Claim 8 of 15

“On February 8 he tried to cancel and delete QuickBooks to get rid of the checks.”

What the State said

Mr. Imes told the jury what he claimed the February 8 QuickBooks activity meant: I canceled the account online, found the data was still there, and called QuickBooks to get rid of it and “put it on a desktop, where no one can find it”: (RT 8220:19-8221:10)

But what’s also important there? At 2:44, there’s a phone call to QuickBooks or Intuit — I’m sorry. Strike that.
There’s an online activity to Intuit QuickBooks to cancel QuickBooks. And then all of a sudden, someone goes back in and logs in and goes, oh, wait, I can create more checks. Wait, there’s more info there, it didn’t go away when I canceled it. So then at 3:11, there’s a call to QuickBooks Intuit. I want to cancel. I want to cancel QuickBooks, a program that I used — if you are Joseph McStay — for years to track his business. How does that make sense other than it’s the defendant doing it, considering those calls to QuickBooks came from the defendant’s phone?
The only reasonable interpretation of that is he tried to cancel it online, realized, oh, crud, it didn’t work, it doesn’t delete the information, the account is still there — because as you were told, it stays in the cloud. So he called QuickBooks, hey, I need to cancel this. I need — I need to get rid of it. I need to put it on a desktop, where no one can find it.

See the trial transcript (RT 8220-8221, Mr. Imes)

In rebuttal, Ms. Rodriguez told the jury the defense could have called the February 8 representative, that I “impersonated” Joseph on the 9th, and that I wanted the custom account deleted because I had forged checks in it: (RT 8428:6-8429:14)

Read the full passage

And the story keeps changing from the defense. They talked to you about calling the witness from the 8th, Sean Augustine. Well, guess what? The defense had every opportunity to call Sean Augustine. They didn’t call him.
They called Annette Dron who absolutely had nothing to do with this case. She was a supervisor she didn’t make notes on the 8th, she didn’t make notes on the 9th. The other thing that they don’t explain to you is that why in the world, on the 9th, when the defendant calls QuickBooks and pretends to be Joseph McStay — and we know that because Ryan baker told you we captured the phone number, and it’s the defendant’s phone number. We know he identifies himself as Joseph McStay because you have master administrator to do anything on that account.
So he impersonates Joseph McStay and calls QuickBooks and says, I want to delete the information. That’s is so important in this case, ladies and gentlemen, and I’ll tell you why. Because when you go back and you look at the records — and I think I have a slide that shows this a little bit later — and you go back and you listen to the testimony of Mike West, Mike west tells us on the 8th, on the custom side, somebody canceled the subscription and tried to delete it. And what did Mike West tell us?
That does not delete the information. So when he signs back in 10 minutes later, it’s reinstated. And we’ll talk about the testimony and you will be able to look at that and see it. Why in the world is anybody going to delete their company with pending jobs in it? How are you going to get that information. There’s no evidence that he tried to delete the EIP side, just the custom side, two separate accounts. The custom side is the one that’s associated with the defendant, and he needed that side deleted because he took checks and forged them and then deleted them from the account and realized, wait, I can’t delete these checks.
These are still up here in the cloud. Crap. I’m going to have order a new version, or I’m going to have to call them and say I need it deleted. That’s why he impersonated Joseph McStay and tried to delete the QuickBooks accounts.

See the trial transcript (RT 8428-8429, Ms. Rodriguez)

She went back to Mike West’s testimony about the 2:44 cancellation: (RT 8429:27-8430:15)

This was the testimony that we heard from Mike West: If the user actually cancels and they say — let’s say, I’m at home, and I go on to my computer, and I want to cancel my account, is that information when — without me calling in, is that going to be deleted? And the Court says. Well, what information are you asking about?
And then I clarified, it’s the data that I put in. If I cancel my subscription online, it tells you, you can’t add new data to it, but it’s not going to delete it. It’s still there. So when we see the activity on the 8th, from the customer side of the account that starts at 2:44, look at that exhibit on the custom side, the account is canceled and 10 minutes later it’s reinstated, because he realizes he can’t get rid of the data that way. And the defense just completely forgets about that, just ignores that, because, you know what, we pick and choose the facts that we like, and we ignore the ones that we don’t like.

