Nora Anne's inquest: Ransom demand e-mail account deactivated - Witness

Police witness, DSP Hazizi Abd Samad, 42, from the Cyber Crime Investigation Division, Commercial Crime Investigation Department (CCID), Bukit Aman, said that the account status was obtained when a check was conducted on Sept 14, this year, soon after the email address was obtained on Sept 11.

“In this investigation (of the e-mail account) there are two main parts, the first is the content and the second is the header. As my job is to analyse this e-mail, we are looking at the header because it contains information on how an e-mail is sent, as well as browser information and IP (Internet Protocol) address.

“On Sept 14, I checked the e-mail, '[email protected]', through the email checker website and it showed that the e-mail account had been deactivated.

The inquest proceedings before Coroner Maimoonah Aid to determine the cause of death of the Irish-French girl Nora Anne, has entered its 13th day, today.

Hazizi said that based on his 14 years of experience in the cyber crime division, such action showed an element of fraud, run by scammers. The investigation did not find the sender’s real IP.

He said that as the e-mail was registered under Microsoft Corporation, hence only Microsoft knew the real address of the e-mail and when it was created.

“In the investigation, the IP address was registered under the Hotmail webmail service,” he said.

Asked by deputy public prosecutor Nuralis Mat, what conclusions can be drawn about the e-mail, Hazizi said: “In my opinion, only Microsoft knows the IP address of the e-mail.”

Answering a question from lawyer S. Sakthyvell, who represented Nora Anne's family, whether the police can get information from Microsoft, Hazizi said that it could be done by using the Mutual Legal Assistance (MLA) scheme with the United States.

Sakthyvell: Does that mean only Microsoft knows the details of who owns this email?

Hazizi: Microsoft keeps all records from the beginning of the email account creation, delivery transactions and when it is deactivated. So as for the owner, in my opinion, as it is a free webmail service, anyone could register with any identity.

Asked by Sakthyvell whether an e-mail could be created in this country but using an IP address from the United Kingdom or the United States, Hazizi said that it could be done.

Earlier, two witnesses, member of the public, M. Magendran, 39, and the Cryptocurrency Crime Investigating officer, Forensic Accounting Investigation Division, CCID Bukit Aman, Inspector Nur Adli Md Saari, 36, as the 30th and 31st witnesses, respectively, were called to testify.

Nur Adli, while testifying, informed the court that the e-wallet number listed in the e-mail that purportedly demanding ransom amounting to two Bitcoins, was detected as that of a scammer.

He said that the police had deposited RM100 on Aug 13 last year, and a check on the e-wallet found that it was active on Aug 12 and 13 with the suspect transferring the said deposit into various other accounts to avoid detection.

“The e-wallet used is in line with the known tactics used by scammers,” he said.

Nora Anne went missing on Aug 4, last year, a day she and her parents arrived in Malaysia for a two-week holiday at a resort in Pantai, here.

Her body was found on Aug 13 near a stream in a hilly area, about 2.5km from the rainforest resort, following a massive search.

The post-mortem report stated that there was no criminal element in the death of Nora Anne and it was established that she died due to gastrointestinal bleeding from hunger and stress over a prolonged period.

The inquest continues tomorrow.