When did investigators identify Kohberger as a suspect?

I am less sure that the FBI used the MyHeritage database in the IGG process, but I am increasingly sure that Kohberger was already a suspect before the process started.

Before the most recent court hearing in which the two parties discussed the investigative genetic genealogy (IGG) information, I argued that the FBI likely violated the MyHeritage terms and conditions to identify a suspect through IGG. As I stated in that post:

At the beginning of the IGG process in this case, Othram Labs was under the impression that it would conduct both the creation of the SNP profile and the genetic genealogy; however, just as Othram began the construction of the family tree, the FBI took over…

The fact that the FBI took over the IGG process is notable: Othram’s genealogists are more than capable of constructing the family tree on their own, so the FBI’s interception was not due to a disparity in skill between genealogists.

I concluded that the FBI took over the IGG process because the FBI was willing to violate the MyHeritage terms and conditions while Othram was not.

This could still be true; however, the FBI has not hesitated to hand over such information to defense attorneys in the past. If the IGG records include information that the FBI used the MyHeritage database, then the defense should have that information by now. Perhaps they do.

But the defense seems to be probing at something else, something that they stated explicitly even before they received the IGG information: Kohberger was likely already identified as a suspect before the IGG process started. According to the defense in a document filed on June 22:

Mr. Kohberger has reasons to be extremely suspicious of the IGG used in this case. Rather than seeing it as some sort of complex tree building that led to him, it appears far more like a lineup where the government was already aware of who they wanted to target. Rather than have the investigation done by someone blind to that fact, the FBI chose to do it themselves.

(Emphasis mine.)

This would explain why the FBI intercepted the IGG process. Othram would not have been privy to any information regarding suspects already identified in the case, and a family tree produced by Othram would likely be more extensive than one produced by the FBI. Once Othram completed the DNA testing, the FBI could have taken the final file created through the sequencing process and created a family tree themselves, essentially drawing a line straight from the suspect’s top DNA match to Kohberger.

Hovering over the defense’s argument is the tacit claim that Kohberger was identified as a suspect through a frame job by law enforcement, which is not necessarily true. Instead, the defense won’t state what they probably learned through reviewing the discovery: That by the time the IGG process began, law enforcement was already scrutinizing Kohberger based on his vehicle, and they likely focused their investigation towards him on or before November 29 when Washington State University (WSU) officers reported his car to investigators.

Investigators initially struggled to identify his vehicle because, as I have argued in the past and will continue to do so, Kohberger disguised his vehicle before the immediate time window of the homicides. (He also likely disguised his car for the other “at least twelve occasions” that he was in the neighborhood. I have identified at least three appearances his vehicle would need to assume for my argument to work.) If this is true, then investigators could have identified Kohberger as a person of interest relatively early in the investigation but struggled to build a strong argument for probable cause until later.

And herein lies my argument: Investigators identified Kohberger as a person of interest within roughly two weeks of the homicides. Unfortunately, I am now confused as to why investigators relied on IGG to identify him as a suspect. I hope to understand more as time goes on.

My argument begins with the hours leading up to the homicides.

The Late Evening of November 12

There is a window of the timeline that has been mentioned since the beginning of the investigation but never—at least, by my observations—explored in-depth in the case’s public commentary. That would be the late hours of November 12.

Kohberger’s Alibi

In the August following Kohberger’s arrest, his lead defense attorney filed a response to an inquiry regarding an alibi defense by stating the following:

Mr. Kohberger has long had a habit of going for drives alone. Often he would go for drives at night. He did so late on November 12 and into November 13, 2022.

My interpretation of this statement is not only that Kohberger was out driving during the hours stated, but that the state has evidence to support this narrative that is impossible for Kohberger to side-step or deny; thus, his attorneys had no choice but to incorporate this evidence into their defense.

“Suspicious Behavior”

According to a Moscow press released dated November 20, investigators were interested in the possibility of suspicious behavior that stretched from late November 12 and into November 13 when the four victims were away from the King Road residence. According to the press release:

[D]etectives seek additional tips and surveillance video of any observed suspicious behavior on the night of November 12th into the early hours of November 13th while Kaylee Goncalves and Madison Mogen were in downtown Moscow and when Ethan Chapin and Xana Kernodle were at the Sigma Chi house.

Investigators had access to surveillance footage and witnesses from the Corner Club and Sigma Chi house where the victims spent their hours late on November 12. The dispersion of a press release to the public suggests that this was not enough; moreover, while the press release stated the locations of the victims, it is nondescript regarding the locations of the suspicious behavior potentially observed or caught on camera.

