validate select artifacts in the file since they had the Firefox 2 file format and decoding instructions from the CacheBack course Training Manual. I asked that any issues or concerns be brought to my attention immediately for investigation and/or correction. Since Firefox 2 history (mork) file format was already depricated, I felt at that time that no additional work was warranted on "that specific file format". In hindsight, I should have re-verified the work upon my return to Canada but that was unfortunately not the case.
OCT 2010 - I was deposed as a witness in the case with the State and Defense counsels present. My line of questioning was completely restricted to my actions from December 2009. At NO time was I ever asked to "analyze" or "investigate" the history data or form any opinions. At NO time in the future was I also asked to analyze or investigate the history file. My sole purpose was to provide a "decoding function" for the investigators.
MAR-MAY, 2011 - I contacted the State Attorney's office on numerous occasions to verify what I was required to testify about at trial. I specifically inquired about whether I needed to examine the data, create any presentations for court, or if I required a laptop. I was told that I did not need to bring anything and that everything was already looked after. I was expected to only be on the stand for a few minutes - that was it.
JUN 8 & 9, 2011 - I was called to the stand by the State to testify about a CacheBack report that I had never seen before and the contents of which I had no foreknowledge of. This report was created by OCSD on June 3rd, 2011! I was only supposed to get up on the stand and say "I decoded the file" and that was it. Instead, I was tediously asked to read directly from the CacheBack report. Since OCSD officers had testified prior to me, and since the State was not affording me an opportunity to 'explain in simple terms' items like "URL" etc., I essentially was just a narrator and assumed that the jury was already educated by OCSD witnesses.
During my testimony, my attention was directed to a URL at "sci-spot.com" and I was asked to read aloud the Visit Count for that entry. As I stated in the courtroom, I said "According to the report...84 times". Personally speaking, a single "chloroform.htm" with a visit count of 84 seemed odd. But, since I did not have any other details about the investigation, and since I did not investigate the evidence, that's all I could say.
JUN 16, 2011 - The supervising OCSD computer forensic investigator (Sergeant) took the stand under direct examination by the Defense. He was shown two reports: the NetAnalysis report from August 2008 (which parsed only 8,878 records) and the CacheBack report, which parsed 8,571 records. OCSD was asked to point out the glaring differences between the Visit Count of 1 for the NA report and 84 for the CB report. In addition, "myspace.com" was missing from the CB report, as were other URLs. Rather than acknowledge this already known issue and address it there and then, the officer chose not to.
From a developer's perspective, this was an obvious "parsing error". By looking for a valid Visit Count attribute, CacheBack skipped over records until it found a valid Visit Count marker. As I later determined (see below), FF2 infers the first visit count and thereby "omits" the Visit Count attribute altogether. So while terribly damaging, the actual correction to the problem was relatively easy, and obvious to me once I became aware of it.
JUN 16, 2010 (after his testimony) - I called the OCSD Sergeant about his testimony and inquired about the discrepancy. That's when he said that he KNEW about this discrepancy LONG AGO. When asked "What did you do about it?", he replied "that he visually inspected the URL within the Firefox 2 history file which was in question and observed the number 84 nearby ("a couple of lines below") and assumed that it was correct". Despite the obvious and critical flaw in this thinking, he still knew that the NetAnalysis report was still in evidence with a visit count of 1.
According to the OCSD officer, this discrepancy was known LONG before trial. NO attempts were made to contact me, the developer of NetAnalysis or to validate it manually using any other combination third party tools. Validation of "select URLs" (e.g., chloroform) would have taken only 10 minutes. So at this point, there are 2 inconsistent reports before the court and nothing was done about it. Even the prosecutor didn't know.
JUN 16-19, 2011 - I advised the State Attorney of the problem(s) and liased with her and the OCSD officer. During the next 36 hours, I completely retooled the code in CacheBack and successfully matched the proper 9,075 records. An independent tool called "dork.exe" developed by the Mozilla developers corroborated my results. I also used EnCase Version 6 keyword search on the new record marker (a square open bracket) and verified the same results. CacheBack 3.7.11 was immediately released and I prepared an assortment of published results (for OCSD and the State prosecutor) in various file formats to make it easy to disclose and review.