See the trial transcript (RT 8429-8430, Ms. Rodriguez)

What the State already knew

My February 17, 2010 notes, read aloud by DuGal: “Quickbooks on-line. Decide to delete and start Quickbooks Pro 2010. Credit card for purchasing Quickbooks.” DuGal’s report says I made “these transactions two or three days after February 4, 2010” (What I told them, and when).

The record

This is the day the State leaned on hardest. Here it is in order, from the activity log of the custom QuickBooks account, Intuit’s records and my phone record:

• 2:15 p.m.: someone signed in to the custom account. The log lists every sign-in under “Joseph McStay,” whoever it was; Det. Hanke agreed at trial that it doesn’t show who was at the computer (Claim 14).
• 2:20 p.m.: I wrote the last check, $6,500 to me, “saudi arabia final,” dated February 4, and printed it. It was deleted at 2:25. I deposited it the next day at Bank of America.
• 2:44 p.m.: the subscription was canceled, online, from inside the account. No call to QuickBooks had been made yet.
• 2:52 and 2:53 p.m.: signed in again. 2:54: “Subscribed,” ten minutes after the cancellation. 3:04: signed out.
• 3:05 to 3:10 p.m.: short calls from my phone to directory assistance and to toll-free numbers (items 9151-9158). There were no calls from my phone between 1:55 and 3:05.
• 3:11 p.m.: I called QuickBooks at 1-800-446-8848. The call lasted 107 minutes 25 seconds and ended at about 4:58 (item 9159). From 3:29 to 3:51, during the call, the custom account was signed into again.
• That day, QuickBooks Pro 2010 was ordered, as a download with a backup disc, order SBL37682110: $182.62 on Joseph’s MasterCard ending 6175, billed and shipped to Joseph McStay, with Joseph’s Hotmail address on the order (INT 000004). Intuit later told Det. DuGal the order was taken by phone, and that the program was downloaded once, that afternoon (Claim 9).
• 5:01 p.m.: I called Joseph and left him a message, 52 seconds (item 9163).
• 5:05 p.m., seven minutes after the call ended: a support case was opened in Joseph’s name, case 1846639, owner Shawn Augenstein. The case record says it was created “By: Customer.” Its question: “i want to transfer data from qb online to qbs pro 2010, need help” (INT 000035).
• 6:15 to 6:16 p.m.: Augenstein e-mailed Joseph, at JOSEPHMCSTAY69@HOTMAIL.COM, the instructions for exporting his QuickBooks Online data. They include this line: “Also, export does not cancel your subscription.” (INT 000036)

See the QuickBooks activity log, custom account (page 2 of 5)

See Exhibit 794 (AT&T page 374, February 8)

See the QuickBooks Pro order (INT_MCSTAY000004)

See case 1846639 and the export e-mail to Joseph (INT_MCSTAY000035-36)

Mike West, Intuit’s investigator, was asked by Ms. Rodriguez whether canceling online deletes anything: (RT 3994:11-3995:7, February 13, 2019)

See the trial transcript (RT 3994-3995, Mike West)

On recross, West agreed the data can be moved from online to desktop. Asked whether a desktop version was ordered, he didn’t know. It was, that same day, on Joseph’s card (INT 000004): (RT 3995:14-3996:22)

See the trial transcript (RT 3995-3996, Mike West)

What Intuit told San Diego in 2011

In May 2011 DuGal called Intuit. Intuit told him the Pro order was a phone order: (recorded call, May 11, 2011, p. 12:3-23)

DETECTIVE DUGAL: Did this order come via e-mail, or did it come via telephone call?
MR. JUDE: Let me check for the information. Okay?
DETECTIVE DUGAL: Yeah. I’m betting it’s a telephone call. And if it’s a telephone call, what I’d be interested in is the phone number for that telephone, because I don’t show — I have his phone records.
MR. JUDE: Uh-huh.
DETECTIVE DUGAL: And I don’t have a phone call coming from any of his telephones to you guys.
MR. JUDE: Uh-huh. I do understand.
As I’m checking, I am not sure if I can pull up the phone number that has been used to purchase this one. But definitely this is a phone call transaction.
Because we only have here three options on how to purchase the software. This, for the first one, is through a phone call. And if it has been made through a phone call, the order number starts with “SBL.”