The Grub Truck Footage

But investigators also had footage from another location: The Grub Truck in downtown Moscow where Mogen and Goncalves were observed on camera for about fifteen minutes. According to a patron at the Grub Truck who reported to investigators his observations about a seemingly suspicious bystander, investigators did not ask him many questions. He stated:

They didn’t have that many questions, which I thought was weird… They were mostly interested in establishing a timeline for the girls…

My first thought upon watching this video shortly after its posting was that investigators already had a suspect identified—someone who wasn’t present at the Grub Truck—hence their alleged lack of interest in the patron’s observations about the bystander. Upon Kohberger’s arrest, however, I dismissed this idea. Investigators clearly did not have Kohberger identified as a suspect during the first week of the investigation.

But while investigators hadn’t identified a suspect by that point, they had identified something else: The suspect’s vehicle, which was captured by cameras in the King Road area around the time of the homicides.

It is possible that during the first week of the investigation, investigators both (1) had not yet identified a suspect, and (2) knew that the suspect had not patronized the Grub Truck that evening. But how is this possible?

Think, McFly! Think!

And after their visit to the Grub Truck, Mogen and Goncalves went home where they were ultimately killed.

1:56am

In the beginning of the investigation, Moscow police stated in their initial press releases that all four victims arrived home at approximately 1:45am from their respective locations.

According to the Goncalves family, this wasn’t true; electronic records indicated that Mogen and Goncalves arrived home at 1:56am. Alivea Goncalves told NewsNation, “[T]hey did officially update the timeline to reflect Kaylee and Maddie getting home at 1:56am. I’ve been pushing that from the very beginning.” Moscow police did not revise the statement in their press releases until November 27 despite having collected footage from at least one neighborhood camera on November 13.

But the Goncalves family and investigators likely weren’t the only people who knew when the four victims arrived home. There was somebody else, somebody who would have been reading the press releases very carefully. He would have known that the four victims did not arrive home at the same time. He would have known because he was there.

And that was the point: Publish incorrect arrival times because only the real suspect would know the truth. Once the Goncalves family kept pushing for a revision, however, investigators likely decided to sacrifice that detail and move on.

Wrong Direction and at the Wrong Time

This is the most unnecessary prong of my theory and the most likely to be incorrect.

After concluding that Kohberger was in the King Road neighborhood when Mogen and Goncalves came home, I reviewed the surveillance footage filmed by a camera on Linda Lane, the same camera that captures audio of a vehicle leaving the King Road area after the homicides at 4:21am. This footage corroborates the timeline presented in the probable cause affidavit, which states that Suspect Vehicle 1 left the area at “a high rate of speed” at approximately 4:20am.

Sure enough, there is audio of a vehicle leaving the area at timestamp 2:00:06—four minutes after Mogen and Goncalves arrive home—by what sounds like the same route the vehicle took at 4:21am.

If the 2am footage captures Kohberger’s vehicle leaving the area, then that could explain a statement from the defense that has confounded me for months:

A report from an analyst for the FBI dated March 21, 2023 shows the analyst heavily relying on a video of a car heading in the wrong direction and at the wrong time on Ridge Rd.

(Emphasis mine.)

Ridge Road shares the same stretch of street as Walenta Drive, which is the route that Suspect Vehicle 1 took to flee the area of the crime scene; the defense’s statement here suggests that the camera was affixed to a residence with a Ridge Road address.

But the phrase “in the wrong direction and at the wrong time” is a logical impossibility: Wrong time suggests that the vehicle isn’t supposed to be on that street at that time, in which case there is no right or wrong direction for the vehicle to travel. For example, if the vehicle were captured on camera traveling at a time when Kohberger is confirmed to be at his apartment in Pullman, then the vehicle cannot be traveling in the wrong direction because Kohberger’s vehicle shouldn’t be traveling at all.

But if the vehicle were leaving the area of the crime scene at 2am, then that is consistent with the defense’s statement in two respects: (1) The vehicle is traveling at 2am whereas the homicides occurred at 4am, which makes 2am the wrong time; and (2) the vehicle is traveling away from the neighborhood, and one would expect the vehicle to travel towards the neighborhood in the hours preceding the homicides. Of course, the vehicle returned to the area at 3:29am from the east.