This information was provided to the prosecution and to the OCSD in advance of the State's rebuttal, and the OCSD officer's second appearance (for the State). I even offered to fly down there overnight at my own expense to set the record straight and explain the discrepancy. Since the fate of woman's life could lay in this critical piece of information, I did everything in my power to remedy the situation, or at least mitigate the issue - once I became aware of it.
COMMENTS
Had OCSD informed me that NetAnalysis had indeed been able to parse the Firefox 2 history file in August 2008 (16 months earlier), I would have definitely asked for a copy of the results as a benchmark to my own work in December 2009. This information was selectively omitted in my discussions with OCSD.
The OCSD had an opportunity and a responsibility to validate the results, in particular, the URLs that were deemed to be the most critical to the State's case. Had I been asked to revisit the results or aid in the examination of the results, the issues would have been discovered and corrected immediately.
In hindsight, I could have (should have) done more upon my return in December 2009 to further review the Firefox 2 parsing routine. Unfortunately, this is a valuable lesson learned. Despite Mork file format being depricated, we should have invested more time to review again the changes made in CacheBack 2.8 RC2.
While NetAnalysis and CacheBack were eventually updated to better parse the Firefox 2 file, neither product's reports tendered in the Casey Anthony trial were entirely correct. It is disappointing that NetAnalysis in this case was somehow held out to be otherwise.
I was not going to post anything herein because I believed that members of the forensic industry would qualify any suspicions by asking involved stakeholders about the matter - directly. Unfortunately and regretably, either for personal gain or for no other reason than to attempt discredit the CacheBack name, certain limited comments have found their way into public venues through posts and blogs that are completely subjective and misleading.
Like anyone other software development company, our software is developed by humans and we have endeavored to correct any and all issues immediately once they are discovered or reported. While we do our best to test, test, re-test and test some more, sometimes that isn't always enough.
My personal thanks to my good friend and colleague Shafik Punja of the Calgary Police Service for pushing me to come forward to define the issues and offer the true perspective on the issues.
CacheBack is a great tool for Internet investigations! I stand behind the product and I stand behind our customers. When a customer reports an issue, we're on it right away and we fix it right away, if required. The Casey Anthony Trial was a good experience for no other reason than to experience the American justice system and to be humbled in acknowledging that "one more test" is never a waste of time.
TO THE MEMBERS OF OCSD:
I am truly sorry that I was unable to refrain from discussing this issue in a less than positive light. Collectively, we could have done things differently and I know we have all learned from this experience.
Respectfully,
John Bradley
CEO & Chief Software Architect
* * * * *
IMO, Cindy and George don't have one iota of reason to sue Mr. Bradley. What does the 84-vs-1 search have anything whatsoever to do with Cindy and George? Eventually it was shown that Cindy perjured herself about all the searches during rebuttal, when it was proved that she was AT WORK when those searches were made.
And, it appears to me that all this "84-vs-1" nonsense is obfuscating the fact that even though the chlorform page at sci-spot was visited only once,
ADDITIONALLY Casey Google-searched the word "chloroform" TWICE; Casey Google-searched the phrase "how to make chloroform" TWICE; Casey searched Wikipedia for "chloroform" and Casey made numerous other Google-searches for "neck breaking", etc. The bolded/underlined segment is totally sustantiated and separate evidence, and not included in the "84-vs-1" discrepancy that the OCSO forensic examiners had complete knowledge of long ago, but neglected to pass along to the Prosecution or Mr. Bradley.
Regardless of the number of times the chloroform page at sci-spot.com was visited, there is more than ample computer forensic evidence that chloroform and variants were searched for multiple times by Casey on the Anthony home computer. The 84-vs-1 does not detract from that in the least.
And then Casey deleted the Firefox browser history on July 16, 2008, prior to her initial arrest. Consciousness of guilt?
The defence was well aware of these discrepancies and presented them during the trial. No way was the prosecution holding back exculpatory evidence.
And now the Anthonys may sue John Bradley ... FOR WHAT????? How the heck did these software mistakes cause ANY damages for the Anthonys?
It's not enough that their daughter has been acquitted ... now they want to get rich off the back of a person who worked his heart out to do what's morally and legally right, at his own expense and many, many hours of dedicated work.
Jim Lippman, George and Cindy Anthony, you are absolutely detestable.
And, IMHO, you certainly don't have a case against Mr. Bradley.