See the recorded call (p. 12)

Earlier in that call, looking only at the two support cases, Dron had said they had nothing to do with the desktop order: (p. 41:22-25)

DETECTIVE DUGAL: Is that who ordered it?
MS. DRON: Well, see, this is — this has nothing to do with that Desktop order. This is just somebody calling in about their QuickBook Online company —

See the recorded call (p. 41)

Later, when DuGal put the call, the e-mails and the Pro order together for her, Intuit’s supervisor said, “maybe he was just trying to get the data”: (p. 49:14-21)

DETECTIVE DUGAL: But going back that — that phone call from Chase or — his name is Charles, but he goes by Chase.
MS. DRON: Yes.
DETECTIVE DUGAL: That was on the same day that all these e-mails and purchasing of Pro happened?
MS. DRON: Yes. So maybe he was just trying to get the data, you know.

See the recorded call (p. 49)

At the end of the call, DuGal called it “the biggest lead I’ve had in a long time,” then said it “may have absolutely been normal business,” and that normal business was “just as likely, if not more likely than anything else”: (pp. 57:5-58:1)

MS. DRON: Yeah. And it may have just been normal business possibly.
DETECTIVE DUGAL: It may have absolutely been normal business. And it may — based on the fact that that business partner called you guys, it absolutely could have just been him verifying — you know, whatever.
If Joseph told Chase, hey, give these guys a call, make sure this is coming through, whatever. I don’t have any idea —
MS. DRON: Yeah.
DETECTIVE DUGAL: — of how that works, but — but it may be that simple.
MS. DRON: Yeah.
DETECTIVE DUGAL: And right there is your reason it’s difficult to get a court order, by the way. Because that’s just as likely, if not more likely than anything else.

See the recorded call (pp. 57-58)

DuGal told me in June 2011 that he had seen QuickBooks ordered “under Joseph’s money, Joseph’s name” from my phone, that he called me to “resolve that,” and “we did”: (recorded call, June 21, 2011, p. 36:6-11)

DUGAL: Just like Quick Books all of a sudden you know I’m like awe yeah there’s you know here’s somebody ordering Quick Books under Joseph’s money, Joseph’s name, it’s Chase’s phone I’m sure it’s Chase I gotta call Chase I gotta resolve that
MERRITT: Yeah
DUGAL: And we did but those issues come up and

See the recorded call (June 21, 2011, p. 36)

In a recorded call on May 12, 2011, Annette Dron, a QuickBooks supervisor, described the February 8 activity to DuGal this way: (Dron call, May 12, 2011, p. 5:1-12, as I copied it)

DRON: “And it just looks to me like they were going to move the QuickBooks online to desktop, which people do constantly, or go back and forth, you know?”
“So, that’s what it kind of looks like, because — because he’s saying that — you know, right at the time they ordered the desktop version, then we get this ‘Can someone move my data from online to pro?’
So — and that’s not really — I mean, people do that all the time. And — but then, for whatever reason, they never cancelled the QuickBooks online company.”

See my copy (Folder F, tab 9HH)

Listen (recording of the May 12, 2011 call, about 1:35 to 3:03):

The transcript of this call isn’t available to me, but the recording is. The words above are as I copied them from the transcript in 2017; the clips are from the recording.

By “the QuickBooks online company,” she means the account itself, which was never closed. The subscription was canceled and reactivated on February 8 and canceled again on February 9, as the activity log shows.

What Dron told the jury

Mr. Maline called Annette Dron as a defense witness on April 16, 2019. She told the jury the same thing she had told DuGal.

On the February 8 request: (RT 6252:11-17)

Q (BY MR. MALINE:) And did you — what — what else did you tell Detective Dugal about the QuickBooks online account regarding the first transaction on February 8th?
A I told him that someone had requested that — export data and that that wasn’t unusual. It’s one of our most frequent questions, was to export data from QuickBooks online to QuickBooks Pro.

See the trial transcript (RT 6252)

Asked whether moving to Pro, then canceling, then deleting was unusual (her “Yes” answered a question put as “uncommon”; Mr. Maline’s next question takes it as “not uncommon,” and her reasons follow): (RT 6253:27-6255:1)

See the trial transcript (RT 6253, 6254, 6255)

On what she reported back to him: (RT 6255:14-21)

Q (BY MR. MALINE:) Did you report back to Detective Dugal, your review of the materials?
A Yes.
Q And what did you tell Detective Dugal about this transaction?
A I — I couldn’t find anything that looked out of the ordinary from the — the cases that I could see. It was all normal — normal behavior.