So if investigators knew that the suspect was in the neighborhood in the late hours of November 12, then why are there seemingly no search warrants to cellular providers for information from the nearby cellular tower during those hours? The search warrants known to the public served to the four cellular providers only specified a two-hour window around the time of the homicides on November 13.

To answer that question, I will turn to the defense: “Precisely how the police came to believe the car was an Elantra is still unknown.” Granted, the defense gains nothing by acknowledging that the car is a Hyundai Elantra and conceding this fact to the state. Nevertheless, I think that something meaningful can be extracted from the defense’s statement.

And now we’re back to my favorite subject.

Kohberger Seemingly Altered His Car (Redux)

I have said this before, and I will say it again: Kohberger altered his vehicle. If a white sedan appears in the neighborhood late on November 12, and then a white sedan vaguely similar in appearance but with different characteristics appears in the neighborhood hours later, the onus is then on investigators to provide a reasonable basis supporting the common identity of those vehicles. Investigators likely intuited that the white sedan captured across all footage was the same—not just on November 12 and around the time of the homicides, but on prior occasions and at 9am—but an argument for probable cause might have been feeble.

That said, we don’t actually know that investigators didn’t search the nearby tower for November 12 or any other time.

The 8458 Phone

I will remind you that there are three fully sealed and redacted search warrants. We know nothing about their contents, but we know the dates they were sealed: November 16, December 5, and January 10. It is entirely possible that the warrant sealed on December 5 was served to AT&T for cellular data gathered on November 12; investigators would have known that Kohberger had an AT&T phone if they had identified him as a suspect by then. According to the affidavit:

During the [August 21] stop, which was recorded via a law enforcernent body camera, Kohberger provided his phone number as [redacted]-8458, hereafter the “8458 Phone” as his cellular telephone number. Investigators conducted electronic database queries and learned that the 8458 Phone is a number issued by AT&T.

This passage does not mention the data of the database query.

I am not married to the idea that the warrant sealed on December 5 was served to AT&T for information from the cellular tower near the crime scene, but the possibility thus far cannot be ruled out.

Anyway, back to the car.

The 2014–2016 Elantra in Pullman

The suspect’s vehicle—referred to as Suspect Vehicle 1 in the affidavit—was primarily analyzed by an FBI Forensic Examiner. According to the probable cause affidavit, the FBI analyst revised his assessment of the Elantra in Moscow captured around the time of the homicides from a 2011–2013 Hyundai Elantra to a 2011–2016:

After reviewing the numerous observations of Suspect Vehicle 1, the forensic examiner initially believed that Suspect Vehicle 1 was a 2011–2013 Hyundai Elantra. Upon further review, he indicated it could also be a 2011–2016 Hyundai Elantra.

So while his initial assessment excluded the years 2014–2016, he included those years in his revision; however, the analyst never revised his assessment of the Elantra caught on camera in Pullman. It always remained a 2014–2016. According to the affidavit:

This camera footage from Pullman, WA was provided to the same FBI Forensic Examiner. The Forensic Examiner identified the vehicle observed in Pullman, WA as being a 2014–2016 Hyundai Elantra.

This necessarily means that the analyst ruled out, from the beginning and throughout the investigation, the possibility of the car in Pullman being a 2011–2013. One might say that the cameras in Pullman provided clearer footage if their video resolution and placement were superior to those of the cameras in Moscow.

But there’s another possibility: It is possible to mistake a 2014–2016 Elantra for a 2011–2013, but it is impossible with advanced analysis software to do the reverse.

We don’t yet know which features of the vehicle the analyst and his software took into consideration for identification, but I will pay particular attention to the fog lights. The fog lights of the 2011–2013 Elantra are smaller than the fog lights of the 2014–2016. It would have been possible for Kohberger to install fog light covers over the L-shaped fog lights of his 2015 Elantra to make the lights appear smaller; he could not, however, make small fog lights on a 2011–2013 appear larger.

A 2011 Hyundai Elantra, left, and a 2015.

This means that the vehicle in Moscow could have been (1) a 2011–2013 Elantra, or (2) a 2014–2016 Elantra with fog light covers installed. Meanwhile, the vehicle in Pullman was likely captured on camera with its normal fog lights exposed, and that vehicle could only be a 2014–2016.

