Questionable Convictions: The Controversial AI That Swayed Murder Trials and the Scrutiny That Followed

To go back to this article, navigate to My Profile and then select View saved stories.

An AI Application Played a Role in Murder Convictions, Until Its Accuracy Was Questioned

On a late evening in August 2020, Kimberly Thompson and Brian James arrived at a residence in Akron, Ohio, only to be met with a flurry of bullets as they exited their vehicle. Both were hit in their legs, taken to a medical facility, and lived through the ordeal. However, Tyree Halsell, Thompson's grandson of 20 months, who remained in the vehicle, suffered a fatal gunshot wound to the head.

Following the incident, Akron police gathered surveillance videos from the area and sought assistance from the public to identify two individuals observed walking up to the victims, shooting, and then escaping in a truck. After a few months, the investigation focused on a suspect named Phillip Mendoza, leading to the acquisition of a warrant to examine his mobile phone's location history from Sprint, as indicated by legal documents. Additionally, they issued a geofence warrant to Google, requesting data on any devices that had been in the vicinity of the crime scene according to their GPS, Wi-Fi, or Bluetooth signals. However, neither warrant provided any proof that Mendoza or his electronic devices were present on the 1200 block of Fifth Avenue, the location of the shooting, on the night it happened.

The inquiry hit a standstill until it was reignited in August 2022, following the Akron police department's receipt of a three-page document that held the crucial evidence they had been looking for. This report originated from an obscure Canadian firm named Global Intelligence, which, over the recent years, has been offering a remarkable service to numerous police forces throughout the United States.

Global Intelligence asserts that its Cybercheck system is capable of pinpointing a person's location, either currently or at a previous moment in time, solely through open-source information—data accessible without legal permission—coupled with over 700 algorithms. This is achieved by identifying the Wi-Fi networks and access points with which the individual's "cyber profile" has connected. The organization's founder, Adam Mosher, has sworn in testimony that this method is fully automated, eliminating the need for any human input from the moment a case's basic information is inputted into the Cybercheck portal until a report is generated, detailing a suspect's whereabouts.

Should the technology operate as promised, Global Intelligence offers law enforcement agencies new surveillance powers at a minimal cost of $309 per case, capabilities that compete with the open-source software utilized by international intelligence organizations. However, a comprehensive analysis by WIRED, examining Cybercheck's use in cases stretching from California to New York through extensive court documents, statements, discussions, and law enforcement reports, indicates that Cybercheck may not be as reliable. In significant instances, the technology has supplied information that was either provably false or could not be corroborated through alternative methods.

Experts in open source intelligence have claimed to WIRED that the data Cybercheck includes in its reports to law enforcement could not be sourced solely from publicly available information. In fact, in recent months, the involvement of Global Intelligence in Ohio has significantly diminished. Prosecutors have chosen not to rely on Cybercheck's reports as evidence in various murder trials, including the case involving Mendoza.

"Either they're engaging in something straight out of Minority Report, or it's simply nonsense," comments Stephen Coulthart, head of the Open Source Intelligence Laboratory at the State University of New York at Albany. Coulthart made these remarks after examining Cybercheck reports and the transcripts of Mosher's testimony, which he did upon WIRED's request.

Ongoing Legal Matters

In a trial that took place in November 2022, Mosher stated that since 2017, 345 distinct police departments had utilized Cybercheck for around 24,000 inquiries. WIRED discovered numerous instances involving Cybercheck, highlighting 13 cases where the intention was to present Cybercheck findings as evidence during court proceedings. Among these, two instances where the judiciary permitted the inclusion of Cybercheck documents as evidence in court led to convictions for homicide.

Our investigation revealed that entities utilizing Cybercheck varied widely, encompassing everything from local police forces in suburban areas to county sheriff offices and state law enforcement agencies. The types of offenses these agencies were investigating with the tool covered a broad spectrum, including child pornography offenses, incidents of drive-by shootings, and long-unsolved cases that have lingered in communities for years. For instance, last year, a breakthrough came when the New York State Police apprehended a murder suspect. This arrest was made possible thanks to evidence from Cybercheck which purportedly pinpointed the suspect's mobile phone at crucial scenes on the night the murder took place, nearly two decades ago, as outlined in the legal charges. This particular case is on the court docket for trial in 2025.

