Security cameras. Internet video streams. Cellphone towers.
In the days after four college students were stabbed to death in their Moscow, Idaho, rental home in the early hours of Nov. 13, police traced the digital footprint of the victims and the man accused of killing them in exhaustive detail.
Authorities tracked down the suspect’s car in his college parking lot, backtracked his cellphone’s movements for six months, and even figured out exactly what time one of the victims was using TikTok on her phone, court records show. They used a video stream from a food truck to help determine where two of the victims had been earlier, and phone records to figure out who gave them a ride home.
While investigators worked long hours to crack the case, technology sped things along dramatically, including thousands of digital uploads processed by the FBI. Without a murder weapon, motive or anyone seeing the killer’s face, authorities were able to make extraordinary use of advancements in technology to piece together the mystery surrounding who they say killed University of Idaho students Ethan Chapin, 20, Madison Mogen, 21, Kaylee Goncalves, 21, and Xana Kernodle, 20 — an act of violence that upended the small college town.
«I think it just goes to this idea that there is no perfect crime in this day and age,» said former Los Angeles County prosecutor Joshua Ritter, who is now a partner with El Dabe Ritter Trial Lawyers. «It is for the most part a fairly circumstantial case. And building that kind of case requires you to build this kind of tapestry of evidence, which they have done here in a very remarkable way.»
While experts like Mary Phan, professor at the University of Washington School of Law, called the police work «a perfect case study in modern investigative techniques,» others expressed caution.
Well-known Colorado defense attorney Iris Eytan said she thought the newly released charging document reflect a police department desperate to make an arrest without considering other possible suspects or exploring why the surviving roommates didn’t do more to help their friends.
‘Extensive hours spent unraveling this case’
Authorities were able to access an extraordinary amount of information, allowing them to piece together videos and pieces of data to unravel what happened in the early morning hours of Nov. 13.
«You’re looking at a combination of newer, sophisticated technology, combined with old-fashioned police work,» said Howard Ryan, a law enforcement consultant and former New Jersey State Police crime scene investigator.
Authorities found the suspect’s phone was turned off or put into airplane mode for two hours bracketing the attack. They got cell phone records showing he’d been in the area of the attacks at least 12 times in the previous several months, almost always late at night or early in the morning, the charging documents say.
And they got records showing he apparently drove past the scene of the crime the next morning — while the two surviving roommates slept unaware of the carnage around them.
TIMELINE IN IDAHO STUDENT KILLINGS:A mystery, no leads, then a break in the case
MORE ON SUSPECT:What we know about Bryan Kohberger, arrested in the slaying of 4 University of Idaho students
The breadth of videos garnered in the probe may have even captured a portion of the attack itself after an audio recording from a nearby security camera «picked up distorted audio of what sounded like voices or a whimper followed by a loud thud,» police said in the affidavit, noting a dog could be heard barking afterward.
And as a small army of local, state and FBI investigators zeroed in on Bryan Kohberger, they also tracked his car’s cross-country journey and rifled through his parents’ trash to extract DNA evidence they say puts him at the crime scene. Kohberger is a PhD student at Washington State University in Pullman, about 10 miles away from Moscow.
«It was persistent determination and extensive hours spent unraveling this case that led to an arrest,» Moscow Police Chief James Fry said.
How Idaho police untangled a mystery using TikTok, Doordash, cameras
In the hours and days after the attack, police asked area residents to send in tips and any video they had. By Nov. 25, they asked other law enforcement agencies to watch for a white 2011-2016 Hyundai Elantra, which was spotted on surveillance cameras in the neighborhood.
Three days later, a Washington State University police officer — working an overnight shift — used his access to the university’s campus vehicle registration database to find a vehicle matching that description. Twenty minutes later, a colleague found the car, parked outside Kohberger’s apartment.
It’s that moment police first mention Kohberger’s name in the lengthy arrest documents released this week. The discovery appeared to open a new phase in the probe as authorities worked backward, tracking both the owner and the car’s movements on the night of the attack.
Investigators previously acquired data on every cellphone in the vicinity of the attacks, but Kohberger’s phone was not among them. Now armed with the knowledge that a car matching his had been seen in the area, investigators on Dec. 23 asked AT&T to give them all of Kohberger’s location data for the past six months. The data showed his phone left his house in the early morning hours of the attack and then stopped transmitting for about two hours around 2:47 a.m., the same time period investigators believe the students were killed, the documents say.
«This is done by subjects in an effort to avoid alerting law-enforcement that a cellular device associated with them is within a particular area where a crime is committed,» Moscow Police Department Corporal Brett Payne wrote in an affidavit.
As they tried to find the killer, police used video clips and social media posts to track the victims’ movements the previous evening. One clip that received widespread attention was of Goncalves and Mogen visiting a food truck, their presence captured on a live video feed usually used by patrons to see how long the lines are.
Police said the footage gave them a time and a place, allowing them to track the victims and establish more of a timeline.
