SBSW 14 1590 10/21/2014

Search Warrant for McStay HSBC Bank Account Data

SBSW-14-1590-Probable Cause Affadavit 10:21:2014

SBSW 1590 6 Blanck Checks
Charles Ray Merritt’s claims that he was given 6 blank checks and permission to use Joseph McStay’s credit cards.
SBSW 1590 Checks Written
Check numbers for those checks written by Merritt.
SW 1590 M owes taxes
Merrtt’s tax debt mentioned.
sw 1590 overview of warrants SDSD and SBC
Overview of warrants from both SDSD and SBC.

42 thoughts on “SBSW 14 1590 10/21/2014

  1. I need to be a little more clear on the QB stuff, because it’s complicated and I am learning as I go.

    To reiterate:

    What made me curious about this aspect of the state’s case is the wording used by investigators and the DA in relation to the check writing on Joey’s account– (believed to be done by Merritt). LE has never stated affirmatively, or even in speculation, what computer or internet source Merritt used to write these checks.

    They have simply stated that the computer used to write the checks was NOT in the McStay residence.

    If they’d been able to get ISP and IP addresses from those transactions, I would think, they could identify at the very least the exact server used. And perhaps who the account belonged to as well.

    When I looked up the privacy agreements for QB from around that time I saw that they promise their clients two things. They promise that the storage of IP addresses will not be linked to a specific client and they also had a “purge” schedule. As in, they only keep this type of data for a certain amount of time.

    In most cases it was no more than 3 years.

    It does seem possible that because a warrant wasn’t issued sooner for Joey’s QB data, that the IP and ISP addresses related to a given transaction were purged prior to the 2014 warrant, simply as a matter of protocol.

    And that the manner in which detectives concluded that someone other than Joey performed certain QB actions, was based solely on data gotten from Joey’s hard drive and the QB activity log. The activity log would not have been purged.

    1. My head is spinning just writing this. Put in lay terms, investigators may not have conclusive evidence as to where these checks were written.

      And if they don’t, then this puts an interesting spin on the 7:59pm check, because I’m not certain that it can be proven absolutely that it was written in the McStay home.

      1. That effing check. I’m over that check. So why does this matter? Like you said, if Chase cashes the checks then who else could have written them?

          1. Merritt either wrote these checks from someone else’s home and computer, or someone else wrote them and gave the checks to him.

                1. When you look at the ping testimony in the prelim, the check writing always happens at times when Chase was pinging in Rancho. It’s not like he was somewhere else when the checks are being written.

                  1. Here’s is what investigators could document from the QB data (from prelim):

                    A So, when I looked for checks and the check transaction,
                    there was no checks shown. There was no checks written on this account. But when I look through the activity log, the activity log shows the user log-ins, the time of log-ins, checks created, deleted, edited. And it has a whole activity log.

                    1. So they look at the activity log and they can only tell when a user logged in. On Feb 4, Joey had logged in earlier in the day—what we don’t know is if a second log in, from another computer, using the exact same password, would register as a new log in.

                    2. (From Prelim)

                      On February 4th, did Joseph log-in to QuickBooks in the
                      afternoon?
                      A There showed a log-in, but no activity as far as checks
                      or any other additional activity. But there was a log-in around noon on February 4th.
                      Q Does it show you the time that log-in occurred?
                      AYes.
                      Q A log-out event, is that recorded as well?
                      A I don’t recall exactly what time there was a log-out. I
                      don’t believe there was a log-out. I believe there was just a log-in.

                    3. Would it though? I mean if Quickbooks isn’t monitoring IP addresses, they are only noting login account names and passwords, maybe a second login wouldn’t even register.

                      There was a query posted from around 2013, from a QB client who was concerned that employees were logging into the system from outside work and he wanted to limit which IP addresses they could log in from, and was having a problem with this.

                      I’m not sure that in 2010 QB cared what IP address you logged in from, if you were using Intuit.

                      Now if you were using the downloaded software, the IP mattered, but Intuit was virtual. I’m not sure IP addresses came into the use, unless you specifically designed your system to monitor these.

                    4. I think you are gettting worked up over nothing. But let’s just ay you are right, that a second login on the 4th wouldn’t be noted in the activity log–why wouldn’t Chase fess up to this.