Mosher has appeared several times to discuss Cybercheck, but his descriptions of the algorithms' data sources and their decision-making processes don't entirely clarify how Cybercheck generates its findings. Global Intelligence remained silent on WIRED's inquiries regarding the creators of Cybercheck's algorithms and the data utilized for their training. In response to questions about the system's capability to identify an individual's cyber footprint on a specific wireless network, sometimes years post-incident, an anonymous Global Intelligence staff member conveyed via email that there isn't a solitary information source concerning interactions with wireless networks.

Reliability Assessments

More than two years following the fatal shooting of Halsell in Akron, Cybercheck delivered a document to law enforcement stating that after 9 pm, Mendoza's digital presence had been detected on two Wi-Fi networks in the vicinity of 1228 Fifth Avenue. According to what Mosher revealed in his testimony, a digital profile constitutes a composite of an individual's names, pseudonyms, email addresses, contact numbers, IP addresses, Google IDs, and various digital markers, all of which together form a person’s distinctive online identity.

Prosecutors in Summit County have accused Mendoza of committing murder. However, a significant issue was uncovered by Mendoza's legal representative, Donald Malarcik, upon reviewing the Cybercheck report. A staff member at the police department responsible for inputting data into the Cybercheck system apparently made an error: They inquired if the system could pinpoint Mendoza at the crime scene on August 20, 2020, instead of the actual date of the shooting, which was August 2. Despite the incorrect date, Cybercheck reported it could accurately locate Mendoza at 1228 Fifth Avenue with a 93.13 percent certainty. What puzzled Malarcik even more was that Cybercheck later issued a second report that was a mirror image of the first one in every aspect, from the MAC addresses (unique identifiers for devices connected to a network) to the specific times Mendoza’s digital footprint was detected and the level of accuracy. The only difference was that this subsequent report listed the correct date of the incident.

The search warrants issued to Sprint and Google failed to reveal any proof placing Mendoza's devices or accounts at the location in question. However, Cybercheck's fully automated systems suggested that Mendoza's digital footprint was not only present at 1228 Fifth Avenue during the shooting, but it also showed that he was at that precise location, at the same time, and for the same duration, connecting to the same Wi-Fi networks, 18 days afterward.

An anonymous representative from Cybercheck, in response to inquiries from WIRED, expressed the firm's confidence in the veracity of the reports concerning the Mendoza situation. "Having an identical cyber footprint from the same device at a location on another date is not unusual," they mentioned.

Malarcik submitted a legal request urging the prosecutor to disclose the Cybercheck software used in a different case, which had produced a report. Additionally, he issued a legal demand for Mosher's presence and engaged a specialist in digital forensics to scrutinize the code and the two analyses concerning Mendoza produced by Cybercheck. Speaking to WIRED, he mentioned that in a distinct case, experts reportedly encountered merely a few hundred lines of code responsible for generating a tool that scours public internet sites for data on individuals—this starkly contrasts with the 1 million lines of code and over 700 algorithms Mosher has claimed to have discussed during pre-trial testimonies.

Malarcik contends, "This was akin to performing a search on Google. What remained undisclosed to us was the so-called secret ingredient, which Mosher asserts is the machine learning aspect. This technology supposedly analyzes these bits of data and converts them into actionable intelligence, pinpointing a cyber profile's location. That crucial piece of information has never been shared with us."

Mosher and Global Intelligence failed to reply to WIRED's inquiries regarding the allegations made by Malarcik.

Malarcik urged the court to conduct a Daubert hearing, a procedure to evaluate if Mosher's statements regarding the findings of Cybercheck were reliable enough to qualify as evidence in Mendoza's case. Merely two days prior to the scheduled hearing, the prosecutors of Summit County opted not to use the Cybercheck findings as part of their evidence. Following this decision, the prosecuting authority has since retracted reports from Cybercheck in additional cases involving four individuals charged with murder, where these reports might have been used as evidence, as indicated by Malarcik and judicial records. In the early days of August, Mendoza entered a guilty plea and received a sentence requiring him to serve a minimum of 15 years out of a 15-to-20.5-year sentence.