See the trial transcript (RT 6255)

On cross-examination, Ms. Rodriguez asked about deleting a company before its data was moved: (RT 6269:25-6270:6)

Q And so if that data had not yet been transferred, would it be a little bit more unusual to have somebody requesting to delete an entire company without transferring the data?
A People didn’t always transfer the data and then delete, but it would be more unusual.
Q Well, if somebody wasn’t looking to go out of business and was looking to keep their company, it would be a little bit unusual to delete jobs that you were in the middle of; right?
A Correct. Unless you had another one — some people had two and then they asked for one to be deleted.

See the trial transcript (RT 6269, 6270)

She also said it wasn’t unusual to ask to delete a company, and conceded the limit of what she had looked at: (RT 6269:5-12)

Q So when you told Detective Dugal that you didn’t necessarily notice anything unusual, that was based only on the phone calls; is that correct — the screens that you reviewed with Counsel?
A Anything unusual, yes. It wasn’t anything unusual for someone to call and ask to export data or cancel a company or delete a company, is what I was —
Q Okay. There was a call —
A — referencing.

See the trial transcript (RT 6269)

What the detective told the court about February 8

At the preliminary hearing, Hanke testified the 2:44 cancellation was done on a phone call, and the February 9 cancellation at 8:06: (prelim RT 116:1-21)

Q What was that?
A At 2:44 P.M., it stated the user canceled QuickBooks online subscription.
Q Do you know if that was done via phone call or online?
A It was through a call-intake center. It was done on a phone call.
Q And did you review the defendant’s cell phone records from that date, February 8th, 2010?
A Yes, I did.
Q At around that time, was there a phone call to QuickBooks online?
A Yes, there was.
Q And how long does that, how long did that call last?
A The phone call lasted 107 minutes.
Q The next day, February 9th, was there any other activity on the QuickBooks account?
A Yes.
Q And what happened on February 9th, based on your review of the records?
A At 8:06, 08:06 A.M., it stated: “The user again cancelled QuickBooks online subscription.”

See the preliminary hearing transcript (p. 116)

None of that is what the records say. The activity log shows the 2:44 cancellation made by someone signed in to the account, and Intuit’s Mike West testified a user can cancel online without calling (RT 3993:10-13). My phone record shows no calls at all between 1:55 and 3:05, and the call to QuickBooks began at 3:11. The February 9 cancellation was at 8:16, after Baker’s contact ended at 8:13 (the timeline).

Eight days before my October 22, 2014 interview, Hanke’s own report on the QuickBooks records did the same thing. It pasted in the activity log rows and my phone record, and said the 107-minute call was “at similar times” to the 2:44 cancellation. It also says the February 9 cancellation was at 8:06; the row pasted under it says 8:16: (Bates 000589, report dated October 14, 2014)

• 2:44 pm- User Joseph McStay cancelled QuickBooks Online Subscription.
*Note- QuickBooks customer service had record on February 8, 2010 of “Joseph McStay,” with the phone number of (909)374-0102, which is Charles Merritt’s cell phone number, calling to upgrade QuickBooks, transfer account information, and delete the account. Merritt’s cell phone records show a 107 minute call to QuickBooks customer service at similar times.
February 9, 2010:
• 8:06 am- User Joseph McStay again cancelled QuickBooks Online Subscription.

See Det. Hanke’s report (Bates 000589)

That note puts the February 9 request on the February 8 call. Intuit’s record of February 8 asks only to move the data to Pro (INT 000035). The request to delete is in Baker’s notes of February 9 (INT 000033).

What Det. Bachman swore

San Bernardino Det. Bachman put the February 8 and 9 calls in his sworn warrant affidavits. In 2017 I copied these passages by hand for my lawyers from his phone-tap affidavit (Folder F, tabs 9K-9M). Substantially the same passages, with some added wording, are in his search warrant for Joseph’s Hotmail account, SBSW15-1211, sworn June 19, 2015. This is that warrant.

