Print Command

With Chris 400Km away from the fire scene, IAG had a massive issue if they wanted to continue the case against him.

Russell Joseph had found no real evidence examining the fire scene over 3 visits in 2011. He hadn’t been able to identify the Point of Origin or establish the cause of the fire.

He had incriminated Chris by claiming he found Accelerants but this he knew would not stand up in a Court. The pre-trial had sounded serious alarm bells in respect of his evidence about the rocks and the fire being staged. He had been forced to admit at the Pre-trial on 13 April 2013, that there was nothing in the fire scene to link Chris to actually setting the fire.

Pre Trial 1 – 13 April 2013

The only possible connection was Remote Ignition, the original theory had been based on hacking the printer but after Chris shot that down at the Police Interview, the ‘Trigger system’ had replaced the Hacking theory.

Both theories relied on the Printer printing and Jorgensen was restricted in what he could do to ‘find’ one as Joseph had done with the printer remains since he had sent a certified copy of the Hard Disk to the defence removing the option of him editing one of the records it contained.

He knew that there was no print command, he’d searched every possible location where a record could be seen. Chris had also realised this, IAG concentrating on the use of the remote print option available in LogMeIn wasn’t really required if there was a print command record. LogMeIn’s remote print option was clearly explained in the manual. It was a simple system, a client system, in this case the Macbook in Hamilton could log on to the LogMeIn host, in this case the PC at Killara, to remotely print a document from the HOST on a printer attached to the client. The reverse to what was needed to replace the missing Print Command.

Naturally, using LogMeIn it is possible to operate the host as if you are sitting in front of it, so printing a document on the host would use the host’s printer in the normal way, i.e. using the print spooler to handle a ‘Print Command.’

The first pre trial had received a good result for IAG when Judge MacDonald delivered his decision that the evidence of the investigators was all admissible. This was quite remarkable when the defence had shown so much of the evidence was false.

The Court of Appeal however, considered that there was a serious hole in the Crown’s case, the lack of the print Command. They didn’t throw the case out however, they gave them a chance to rectify the issue, to find a print command or to prove by inference that one was sent to the printer.

Appeal decision – 17 June 2014

Another year almost passed before a hearing took place for IAG’s investigator Jorgensen to present his evidence that that he could meet the Court of Appeal’s criteria.

It started badly for IAG, the defence had a real computer expert in the Court with his full data analysis gear connected to the certified copy of the PC hard drive removed from the host PC recovered from the fire scene. He produced a record from the PC’s Print Spooler, it showed that the last PRINT COMMAND processed by the spooler was on 8 September 2011 at 22:55:09 over a day before the fire. The Crown and Jorgensen agreed that this was correct.

IAG’s expert, Jorgensen tried to get around this by saying there is a system, DIRECT PRINTING, that allows the printer to operate without using PRINT COMMANDS and the Print spooler. This according to him required a change in the printer settings. Such a change would naturally be reflected in the PC Registry pages recording the printer settings taking place after the last print command before the fire.

There was some debate over which particular setting was involved, all that the experts could agree on was that the setting was 0x00000002 but nothing was found to identify which key would hold this commonly used value in the registry.

The IAG expert was allowed to return to his office to research overnight and report back by AVS link the next day.

When he did he produced an excerpt from a registry page dated 9/10/2011, the day of the fire, with one of the keys, labelled Attribute set at 0x00000002 which he claimed, without any evidence to support his claim, showed the printer was set to Direct Print.

Jorgensen’s extract of Registry page.

The defence expert checked the original printer page in the registry identified by Jorgensen’s excerpt and the same block of data was visible BUT the header of the page stated this page had last been updated on 30 April 2011, months prior to the fire.

Full Registry page – Last Written Time 30/04/2011 3:38:35 UTC

IAG’s expert had falsified the date on his document, using the date the last change to any page in the registry had been updated compared to the date the actual page had been updated.

He couldn’t explain how the printer could have worked on 9 Sept, the day of the fire, controlled by Direct printing whilst it had worked using the Print Command setting on 8 Sept and the settings controlling the printer hadn’t changed since 30 April 2011.

The Judge correctly stated that the print command system was in charge of the printer on the day of the fire and therefore the last print command was 24 hours earlier.

That destroyed the Remote Ignition theory. The prosecution barrister agreed that without Remote Ignition there was no case against Chris.

The evidence was based entirely on PC records, it is not disputable, there was no REMOTE IGNITION involved in causing the fire and Chris was 400Km away. It had previously been established that there was no evidence at all in the fire scene to link him to the fire.

After the new Pre-trial, 16-18 February 2015. Judge McDonald in his Reserved Judgment of 17 April 2015 summed up the case very well. In detail stating: –

Print command

[ 5] The Crown continues to rely upon the remote ignition theory as to how Mr Robinson was able to start the fire at his home in Kerikeri while he was in Hamilton. Mr Annandale accepted in his opening written submissions and in his closing oral submissions that there is no direct evidence of something being printed on 9 September 2011. There is no direct evidence of a print command being sent by Mr Robinson’s MacBook, in Hamilton, to the home Acer computer then to the printer in the library at his home. That is a proper concession to make. Mr Jorgenson accepted that there was no evidence that a print command was sent.