                      It gives him an alibi?

                    5. If the live-in girlfriend is telling the truth and she knew nothing about Merritt writing checks form Joey’s account, then Merritt must have been doing this check writing some place else.

                      Maybe there is a computer/printer setup at his workshop, but then he would have told LE this. (I’d think). But maybe there is some place else he went to write these checks. All the check writing happens at around lunch time. Except for the 4th. Why?

                    6. Lurk,there’s a warrant coming up where it’s clear that LE believes the girlfriend. They don’t seem to think she knew anything. And her 5 calls to Merritt on the night of the murders seems to indicate this as well.

                      If you know your boyfriend is in the middle of a quadruple murder you don’t call him 5 times.

                      Again–not saying Merritt did this. But those 5 calls in a period of less than 4 hours, do kind of tell a story.

                    7. Yeah. They tell the story of Chase Merritt killing his best friend. I just looked at the prelim again.

                      What the activity log shows is that before Feb 1 there was never a check written on that custom account.

                      Don’t you find the timing of all this to be incriminating?

                    8. I do think the timing is suspicious, but life is stranger than fiction. Like with Kevin Green, could just be ah horrific coincidence. The McStays were in a very interesting place in their lives. It’s possible, like Mad pointed out, that Joey did give Merritt permission to do this because he wanted to spend more time with Summer, and not have Merritt present.

                      The tension between those two must have been extreme at that point. I don’t know why he would tell Merritt to hide these transactions, though.

                      Unless, DK did have access as well, and Joey didn’t want DK to know how much Merritt was being paid.

                      It’s possible.

                    9. OK. Letting it go. I like absolutes. But I’ll wait until trial to find out the rest. Done all I can for the moment.

  2. I’ve been reading Intuit privacy agreements from 2011 and 2012, I have this feeling that IP addresses attached to accounts, especially those gone defunct, were purged prior to 2014.

    As in, I would be willing to bet that SBC investigators were not able to tell from Quickbooks which computer IP Merritt used to write those checks–or which ISP address either.

    And if the prelim is any indicator, the ATT AirCard data didn’t reveal this either.

    Huh.

    1. If I’m right, there is a process of deduction that they used. They could tell what sites Joey went to from his respective computers. And there are the activity logs that still exist at Intuit.

      When Joey’s computer was logged on and there was activity, it goes to reason that the activity was initiated from that computer.

      If neither Joey’s computers is logged into QB, then logic dictates that a log-in at that time happened from a computer NOT in the home.

      But this might get tricky in court where the bar of proof could be very very high.

      Clearly, if the checks generated were written after Joey’s disappearance, and are cashed by Merritt-who else would have written them.

      The question keeping me up at nights, is why didn’t Merritt admit to where he was when he wrote these checks? (he admits to writing them) And if he did tell LE this, why don’t they seem to believe him?

            1. They stick with their story. Joey told Chase to write checks-maybe because Joey wasn’t feeling well. Maybe the tension between Summer and Chase was getting to be too much and Joey wanted to work on his relationship with her.

              So he sets Chase up to write checks and doesn’t think he needs to add Chase formally as a user.

              Maybe Chase does take advantage, but not because he killed Joey.

                  1. Chase was expecting the money and is freaked out not only because his best firend vanished but because he has to get paid for his work. Maybe he already made the fountains and spent that money owed.

                    1. Chase knows it will look bad. And because of his history it’s a kneejerk reaction. He’s in the habit of hiding certain behavior.

    2. Grav,

      Do you mean that IP addresses from 2010 would have been purged by 2014? what you wrote sounds a little general.

    1. And it’s interesting as well, that this is the first warrant where it’s stated that the reason for the face to face meeting on the 4th was because Joey had checks to give to Merritt.

      And we know now that this could not have been true. All the checks Merritt supposedly got that day, had been written on the 5th and the 8th and backdated to the 4th.

      This is a tough hurdle for the defense, because unlike some of the blood evidence (or lack there of) this is substantiated.

      Unless there is a glitch in the computer analysis of QB, Merritt got caught in a whopper of a lie.

  3. This warrant is interesting because Merritt not only claims he was given checks to write to himself, but that he was also given permission to use Joey’s credit cards.

    Hmmmmmm. Not sure I’m buying this.

Comments are closed.