First, what he said I admitted: (SBSW15-1211, SW&A page 7, Bates 028871)

“Investigators determined 76 checks, #4161-4235, were still missing and believed to have last been taken by Merritt when he forged the other checks that were deposited. In addition, Merritt’s cellular phone records showed he spoke with the Intuit Corporation, who manufactures the QuickBooks financial program, for over 100 minutes on February 8th 2010, prior to anyone knowing the McStay family was missing. Merritt later admitted he tried to change the QuickBooks account and stated Joseph McStay instructed him to make the changes, though Merritt did not attempt to conduct the changes until days after their meeting and Merritt claimed he had already lost contact with Joseph McStay.”

See the warrant (Bates 028871)

Then what he said Intuit’s notes showed: (SBSW15-1211, SW&A pages 7-8, Bates 028871-028872)

See the warrant (Bates 028871-028872)

And then his conclusion: (SBSW15-1211, SW&A page 8, Bates 028872)

See the warrant (Bates 028872)

See the warrant’s affidavit page, signed by Det. Bachman (SBSW15-1211, Bates 028866)

See my 2017 handwritten copy of the phone-tap affidavit (Folder F, tabs 9K-9M)

See Intuit’s phone record for case 1846639 (INT_MCSTAY000034)

See the contact records for the custom account (INT_MCSTAY000024-000027)

Fact check

• Mr. Imes: “At 2:44, there’s a phone call to QuickBooks.” He corrected himself in front of the jury. Hanke told the preliminary hearing the same thing under oath and didn’t (prelim RT 116). My phone shows no calls at all from 1:55 to 3:05.
• Mr. Imes: “I need to put it on a desktop, where no one can find it.” That is what I asked for: a desktop copy that keeps every record.
• Ms. Rodriguez: West “tells us on the 8th … somebody canceled the subscription and tried to delete it.” West never said anyone tried to delete anything. He said canceling deletes nothing (RT 3994-3995).
• Hanke’s report: the 107-minute call was “at similar times” to the 2:44 cancellation (Bates 000589). It began 27 minutes later.
• Ms. Rodriguez: Dron “absolutely had nothing to do with this case.” Dron was the QuickBooks supervisor DuGal himself interviewed in May 2011. At his request she looked over the February 8 and 9 calls (“I don’t remember, specifically, but I did look at calls”) and reported back to him (RT 6243:3-6244:13).

Claim 9 of 15

See the trial transcript (RT 6243, 6244)

“The February 9 call proves a guilty mind. Baker said only fraudsters ask to delete their records without a copy.”

What the State said

About the February 9 call, Mr. Imes told the jury no one with an innocent reason would delete a business’s records and order a new QuickBooks, and that Joseph would have changed the shipping address: (RT 8222:25-8223:11)

And that takes us to February 9th. February 9th, at 7:34 a.m., is the first phone activity for the defendant since 6:31 the night before. And it’s immediately at 8:06 a.m. that there’s a call to QuickBooks, logging his telephone number, asking to delete the account. And remember, Ryan Baker’s testimony, it needs to be deleted. Why would Joseph McStay or someone with innocent intent need to delete the business records for a business that’s been around for years? There is no reasonable evidence, based on reason, for a defendant needing to delete QuickBooks and order a new one? No reason based on the evidence, at all.
Joseph could have gone to the store and bought the desktop version. You would have to believe, by the way, that Joseph was not attentive enough to change his shipping address when he ordered it from San Clemente to Fallbrook.

See the trial transcript (RT 8222-8223, Mr. Imes)

The case summary put Baker’s notes on a phone call at 2:44 p.m. on February 8: (Bates 000024)

“On February 8, 2010, at 1444 hours, Intuit QuickBooks received a phone call from (909) 374-0102 (Merritt’s cell phone) and the caller identified himself as Joseph McStay. The caller wanted to upgrade QuickBooks, transfer the account information and delete the account. The QuickBooks representative, Ryan Baker, noted the caller said he was going to cancel the account, but when he cancelled, he “NEEDS” this (the account records) to be deleted. The caller was advised an email was sent to master administrator on how to permanently delete the account records.”

