Murder trial: Police find multiple airline and banking searches on missing woman’s phone

Law enforcement and FBI personnel testified Tuesday in the trial for Bernard Brown, who is accused of second degree murder in the disappearance and presumed death of his ex-girlfriend, Moreira “Mo” Monsalve. 

The 46-year-old mother of three was last seen on the evening of Sunday, Jan. 12, 2014, more than eight years ago. Brown has pleaded not guilty to the charges.

Between the evening of Jan. 12 and the early morning hours of Jan. 13, police observed that multiple websites were being accessed via browser activity on Monsalve’s phone.

In testimony on Tuesday, Lieutenant Nelson Hamilton detailed how Monsalve’s phone was found in pieces at the bottom of a dumpster at Pāpōhaku Park, located just 0.3 miles from Brown’s residence at ʻĪao Parkside. Along with the phone, police found a vehicle title, paperwork belonging to both Monsalve and her son, Monsalve’s checkbook, and her ID.

Police were led to the site on the afternoon of Thursday, Jan. 16, 2022, after being informed that Monsalve’s purse was found there earlier, and had been removed by a homeless man.

According to Lt. Hamilton, the area by the dumpster was cordoned off with police tape and trash was removed layer by layer, starting with the removal of bags and debris from the top. By the time the team got closer to the bottom, Lt. Hamilton had to go inside the dumpster because he could no longer reach over. “That’s when I noticed her ID card at the bottom,” he said.

At the time of the search, Hamilton was a Detective Sergeant with the Maui Police Department’s Criminal Intelligence Division.

The items were photographed and recovered by an evidence specialist.

Earlier that day at around noon, Lt. Hamilton was assigned to assist in doing a neighbor check to see if anyone saw or heard anything on the night of Jan. 12, 2014–when Monsalve was last seen at Brown’s residence.

About 45 minutes after completing the area and checking with neighbors, Lt. Hamilton said Brown came out of his apartment and approached him, asking what he should do about people harassing or threatening him.

During the exchange, Lt. Hamilton said he noticed “lots of scratches” down both of Brown’s arms. They were in “no particular direction, kind of all over, down his arms and forearms.” The officer described the scratches as “thin,” and noted they were possibly caused by walking through brush. When asked if they looked like fingernail marks, Lt. Hamilton said, “No.” He pointed to prior experience saying both the “thinness” and “randomness” of the marks led to this belief.

Lt. Hamilton was also tasked with reviewing phone statements and Facebook data extracted from Monsalve’s phone on the night of Jan. 12, to the morning of Jan. 13, 2014. This included browser activity that showed searches and bank activity.

The Lieutenant also observed a series of deletions to Brown’s Facebook account between 11 p.m. on Jan. 12 and after 7 a.m. on Jan. 13, in which he deleted in succession 21 individuals from his friends list, then 14, and then 23, for a total of 58 deleted relations.

Police also noted: a 14 second call made in the early morning hours of Jan. 13 from Monsalve’s phone to Brown’s phone; At around 1:04 a.m. on Jan. 13, police noted that Monalve’s Facebook account was doing an activity while inked to the same IP address as Brown’s; and after midnight, there were a series of bank or credit card searches done through Monsalve’s phone.

Police testified that on the morning of Jan. 13, there were several outgoing calls on Brown’s phone including one to Los Angeles, and two calls to numbers in the San Jose area code.

A stipulation witness, Dustin Simerly, who is employed as an electronics engineer with the FBI, noted that the organization was able to extract and image Monsave’s damaged Android smart phone.

The FBI Honolulu’s Cindy Maglasang, who is now retired, was trained, experienced, and certified in the digital analysis of cell phones.

She explained that the FBI in was able to image and store the data from Monsalve’s phone. In her capacity, Maglasang made a copy of the image and verified it using software and hash values to ensure the image created was the same as the original.

She said the duplicate was stored on an exam machine until done and then copied on another disc and stored with software results.  The results portion was then reviewed on a separate disk, while the original did not get touched, and remained as evidence.

Detective Matthew Bigoss, and 18 year veteran of the Maui Police Department, explained to jurors in more simplified terms what kind of data was found during an examination of Monsalve’s phone and Facebook accounts.