"In instances where we proceeded to trial involving Cybercheck, the findings they uncovered were corroborated by the evidence gathered by our field detectives," Brad Gessner, the chief counsel for the Summit County Prosecutor's Office, shared with WIRED. "There was a clear alignment between the two."

Gessner mentioned that the office has employed, or planned to employ, Cybercheck reports in a total of 10 cases submitted by the Akron Police Department. The initial reports on the county's deployment of this tool were made by the Akron Beacon Journal and NBC News.

The Sheriff's Office in Summit County has informed the Akron Beacon Journal that they are looking into allegations that Mosher may have committed perjury, though no further information has been disclosed.

In different instances, specifically during the murder cases involving Salah Mahdi and Adarus Black, defense lawyers did not contest the application of Cybercheck, leading to guilty verdicts. These verdicts were later affirmed by a higher court.

Subsequently, the judges presiding over the homicide cases involving Javion Rankin, Deair Wray, Demonte Carr, and Demetrius Carr have decided that the evidence from Cybercheck will not be allowed unless the defendants are given access to its foundational code by Global Intelligence. Despite this, the Summit County Prosecutor’s Office challenged many of these decisions, and in September, an appellate court in Ohio determined that the lower court made a mistake by not permitting the Cybercheck analyses to be used as evidence, citing reasons that did not pertain to the actual performance of the technology.

In different regions, WIRED discovered, legal authorities have likewise chosen to abstain from utilizing Cybercheck reports, or have dismissed charges against the accused once defense lawyers closely examined the results and Mosher's statements.

In 2021, sheriff's deputies in Midland County, Texas, were probing the killing of a woman after discovering her charred remains in a field beside the road. The investigation led to the arrest of the woman's former boyfriend, Sergio Cerna, on charges not connected to the case. A search of his phone revealed menacing texts to the victim, with one message warning, “Your car is going to be burned down then you will be next,” as stated in a court document. However, authorities were unable to locate any proof that linked Cerna to the location where the crime occurred.

The sheriff's department sought assistance from Cybercheck, which produced a report alleging that, with a 97.25 percent precision, Cerna's digital footprint had interacted with a wireless LaserJet printer in the vicinity of the crime scene on the day the victim was discovered. The prosecution team aimed to introduce this report as evidence during Cerna's court proceedings. However, Cerna's legal team called for a Daubert hearing to scrutinize its admissibility. Midway through this hearing, before Cerna's defense had the opportunity to question Mosher, the assistant district attorney, Lisa Borden, opted not to present Mosher's testimony or the Cybercheck findings in court.

"She explained to WIRED that for the data to be credible, they needed to verify its authenticity. However, during the Daubert hearing, the printer pinpointed in Cybercheck's analysis was nowhere to be found. Court documents and Global Intelligence confirm this was the sole Daubert hearing Cybercheck has faced nationwide."

In March, a jury from Midland County found Cerna guilty, resulting in a life sentence. Cerna's lawyer announced plans to challenge the conviction.

In Colorado, inquiries regarding Mosher and Cybercheck emerged before the legal authorities decided to dismiss the charges and make the case files confidential against an individual involved in a case described by police as involving child sexual abuse material (CSAM). Upon discovering that the local prosecutor's office intended to present evidence from Cybercheck in court and have Mosher testify as a specialist, defense lawyer Eric Zale employed private detectives to investigate Mosher’s credentials.

According to Zale and an appeal document submitted by Malarcik on behalf of another client, Mosher informed the Boulder County judiciary that he had served as an expert witness in two CSAM-related trials in Canada. However, following inquiries from Zale's investigator, Canadian legal authorities involved in one of the cases reached out to the Boulder County prosecutor to clarify that Mosher was never summoned as a witness in any role. The accused in that case, who was a relative of Mosher, admitted guilt at the trial's outset. Moreover, an attorney knowledgeable about the second case in Canada communicated to the court that there had been no formal accusations laid in the matter Mosher claimed to have provided testimony for.