See the State’s case summary (Bates 000024)

And it gave Baker an opinion about fraud: (Bates 000025)

“Baker specifically remembered the telephone call and felt something was not normal with the call. Baker claimed this was the reason he entered the customer service notes in the fashion he did. Baker felt only someone acting inappropriately or fraudulently would ask for the records to be deleted and not ask for some sort of copy of the records. In all the calls Baker handled, he dealt with very few who asked for and was as adamant as the caller was to have the records deleted.”

See the State’s case summary (Bates 000025)

What the State already knew

Hanke knew about the February 8 call and the Pro order before he interviewed Baker; he had put them in his search warrant two months earlier. In the interview itself he described that call as “to purchase the account and transfer” (Baker interview, p. 37).

The record

• 7:34 a.m.: I called QuickBooks at 1-800-286-6800. The call lasted 42 minutes 56 seconds, ending at about 8:17 (item 9167).
• 8:06 to 8:13 a.m.: Ryan Baker’s contact, case 1847012, on the custom account (custom@earthinspiredproducts.com). His notes: “Contacted: User advised that he is going to cancel,… but when he cancels he NEEDS this to be deleted… explained as long as he is the MMA will send the email he can respond to…” (INT 000033). MMA means the master administrator.
• 8:14 and 8:15 a.m.: signed in. 8:16: the subscription was canceled.
• Baker e-mailed custom@earthinspiredproducts.com asking for the master administrator’s written request to delete the account, then followed up twice: once that afternoon and a final time a few days later. No one answered any of them, and nothing was deleted (Baker, RT 3741-3742, 3759:24-3760:14; Bates 007469-007470).
• I called Joseph at 8:56 a.m. (2 minutes 3 seconds), 9:17 (55 seconds), 12:22 p.m. (1 minute 4 seconds) and 1:07 p.m. (37 seconds). That 1:07 call was my last call to Joseph (items 9171-9179).

See Baker’s notes, case 1847012 (INT_MCSTAY000033)

See the QuickBooks activity log, custom account (page 2 of 5)

See Exhibit 794 (AT&T page 375, February 9)

What Baker wasn’t told

Det. Hanke wrote the search warrant to Intuit two months before he interviewed Baker. It asked for the recorded calls about the QuickBooks Pro order, “especially” the 107-minute call on February 8: (search warrant sworn August 21, 2014, Attachment A, item 4)

“4. Any and all recorded customer service calls regarding Order #SBL37682110, phone number (909) 374-0102, especially on February 8, 2010, at 1511 hours for a duration of 107 minutes and 25 seconds.”

See the search warrant (Attachment A)

At trial he confirmed he knew of both calls when he spoke to Baker: (RT 4054:5-15, February 14, 2019)

Q Now, you had information, when you spoke to him that there were two calls that were made to QuickBooks, do you recall that?
A Yes.
Q And what were the dates of those two calls?
A The first call was February 8th, 2010.
Q And do you remember the approximate time of that call?
A I don’t recall the time, no.
Q Okay. And when was the next call made?
A The next call was made the next day, February 9th, 2010.
Q And do you recall the time of that call?
A I’m sorry, I don’t recall the time.

See the trial transcript (RT 4054, Det. Hanke)

Hanke asked Baker how often he got calls like this. Baker said four or five in five years, and described them. He did not use the word fraud, here or anywhere in the interview. At trial he called the call “very unusual” and said “it’s very, very, very highly unlikely that you would get a phone call where someone is just very demanding to have it removed from the system, itself. People want to protect it, not get rid of it.” Of the three or four such calls he had seen, “most of the time, it would have to do with, you know, another business owner or someone being — not having access anymore, someone who had been fired from the business” (RT 3738:25-3739:17). His words in the interview: (Baker interview, p. 24:2-17)

DETECTIVE HANKE: Okay. And during that five-year period, how many phone calls were similar to that? Because I can imagine you get a lot of the same kind of questions, the same, how do I download this? How do I — you know, that type of thing.
I mean, in your experience, I mean, how often did you deal with this?
MR. BAKER: Four or five, not very many. And when we did have those type of phone calls, as you can probably think, most of them are, you know, business partners that have gone awry; somebody wanting to, you know, take that data for some reason; or someone trying to avoid having IRS, you know, get the company information.
DETECTIVE HANKE: Okay.
MR. BAKER: Not very common for us.