It is also worth noting that we don’t know the timeline for the footage analysis. The analyst’s revisions could have occurred in the same day rather than days or weeks apart. Moreover, we don’t know when investigators sent the Pullman footage to the FBI; however, I have a hard time believing that they didn’t review the footage until the IGG results came back. They likely reviewed the footage early in the investigation—definitely by the time WSU officers reported his vehicle—noticed the parallel activity of the white sedans in both cities, and understood that the two sedans were the same vehicle.

By the way, did you ever wonder why the vehicle on November 13 was referred to as Suspect Vehicle 1 in the affidavit? It is almost as if there was a Suspect Vehicle 2 on another night; footage from the other twelve occasions is not mentioned at all. Or, if the car assumed multiple appearances, then maybe there was a Suspect Vehicle 1A, Suspect Vehicle 1B, Suspect Vehicle 1C…

November 25–29: Kohberger’s Car is Discovered

According to the probable cause affidavit, investigators communicated to nearby law enforcement agencies information about a vehicle. The affidavit states:

On November 25, 2022, MPD asked area law enforcement agencies to be on the lookout for white Hyundai Elantras in the area.

But notice what information is not included in that passage: The year range of the vehicle. It is unlikely that investigators asked law enforcement agencies to be on the lookout for all white Hyundai Elantras of any year. Instead, it is more likely that investigators had already identified the vehicle as a white 2014–2016 Hyundai Elantra by that point, included the year range in the notice, but then omitted that information from the affidavit.

The New York Times, however, reported something different:

[F]urther scrutiny of the video footage produced more clarity, and on Nov. 25 the police in Moscow asked law enforcement agencies to look for a different type of car with a similar shape [to the Nissan Sentra]: white Hyundai Elantras from the model years 2011 to 2013.

If this were the case, then this reporting is based on information from a source or documents not provided to the public. The affidavit never says this.

And Air Mail reported something different still:

Back on November 25, Moscow P.D. had whispered to local lawmen to keep their eyes peeled for a white 2011–2016 Hyundai Elantra…

Again, there is no court document to support this year range.

That brings me to November 29.

On November 29, a WSU officer searched a database of vehicles registered at WSU and came across Kohberger’s 2015 Elantra. Thirty minutes later, another WSU officer at Kohberger’s apartment complex saw his vehicle. The affidavit is phrased in such a way that it almost seems like a coincidence, as if the two officers happened to discover Kohberger’s car within thirty minutes of each other:

On November 29, 2022, at approximately 12:28 a.m., Washington State University (WSU) Police Officer Daniel Tiengo, queried white Elantras registered at WSU. As a result of that query he located a 2015 white Elantra with a Pennsylvania license plate LFZ-8649. This vehicle was registered to Bryan Kohberger…

That same day at approximately 12:58 a.m., WSU Officer Curtis Whitman was looking for white Hyundai Elantras and located a 2015 white Hyundai Elantra at 1630 NE Valley Road in Pullman in the parking lot.

So within thirty minutes of one officer stumbling across Kohberger’s vehicle in the database, another officer is at the apartment complex and makes a visual identification of the vehicle. Perhaps the latter officer was instructed to go there. Why?

To check the vehicle for alterations. Then, the car was reported on an undisclosed date.

Also of relevance is the date when Kohberger changed his vehicle’s registration. The vehicle observed on cameras in Moscow lacked a front-facing plate, so investigators were likely looking for vehicles registered in states that don’t require front-facing plates. Pennsylvania doesn’t require front-facing plates while Washington does. According to Kohberger’s Carfax report, he switched his vehicle’s registration from Pennsylvania to Washington on Friday, November 18. The New York Times reported that investigators were searching for information regarding 2019–2023 Nissan Sentras “a week after the killings,” which would have been on or around November 20. By the time that investigators were searching for the correct vehicle, Kohberger would have switched his vehicle registration, and it might not have been swept up in the net of vehicles registered to other states. That is, until the WSU officers found his outdated registration in their system.

But why didn’t investigators begin serving search warrants for Kohberger’s information at that point? Well, it might depend on the appearance of his vehicle. As I stated above, Kohberger’s vehicle likely assumed at least three different disguises: One for the immediate time window of the homicides, a second for the other “at least twelve occasions,” and a third for everywhere else. It is possible that after the homicides, Kohberger’s vehicle never again resembled the vehicle captured on surveillance footage in Moscow. Investigators would have known what was happening, but perhaps they were waiting for stronger evidence.

And there’s something else that occurred on November 29: Prosecutor Bill Thompson gave his last interview, and Moscow police began uploading interviews to YouTube conducted internally on December 6.