Zale accuses Mosher of exploiting what is considered the ultimate goal in technology to deceive local law enforcement, judges, prosecutors, and even some defense attorneys into depending on Cybercheck's technology.

Mosher did not reply to WIRED's inquiry for his comments on the allegations made by Zale. Global Intelligence did not deny Mosher's assertion of having served as an expert witness in two cases in Canada.

At the time, Mr. Mosher believed it was essential to communicate all activities related to court participation, such as providing statements about an investigation, according to a statement from an anonymous Global Intelligence worker. The text further noted that during different trial processes, other prosecutors examined this situation and concluded that the incident was primarily a misunderstanding rather than any form of misconduct.

WIRED reached out to obtain the identities of the prosecutors involved, but their request went unanswered.

Lack of Documentation

The issues faced in Ohio and Texas revolve around a distinctive feature of Cybercheck that sets it apart from similar digital forensic technologies: Its automated nature means it does not keep any backup evidence for its conclusions. Mosher, speaking truthfully in several different areas, has indicated that Cybercheck does not keep track of its data origins, the methods it uses to link different pieces of information, or the precise way it determines its reliability percentages.

For instance, the method by which Cybercheck linked the email address "ladypimpjuice625@aol.com" to Mendoza remains unclear. Similarly, Global Intelligence did not provide a detailed explanation on how it was concluded that Mendoza's digital identity had interacted with wireless gadgets in the vicinity of 1228 Fifth Avenue.

Mosher has stated under oath that Cybercheck only keeps the information it considers pertinent to its investigations, all of which is captured in the automated reports it produces for investigators. Any other data, such as conflicting details regarding the ownership of an email address or online nickname, is allegedly analyzed by the software to determine the reliability ratings featured in its reports, but is not stored.

"During the Texas Daubert hearing on January 19, 2024, Mosher made it clear that saving every piece of data and artifact they collect isn't feasible, given the sheer volume involved—specifically, zettabytes of information. To put it into perspective, a zettabyte surpasses 1 trillion gigabytes."

Mosher stated in his testimony that there's no requirement for Cybercheck to disclose its methods since its findings are based on publicly available data, accessible to anyone trained in open source intelligence (OSINT) techniques.

"Providing the [Cybercheck] document to an experienced detective familiar with digital environments and artificial intelligence will lead them to identical conclusions," Mosher stated while giving testimony at the homicide trial of Adarus Black, in Summit County.

Rob Lee stands out as a leading expert in Open Source Intelligence (OSINT) and serves as the head of research and primary instructor at the SANS Institute, renowned for its cybersecurity and information security education programs. Based on Mosher’s curriculum vitae and statements made in court, before establishing Global Intelligence, Mosher completed upwards of twelve training courses offered by the SANS Institute.

Upon WIRED's prompting, Lee, alongside a group of experts from the SANS Institute, analyzed Cybercheck reports and the system explanations Mosher provided in sworn testimony. They concluded that it's improbable that certain details in the reports could be collected from open sources.

Lee explains that in order to identify the exact moment a specific device connects with a Wi-Fi network, an investigator must either directly intercept the communication or obtain the records from either the device or the network, options that are not publicly available. Such access necessitates legal authorization in the form of a search warrant.

Lee expressed to WIRED his concerns about the absence of peer review and openness in Cybercheck's algorithmic operations. He doubts the authenticity, adequacy, and legality of the data sets employed for precise profiling and geolocation. Lee finds the assertion that such high accuracy can be attained solely through the use of open-source data, without any additional validation or clarity regarding the tool's techniques and data sources, to be quite dubious and problematic.

An employee at Global Intelligence informed WIRED that law enforcement collaborates with "specialists and analysts in the field of open source intelligence who actively verify and support the intelligence data from our reports through manual efforts." They further mentioned that "the advancement of investigations and legal actions is solely dependent on the robustness of the evidence collected and confirmed by agencies after corroborating the Cybercheck intelligence." The response from the company did not tackle allegations regarding the inaccessibility of specific data, like the connection of a device to a particular Wi-Fi network, through open source techniques.

