Fall 2019 Gavel Fall 2019 Gavel | Page 14

Stephen Allwine: When crime tries to cover its digital tracks By Mark Lanterman In late 2016, I was approached by the Washington County (MN) Attorney’s Office to conduct forensic analysis on a number of devices in a homicide investigation. It soon became clear that the case would be one of the most interesting of my career, involving murder-for- hire, religious convictions, insurance money, infidelity, and a distinctly modern element – the Dark Web – that combined to make for one of the most tragic and complex cases I’ve encountered. The Dark Web, a broad term used to describe the 83 percent of the internet inaccessible through common search engines like Google or Bing, is where many people go to find illegal drugs, child pornography, stolen credit card numbers, and hacking services (though not every service and product available in this online marketplace is illegal). Enter defendant Stephen Allwine: After his attempts to hire a hitman on the Dark Web failed, Allwine murdered his wife in their Cottage Grove home and staged it as a suicide. In January 2018, Allwine was sentenced to life in prison; forensic analysis played a critical role in fleshing out the narrative details that helped the jury make their decision. In 2015, Steve Allwine began exploring a website known for neither its upstanding moral quality nor its cybersecurity strength – Ashley Madison. Through this cheating website, Steve began experimenting with extramarital affairs and the underbelly of the internet. Analysis of Allwine’s devices revealed communications with at least two women through the site; their conversations illustrated Allwine’s dissatisfaction with his marriage and his desire to become involved with other women, unhindered. Exploring the Dark Web While Ashley Madison itself is not part of the Dark Web, I would consider it to be a kind of gateway to the darker aspects of internet usage. It wasn’t long after his first few Ashley Madison-initiated affairs that the Dark Web became a prominent part of Steve Allwine’s browsing. Jurors learned that Allwine first discovered Ashley Madison as a marriage counselor for couples in his church. Though Allwine ultimately initiated affairs through this site – many users who sign up for Ashley Madison and similar cheating sites don’t actually end up having affairs – he still did not regard divorce as an option. Constrained by the marital requirements of his church, Allwine took a dive into the Dark Web to search for other solutions to his predicament. It wasn’t long before Allwine discovered Besa Mafia, a Dark Web group claiming to provide anonymous hitman services. Besa Mafia was a Dark Web vendor that advertised themselves with the slogan “Hire a killer or a hacker.” The enterprise was later revealed to be a scam, but Allwine – using the pseudonym “dogdaygod” – communicated extensively with Besa Mafia, communications which were subsequently released to the internet. These communications included multiple references to Amy Allwine and included her home address, phone number, physical description, and a photograph. One particularly thorough attempt to organize the hit once and for all involved Allwine providing particular location information, a current picture, and a description of her vehicle. Of particular note was the photo shared, which was subsequently discovered in a folder on one of Allwine’s devices. But the hit he sought to arrange never occurred, and Allwine would later report his lost thousands of dollars to the police. While Allwine clearly endeavored to remain invisible on the internet, a key piece of evidence unequivocally tied him to a Bitcoin payment made to Besa Mafia for the murder of Amy Allwine: a unique, 34-digit alpha-numeric Bitcoin wallet address typed out in his iPhone’s Notes app that had been deleted. This Bitcoin address matched the one used by “dogdaygod” to make a payment to Besa Mafia. Though Bitcoin has become increasingly popular in recent months even among non-Dark Web users, it remains the preferred currency for Dark Web exchanges. The address found in Steve Allwine’s deleted note proved to be critical to the case. As Washington County prosecutor Fred Fink explained later, “It was absolutely vital for the State to prove that ‘dogdaygod’ was, in fact, Stephen Allwine. With that connection made, we were able to show intent to kill and premeditation.” A pattern of deception My analysis of Steve Allwine’s devices also revealed a steady pattern of anonymizing service use, disposable account creation, and a desire to conceal his identity from law enforcement. My office was provided Mark Lanterman is CTO of Computer Forensic Services. A former member of the U.S. Secret Service Electronic Crimes Taskforce, Mark has 28 years of security/forensic experience and has testified in over 2,000 trials. He is a member of the MN Lawyers Professional Responsibility Board. 14 THE GAVEL