At the time, everyone—myself included—thought the prosecutor’s office and investigators stopped giving interviews because of the confusion surrounding the term targeted attack and the seemingly mixed messages reporters were given regarding what that meant. The interviews stopped as this issue came to a head. They’re too disorganized! They don’t have their ducks in a row! Nobody is on the same page!

I now believe that they stopped giving interviews because they were homing in on a suspect and didn’t want to inadvertently tip off the public or the potential suspect himself.

But if this were true, then one might wonder why investigators weren’t surveilling Kohberger in Pullman before he left for Pennsylvania on December 15. Well… who said they weren’t?

Moving on.

November 30: Troy and Kendrick, Idaho

According to Fox News, on November 30 investigators requested from businesses in Troy and Kendrick, Idaho, surveillance footage recorded from November 12 to November 14. Both towns are to the east of the Moscow-Pullman area.

This could have been for two reasons: (1) They knew that Kohberger spent time in the rural area south of Moscow and Pullman and were trying to understand his exact whereabouts; or (2) they were preparing for the court case and knew that a defense attorney would complain about a lack of footage proving that the suspect went elsewhere after the homicides, not to Pullman.

Either explanation is reasonable. Regardless, I think investigators were interested in Kohberger by the time they requested the footage.

December 7: The Public Notice

On December 7, Moscow police sent out a public notice requesting information about a white 2011–2013 Hyundai Elantra. According to my argument thus far, investigators had already correctly identified the suspect’s vehicle by that point. If that is true, then why did they provide an inaccurate year range in the public notice?

This could have been due to a combination of three reasons: (1) The car at least resembled a 2011–2013 Elantra at certain times, (2) someone with valuable information about Kohberger will not be discouraged by an inaccurate year range, and (3) investigators did not want to tip off the suspect that they had correctly identified his vehicle. Investigators were aiming for the best of both worlds: Provide enough information to prompt someone suspicious of Kohberger to come forward, but also assure Kohberger that they are on the wrong track and won’t catch up to him any time soon.

But at some point in the timeline, investigators felt compelled to use one tool stored in their back pocket the entire time: IGG.

Coming Full Circle

By December 19, according to the New York Times, Kohberger was identified as a suspect through a family tree constructed from the suspect’s DNA. The first search warrants for Kohberger’s information were served on December 23. The pace was picking up.

While an argument for probable cause based on a misidentified vehicle might be harshly scrutinized, probable cause rooted in a positive DNA identification would be less so. Search warrants sought with DNA evidence are less likely to be denied by the magistrate judge and tossed by the trial judge. The state’s case could build on stronger ground.

Notably, the state claimed in a June 2023 motion that investigators were led to Kohberger through IGG. According to the state:

To the extent the IGG information has any relevance, the fact that it led law enforcement to Defendant means it is inculpatory rather than exculpatory in nature… The mere fact that uploading the completed SNP profile into a publicly available genetic genealogy service led law enforcement to relatives of Defendant does not affect the strength of the evidence against him.

(Emphasis mine.)

What led means, however, is less clear considering what I have argued above.

And while I don’t fully understand how IGG fits into this story, I find myself in good company, because apparently Anne Taylor doesn’t understand it, either. As Taylor said in the January 26 hearing:

I want us to have a clear picture… and the clear picture that I’m concerned about is the state’s pathway of how Bryan Kohberger comes to their attention and is identified. I’ve read that PC affidavit over and over and over again, and I’m not sure. I’m over a year into this case—and everything that I’ve read—and I’ve spoken to our team. We’re not sure how the state decides on Bryan Kohberger. I know different pieces, but I don’t know where they fit together. And the more work I do, the less I know about how they fit together.

It is possible that Taylor is, to some extent, playing dumb here to get what she wants. I cannot possibly build a defense for my client unless I have this thing that I want. Once the court grants me this thing that I want, then everything will finally make sense.

But I don’t think she’s playing dumb. By my estimation, there is likely an essence of truth to what she’s saying: The more she learns about the evidence—particularly the evidence investigators gathered before the IGG process began—the less she understands about why investigators used IGG at all.

And that brings us to today: The defense is pouring over the IGG information, likely with the intention of filing motions based on their findings. They will continue to argue—correctly, I believe—that Kohberger was identified as a person of interest well before the IGG process began.

I don’t think that argument cuts in their favor.

Anyway, I wonder what Kohberger was doing late on November 12. Did he get out of his car?

See you tomorrow.