"Utterly Untrue"

In the trial regarding Black's homicide in November 2022, Mosher stated that from January 2021, Cybercheck conducted around 1,900 investigations into the past whereabouts of suspects and an additional 1,000 inquiries into their current locations. Mosher indicated that of these 2,900 checks, there was merely a single instance where the person wasn't found at the location identified by their online profile, according to Cybercheck's data.

In discussions with WIRED and from emails revealed to WIRED via requests for public records, several of Cybercheck's law enforcement customers have claimed that the firm's technology delivered data that detectives could not verify or that was in conflict with credible sources.

In January, Mark Kollar, who serves as an assistant superintendent at the Ohio Bureau of Criminal Investigation (BCI), reached out to Cybercheck via email regarding a search warrant they had issued to an email service provider. This was in an effort to gather details on an account that Cybercheck had associated with a suspect. Kollar mentioned in his communication, “The email service provider is disputing the existence of the email mentioned in the Cybercheck report, claiming it has never been in existence.”

In August 2023, the Ohio Bureau of Criminal Investigation (BCI), a branch of the state's attorney general's office, initiated a trial agreement worth $30,000 with Cybercheck, involving the submission of over a dozen cases to the firm, according to Steve Irwin, a representative for the attorney general's office, in a conversation with WIRED. Irwin noted that BCI has yet to receive outcomes for many of these cases, and the few leads provided by Cybercheck have not been fruitful. Given the insufficient investigative leads generated, BCI plans to discontinue any future dealings with the company.

In 2022, the Sheriff’s Office of Yakima County, located in Washington, entered into an agreement worth $11,000 to forward 20 cases to Cybercheck. “It seems we still can access Cybercheck, yet it’s not in use,” Casey Schilperoort, the spokesperson for the sheriff, mentioned in an email. “The feedback is that the information we get is often insufficient or not precise.”

In a private email exchange among investigators from various agencies, which was accessed by WIRED via a request for public records, Detective Nicholas Lesnansky of Aurora, Colorado, shared that the program Cybercheck had flagged an individual as a potential suspect in a homicide investigation conducted by his department. This was due to the individual's digital footprint matching a router at a relevant location. However, upon visiting the homeowner, who had been living there for over two decades and reported never having owned such a router, the detectives found the lead unverifiable. Lesnansky shared this development in his correspondence. Attempts by WIRED to get comments from Mosher and Global Intelligence regarding Lesnansky's account received no response.

In another incident from Aurora related to the tragic death of a 13-year-old, the team at Global Intelligence was convinced that Cybercheck had pinpointed the correct perpetrator. However, Lesnansky's own investigation was leading him to believe another individual was the true culprit. He mentioned, “They proposed a theory suggesting it was an initiation for a gang, where the suspect identified by them was supposedly chauffeuring the one I suspect,” Lesnansky noted. “I'm skeptical about the connection Cybercheck made and my prime suspect working together, especially since one's residence has been targeted and shot at by the other on multiple occasions.”

In a related email thread, Heather Collins, who works as an intelligence analyst for the special victims unit at the Mississippi Bureau of Investigation, mentioned her experience using Cybercheck for a case involving a missing minor. She noted that the service provided leads on potential 'suspects' that ultimately proved to be inaccurate. The missing minor was found through different means, leading her to conclude that relying on Cybercheck only led to a waste of their time.

Mosher did not reply to inquiries from WIRED regarding Collins' claim that the data supplied by Global Intelligence was inaccurate.

In some instances, Cybercheck has yielded correct data, though not all the time could investigators utilize it effectively.

Aurora Police Department's spokesperson, Joe Moylan, has disclosed that they have sought assistance from Cybercheck for five separate incidents. He revealed that in two of these instances, the technology provided by Cybercheck proved helpful to their investigative efforts, although it hasn't led to any arrests thus far.