By 2 a.m. the morning of the attack, all six people inside the home were in their rooms, investigators determined, but they also knew Kernodle was waiting for a DoorDash food delivery, which arrived around 4 a.m., court documents say.
Investigators say they believe the killings happened in the next 25 minutes. And although one of the surviving roommates reported seeing a tall masked man with bushy eyebrows inside the home — but apparently didn’t tell anyone, call 911 or check on her roommates — police had little to go on.
That changed as they used security camera footage to track vehicles entering the otherwise quiet residential area.
A breakthrough in the case came with a white sedan
Footage from one camera shows a white sedan repeatedly driving past the home, arriving in the area the last time at 4:04 a.m. and then leaving «at a high rate of speed» at 4:20 a.m., according to the court documents. Because officers couldn’t see a front plate, an FBI agent who specializes in vehicle identifications examined the video and concluded it was likely a 2011-2016 Hyundai Elantra sedan.
Investigators then worked backward and found what they believed to be the same car as it left nearby Pullman, Washington — home to Washington State University — at 2:44 a.m. and headed to Moscow, and then back again to the WSU campus area at 5:25 a.m., the affidavit outlines. It’s unclear exactly when police viewed that camera footage.
And although the public didn’t yet have the description of the suspect provided by one of the surviving roommates, police said they could see Kohberger fit the profile: Tall, thin and with bushy eyebrows.
MORE:How did investigators use DNA profiling to identify the suspect in the Idaho student killings?
When police reviewed Kohberger’s cell phone location history, they saw he’d been near the victims’ home at least 12 times in the proceeding months — and once again a few hours after the killings, according to the arrest documents.
All the police work to that point was circumstantial evidence. Nothing yet tied Kohberger to the house itself. The cellphone location data analyzed by Moscow police did not provide specific locations, only general areas.
But there was the DNA.
Left behind at the house after the Nov. 13 attack was a sheath for a large fixed-blade knife, and on that sheath, enough DNA material to develop a profile. It’s unclear how long it took Idaho authorities to develop that profile, but it was useless without someone to compare it to.
«All of that other evidence, even the eyewitness evidence, down to the cell phone, down to the car, really is just corroborating the DNA,» said Ritter, the former prosecutor. «All along, the very large elephant in the room would be the DNA on the knife sheath.»
Unresolved questions, unclear motive
Days after the attack, Kohberger switched the license plates on his car.
For months, he’d been driving around with a Pennsylvania plate on the back, but not on the front. On Nov. 18, he registered the car in Washington state and got new plates. A few weeks later, he drove back home to Pennsylvania with his father.
A license-plate reader caught the car as it entered Colorado. Body-camera footage released by Indiana State Police this week shows a trooper stopping Kohberger and his father — with Washington plates on the Hyundai — on Dec. 15. Authorities in Indiana said they weren’t looking specifically for Kohberger at the time. He was released without being ticketed.
MORE:TikTok tried to solve the Idaho murders. Instead, it fueled an online witch hunt.
As Kohberger spent time with family back home in Pennsylvania, authorities were close by. On Dec. 27, just days after tracing his cellphone records and linking his vehicle to the crime scene, investigators snatched trash from outside his parents’ home in Albrightsville, Pennsylvania.
They produced a DNA profile the next day, finding that a man who lives there was 99.9% certain to be the father of the person who left the DNA on the knife sheath.
Authorities got the DNA report Dec. 28. Kohberger was arrested the next day.
AN ARREST:Suspect in killings of Idaho college students arrested in Pennsylvania; authorities mum on motive
BACKGROUND:University of Idaho students slayings ‘took our innocence,’ authorities say
«This is still a skeleton of the evidence they have. But just in reading this, this looks like a tremendously strong case because they did that police work,» said Ritter, the former prosecutor. «On their own, these things might be suspicious. But when you start putting them all together, they start to build into probable cause and what you’d need to secure an arrest warrant.»
Despite the assortment of evidence, there are still holes and questions in the case. Authorities have yet to publicly establish any motive or say whether Kohberger even knew the victims. Police also have not disclosed why the students’ fellow roommates did not call authorities and why they weren’t alerted until nearly 8 hours after the killings.
Eytan, the Colorado defense attorney, cautioned against a rush to judgment in the case. She said police usually put their best evidence into an arrest affidavit, and the court documents released by authorities have a lot of holes. She said there are many reasons why someone’s DNA could be present on an item in a stranger’s house — and there’s no evidence to say whether Kohberger had been to the house before.
“What’s seen in an affidavit is usually the best evidence and what’s noticeable here is what’s missing,” Eytan said. “There’s a lot of conclusions reached that aren’t backed up.”
Eytan recently represented a man accused of killing his wife, and said in that case, investigators’ reliance on cellphone data later proved inaccurate. Prosecutors have dropped charges against the man, largely because his wife’s body remains missing.
“It’s important to keep an open mind and it doesn’t appear law enforcement has done that,» she said. «They honed in on this white car and worked back from there.»