 [13] The Acer computer did not shut down correctly instead it crashed. As a result, the spool file, if the background printing setting was in use, would not have been cleaned and a record would remain. Mr Jorgenson accepted that the last print job the Acer computer did, as recorded on the spool file, was on 8 September 2011 at 22:55:09; that is the day before the fire. There is no further record of any print job after that. How then could a print command be sent to the printer by the Acer computer and not be recorded? The second setting is direct to printer. Mr Jorgenson told me:

‘If you go into the printer configurations options, the set-up options, which you can do at any time and change as often as you like and select the option to print directly to the printer, it doesn’t go there the printer spool file, it doesn’t create a record and there is no trace of what was printed.’

[16] When the Court resumed on 18 February 2015 Mr Jorgenson told me that he had made further investigations overnight in an attempt to find the setting which holds whether the printer was set to “background printing” or “print direct”. He found the configuration settings the registry holds for a particular device in this case the printer. The information is not held in the printer driver attributes key but in a key simply called attributes. The Brother printer settings for the key attributes showed a value of 002 indicating the setting for the printer was “direct to print” 11.04pm on 9 September 2011 at the time when the Acer computer crashed. He said the LogMeIn printer driver contained similar information indicating that it was set to operate “direct to printer” and not to operate through the spool file as would occur in the “background printing” setting.

[17] In cross-examination Ms Cull drew Mr Jorgensen’s attention to Exhibit 5 (which identified the settings in the key called attributes) and that it says “key properties last written time 30th of April 2011” (NOE page 121). Mr Jorgensen accepted that if there are any changes made to settings that will change the registry and would be able to be seen. Therefore, the last change to that printer registry was on the 30th of April 2011.

[18] Ms Cull then asked Mr Jorgensen how he would explain how, if these settings he has described were last written on 30 April 2011 and are still the same as at 9 September 2011, the print job on 8 September 2011 went to the spool file?

[21] In summary Mr Jorgenson’s evidence can be distilled to:

(a) There are two possible settings: background printing which goes through via a spool file and direct to printer which leaves no trace

(b) The spool file is cleaned every time the computer is shut down correctly

(c) On 9 September 2011 the computer crashed. The spool file would not have been cleaned.

(d) The spool file was last modified (the last time a document was printed via the spool file) on 8 September 2011 at 22:55:09

(e) In the attributes key both the Brother printer and LogMeIn printer driver were set to direct to print

(f) Those settings had been in place since 30 April 2011. Therefore, those settings were in place when a print job went through via the print spool file on 8 September 2011

(g) Mr Jorgensen cannot explain how this occurred but does not dispute that the evidence indicates it did. He believes that would require an explanation from a Microsoft Senior Systems advisory engineer.

In fact, Jorgensen had NOT produced any evidence that the Attributes key he identified was related to Direct Printing. It just had the correct value, 0x00000002, which is very common in the whole registry, clearly, it was not that key at all.

He had actually PROVED that remote ignition never took place. He had accepted that the Print Spooler was in control of the printer on the day of the fire, since it had received and processed a print command on 8 September 2011 and then shown that the settings had not been changed since 30 April 2011.

Remote ignition relied on a print command being received on the night of the fire BUT the last print command had been established, as agreed by Jorgensen, to have occurred at 22:55:09 on the 8 September 2011, over 24 hours previous to the time the fire was first seen.

Therefore, the Remote Ignition theory was shown to be false, it did not occur. Nothing had been found in the fire scene to link Chris to setting the fire so together these pieces of evidence provided PROOF that he had NO OPPORTUNITY to cause the fire.

It is worth pointing out here that the same evidence, the PC registry records would, in the Civil Court, also prove that Chris had NO OPPORTUNITY to CAUSE THE FIRE.

Two weeks later in an ORAL JUDGMENT on 1 May, Judge McDonald stated: –

[4] The Crown sought time to take advice from Crown Law. They have now done that. The Crown do not seek to appeal my second decision. As Mr Annandale accepted at the end of the second pre-trial, without the remote ignition evidence there was insufficient evidence to proceed to trial against Mr Robinson on any of the counts in the indictment. In short, the Crown could not prove that it was Mr Robinson who set the fire or had it set.

[5] Ms Cull renews her 347 application that she made in mid-2013. I grant that application. There is now no evidence to prove the remote ignition theory.

Mr Robinson is discharged under that section on all counts in the indictment. That discharge is deemed to be an acquittal.

Judge McDonald ordered the Court to forward his Judgment to Judge Heath. He was in charge of the Blackmail charges against Chris and had agreed with the ruling of Justice Wylie, which in essence, stated that Chris could be guilty of blackmail if he was guilty of arson. Heath had extended this to the corollary, if Chris was not guilty of arson then he could not be guilty of the blackmail. The two cases were therefore legally linked.

Judge McDonald explained that he could not acquit Chris of the blackmail charges since they were in the High Court but both he and Mike Smith, the Crown barrister, agreed that this would happen in a few days.

Catherine Cull, Chris’s barrister recorded the forwarding of the Judgment to Judge Heath in her confirmation of his acquittal, dated 5 May 2015.

Looking at this raises serious issues, Russell Joseph had stated on 13 April 2013 at the Pre trial that there was no physical evidence from the fire scene that linked Chris to the setting of the fire and the remote ignition theory was shown to be fictional without any evidence that was not created by Jorgensen. 

Why then was Chris arrested in the first place, shouldn’t it have been left to Jorgensen to find some concrete proof that remote ignition took place before the arrest? They had had over 8 months between the fire and his arrest to find the evidence but as can be seen above there was none to be found!

Time was the enemy of IAG here, Chris was arrested just days before IAG would have to file a defence to the High Court case filed by Andrew Hooker which in reality was impossible to produce. That case was stayed due to the arrest of Chris for arson.

Leave a Reply

Your email address will not be published. Required fields are marked *