Inquest: Email used to send ransom note to Nora Anne Quoirin’s family deactivated, likely to hide tracks

SEREMBAN, Oct 22 — The email account used to send a purported ransom demand to the family of Irish-French teen Nora Anne Quoirin after her disappearance near here last year was found to be deactivated, possibly to conceal the fraud attempt, a senior police investigator testified at the Coroner’s Court today.

Federal Commercial Crime Investigation Department (Cybercrime and Multimedia) investigating officer Deputy Superintendent Hazizi Abd Samad said the account’s status was obtained from analysis conducted on the purported sender’s email address on September 14, 2020.

“Based on my assumption and experience, if an email address no longer exists it would mean that the email creator made the decision to erase it.

“Such behaviour in many cybercrime-related cases, is attributable to frauds run by scammers,” Hazizi, who is the 32nd witness in Quoirin’s inquest, told Coroner Maimoonah Aid.

Hazizi was called to testify after the court was previously informed that Quoirin’s family had received an email demanding for a ransom amounting to two Bitcoin (BTC) — equivalent to RM23,000 at that time —  on August 7, 2019.

Witnesses had then told the court the email was later found to be a scam that purportedly originated from Virginia, United States.

Today, Hazizi also confirmed the intended recipient of said ransom email as the Lucie Blackman Trust, a charity and support group.

As the officer assigned to analyse the email, Hazizi said he utilised open-source software to examine the email’s header when he was instructed to do so on September 11, 2020.

Hazizi also told the court he was unable to determine when the account was deactivated, but added that further information on the creation and deletion of the account could be obtained from Microsoft Corporation as it was registered under the Hotmail webmail service then.

He explained that this could be performed through a Mutual Legal Assistance request made through the Attorney General’s Chamber.

When asked if one could spoof the creation of an email, Hazizi said it was plausible since it is a free webmail service and that users are not necessarily required to provide detailed information to verify their existence.

Federal Commercial Crime Investigation Department officer Inspector Nur Adli Md Saari is pictured at Seremban Coroner’s Court October 22, 2020. — Picture by Ahmad Zamzahuri

Testifying as the 31st witness, Federal Commercial Crime Investigation Department investigating officer Inspector Nur Adli Md Saari also told the court how the email’s sender had used a layering method to mask their transactions and avoid detection.

“On August 13, 2019, I received instructions from my superior to conduct an analysis on a Bitcoin wallet address named in the email received by Quoirin’s family.

As part of his analysis, Nur Adli said he made a deposit to see where the trail led, with the suspect transferring said deposit the next day to several other wallet addresses.

“In layman’s terms, as an investigating officer I was tasked with following the money trail,” he said.

He also said initial investigations on the wallet address revealed that it was newly created with no transaction history whatsoever.

“I found that the pattern used by the email sender leaned towards the modus operandi used by scammers to take advantage of their victims by demanding ransoms in the form of Bitcoin.

“Based on the layering method and how the email was written, it is a known tactic used by scammers,” he added.

Quoirin, a 15-year-old with learning difficulties, disappeared from The Dusun resort last year where she had been staying with her London-based family, triggering a 10-day hunt involving helicopters, search dogs and hundreds of searchers.

Her nude body was later discovered close to the jungle retreat and an autopsy found that she probably starved and died of internal bleeding after spending about a week in the dense rainforest.