In 2017, 9-year-old Kayla Unbehaun was reportedly kidnapped. The South Elgin, Illinois, law enforcement team tirelessly pursued both Unbehaun and her mother, Heather Unbehaun, who was implicated in her daughter's disappearance. Their investigation led them to Georgia, but they were unable to find them there. During this period, the police department partnered with Global Intelligence, and Sergeant Dan Eichholz received a report from Cybercheck indicating that Unbehaun and her mother were in Oregon, he shared with WIRED. This information presented a potential breakthrough. However, the absence of concrete evidence in the Cybercheck report meant that Eichholz couldn't secure a search warrant based on its findings.

In 2023, Unbehaun was joyfully reunited with her father thanks to the keen observation of a consignment shop worker in Asheville, North Carolina, who identified her mother from an image featured on the Netflix series Unsolved Mysteries. Following Unbehaun's discovery, Eichholz found out through subsequent investigative efforts that she and her mother had been residing in Oregon up until a few months prior.

Eichholz explains, "It's not that the information was unusable, but it wasn't something I could rely on immediately," highlighting the constant challenge they faced. "You've provided me with this data, yet I still need to conduct my own verification and secure search warrants." The investigation into Heather Unbehaun for child abduction continues.

Assistance Wherever Possible

The adoption of Cybercheck by police departments nationwide has been accelerated by attractive promotional deals and positive referrals. However, based on conversations with WIRED and the email communications we reviewed, there appears to be minimal proof that these agencies pursued or obtained validation for the capabilities that Global Intelligence advertised for its technology.

According to WIRED, legal officials, including Borden of Midland County, revealed they became aware of Cybercheck through its utilization by local law enforcement. They mentioned that its validity was often determined through the judicial process when it was introduced as part of legal proceedings.

Borden mentions, "The technology was innovative, and my curiosity was piqued, prompting me to think, 'Why not test it out and discover its potential?'" He adds, "I'm grateful that it wasn't required as evidence in my situation, that my conviction was secured without it."

Communications reveal that sales agents from Global Intelligence frequently proposed conducting police departments' investigations at no charge using Cybercheck as a means to showcase the system. Additionally, they mentioned incidents described as significant by Global Intelligence, which were allegedly resolved with the assistance of Cybercheck, though they did not specify these incidents or offer proof of Cybercheck's impact on the outcomes of these investigations.

Documents acquired by WIRED from the Ohio Bureau of Criminal Investigation reveal that detectives were initially eager to discover the insights Cybercheck could offer on their unsolved cases. They went as far as to connect sales agents from Global Intelligence with other police departments within Ohio. This initial excitement appeared to play a significant role in persuading additional agencies to put their faith in the company.

Gessner, associated with the Prosecutor's office of Summit County, mentioned that in the process of determining the adoption of Cybercheck evidence, they sought insights from the cybercrimes division of Ohio's BCI. The response was affirmative, highlighting a lack of such technological capabilities within their unit but expressing a keen interest in acquiring them. Additionally, when reaching out to the SANS Institute for their perspective, Gessner noted, they received feedback indicating that the institute does not engage in activities of this nature.

However, while it has retracted information previously supplied by Cybercheck, Gessner notes that the Summit County Prosecutor’s Office is inquiring with different firms about their ability to perform similar open-source tracking services that were advertised by Global Intelligence.

"He emphasizes the importance of keeping avenues open that could lead to uncovering the truth in their investigations."

Check Out These Suggestions…

Delivered to your inbox: A collection of the most fascinating and peculiar tales from the vault of WIRED.

Elon Musk poses a threat to national security

Interview: Meredith Whittaker Aims to Disprove Capitalist Beliefs

What's the best approach to tackling an issue like Polestar?

Event: Don't miss out on The Big Interview happening on December 3rd in San Francisco

Additional Coverage from WIRED

Evaluations and Tutorials

© 2024 Condé Nast. All rights reserved. A percentage of revenue from products bought via our website, as part of our Retail Affiliate Programs, may go to WIRED. Reproduction, distribution, transmission, storage, or any other form of usage of the content on this site is prohibited without explicit prior written consent from Condé Nast. Advertisement Choices

Choose a global website