Det. Bigoss said, “If you’re using internet on the phone, there will be some data stored on the phone–whether you download it, or there are automatic processes happening in the background. Itʻs constantly storing data on your phone to make the user experience better.” 

In many cases, the phone stores data to speed up the presentation of web pages, according to Det. Bigoss. In this case, investigators used a physical extraction method to obtain data, which is a bit-by-bit copy of electronic storage data that is reviewed and held in a container file.

From Monsalve’s phone, Det. Bigoss said, he could say that at 9:08 p.m. on Jan. 12, 2014, and again at 1:04 a.m., Monsalve’s phone interacted with her Facebook app from Bernard Brown’s IP address.

Det. Bigoss also looked at machine cookies, which is a long alphanumeric string, used to identify a device, store preferences, and store analytics to see how many times someone has been to a website.

According to Det. Bigoss, the same IP address also showed up on Monsalve’s Facebook records. In cross-referencing the data, he found that those Facebook records showed that Monsalve’s account was being accessed from Brown’s IP address on the morning of Jan. 13, 2014, Jan. 29, 2014, and again on Feb. 4, 2014.

Using data from Monsalve’s and Brown’s Facebook records, he said there was one particular activity noted on Jan. 29, in which the same device was used to access both accounts.

There was also a 14 second call made from Monsalve’s phone on Jan. 13 at 12:07 a.m., and a text message from Monsalve’s phone to Brown’s phone at 2:46 a.m. on Jan. 13, according to police testimony.

Browsing history shows visits to mutilple banking, airline sites

Between the evening of Jan. 12 and the early morning hours of Jan. 13, police observed that multiple websites were being accessed via browser activity on Monsalve’s phone.

Det. Bigoss noted there were multiple visits to banking websites including:

• Bank of Hawaiʻi at 10:34 p.m., and 10:51 p.m. on Jan. 12; and (mobile banking) at 12:28 a.m. on Jan. 13, 2014.
• Capitol One: a Google search at 1:05 a.m., and website access at 1:16 a.m. on Jan. 13, 2014.
• Chase: Google search at 12:27 a.m.; Chase credit cards at 12:28 a.m.; mobile banking website at 1:58 a.m.; credit card customer service at 2:02 a.m.; and card service at 2:22 a.m. on Jan. 13, 2014.
• Rewards Visa: 1:40 a.m. on Jan. 13, 2014.
• Barclay cards: Google search at 1:42 a.m., login page and password 1:45 a.m. on Jan. 13, 2014.

Det. Bigoss also detailed access to multiple airline sites, and searches for airline fares between Kahului and San Jose airports.

• Priceline.com: 1:30 a.m. Google search for Priceline; 1:39 a.m. visit to mobile website; 1:40 a.m. Priceline rewards
• Hawaiian Airlines: Google search at 1:47 a.m., 2:27 a.m., and 2:34 a.m.; pages for flight and reservations availability; 1:56 a.m. LA Times article relating to Hawaiian Airlines.
• American Airlines: 1:53 a.m. search for American Airlines; access to page for booking a flight; 1:56 a.m. site activity; 2:22 a.m. website access.; 2:34 a.m. mobile site, flight booking page, sign in page, traveler information page, contact information, and summary of travelers.

According to Det. Bigoss, there was data entry that showed a departure date of Jan. 13 for one adult passenger. On the American Airlines website, a traveler summary page showed that the name of the traveler entered was Bernard Anthony Brown, with a birthday of July 4, 1971. Under the contact portion, Monslave’s phone number and email address were listed, according to testimony. The website offered options for return flights on Jan. 21 and 22, with information on available fares, according to Det. Bigoss.

After that, Monsalve’s cell phone data shows that the phone accessed the Chase mobile banking site again, and then the T-Mobile website. There was also more access to Microsoft, Outlook and Hotmail before browsing activity concluded at around 3:05 a.m., according to testimony.

Det. Bigoss outlined further browser activity on Monsalve’s phone during the time period, which included: access to Outlook and Hotmail, both Microsoft email services; MSN and T-Mobile pages. Facebook was also accessed for friend searches at 1:04 a.m., 1:20 a.m., and 1:57 a.m.; and there was a Facebook password reset at 1:32 a.m. on Jan. 13, 2022.

The trial resumes in 2nd Circuit Court on Thursday, Aug.11, before Judge Peter Cahill.