See the Baker interview (p. 24)

Then Hanke asked whether the caller talked about a transfer. Baker said what made the call stick out was that the caller didn’t ask for a copy, and that a request for a copy would have been in his notes. The copy is what had been asked for the day before. Hanke didn’t tell him that: (pp. 24:18-25:17)

See the Baker interview (pp. 24-25)

A few pages later Hanke asked about other purchases. Baker said there were none. Hanke, who had put the Pro order in his search warrant, said “Okay” and moved on: (p. 30:7-24)

DETECTIVE HANKE: Okay. Were you aware of any other purchases for QuickBooks at all prior to this?
MR. BAKER: There was none.
DETECTIVE HANKE: Okay.
MR. BAKER: There was none.
DETECTIVE HANKE: Okay. And then, let’s see. Okay. So going back to when the person calls in, you put the information in as Joseph McStay at Earth’s Inspired Products.
If — so if I call in and say, my name is Daniel Hanke. What do you do to verify? What — what do you ask? Do you ask last four of Social? Do you ask phone numbers or identifying addresses, or anything like that? Do you guys ask any of those verification questions?
MR. BAKER: We ask for name, e-mail address, and phone number of — phone number of the business and the e-mail that the business is associated to.

See the Baker interview (p. 30)

Only near the end, after Baker had given his opinion, did Hanke mention the 8th, and he said it to the Intuit paralegal, Dennis Boulankine. He said the call “wasn’t regarding deleting the account” and was about buying Pro and transferring the account. He did not say it asked for the export instructions, the copy Baker said would have been in his notes: (pp. 37:3-18)

DETECTIVE HANKE: Well, and — and I believe —
And, Dennis, I was going to ask you also. There’s — on the 8th — the same phone number calls on the 8th and requests — and that — there was an actual purchase.
And I was going to talk to you after or — to see if we can get that information of the person — the customer service person taking — taking the phone call on the 8th. It wasn’t Ryan. It was — but it wasn’t regarding deleting the account, either.
It was — it was to purchase the account and transfer. It was regarding purchasing a QuickBooks 10 or the upgrade Pro and then transferring the account.
But I think that might have to be a separate conference call and a separate setup, and we can probably do that later.

See the Baker interview (p. 37)

Baker was still on the line. He answered the next question himself: (p. 38:1-7)

MR. BOULANKINE: Shawn Odgenstine (phonetic)?
DETECTIVE HANKE: Yeah, Shawn Odgenstine. That —
MR. BAKER: Shawn Odgenstine.
DETECTIVE HANKE: Yeah.
MR. BAKER: Shawn Odgenstine worked in our Inglewood office in Denver. He is no longer with the company. He hasn’t been with the company since 2010.

See the Baker interview (p. 38)

What Hanke wrote, and told the court

Hanke’s report of the interview leaves out the February 8 call and the Pro order entirely. It turns Baker’s “business partners that have gone awry” into fraud: (Bates 007468)

“Baker handles a large volume of calls, usually between 20-30 callers per day. Even with the large amount of calls, Baker remembered this call, because of the unusual request. The call was unusual to Baker, because he had only received the request to delete all files only approximately five (5) times, in five (5) years. Each of those times involved some type of fraudulent activity; such as to avoid the IRS or a dispute between business partners. Most business owners wanted a copy of the account information, prior to cancelling. This caller did not request a copy of the account information. Baker wrote “NEEDS” in all capital letters, because the caller was adamant about deleting the business files. The caller told Baker two (2) to three (3) times the account needed to be deleted. “MMA” stands for master administrator of the account, which in this case was Joseph McStay.”

See Det. Hanke’s report (Bates 007468)

Bachman’s case summary went further, and put Baker’s February 9 notes on a phone call at 2:44 p.m. on February 8 (above). Even so, it describes the caller’s request in the order I made it: he “wanted to upgrade QuickBooks, transfer the account information and delete the account” (Bates 000024). There was no call at 2:44. The 2:44 entry is the online cancellation, and my call to QuickBooks began at 3:11 (the timeline).

At the same preliminary hearing, Hanke told the court the February 9 caller wanted to transfer the account first and then delete it. That is my account of the two calls taken together. It is not what Baker said in the interview, where he said the caller did not ask for a copy (p. 25, above). Hanke knew of both calls and described them as one: (prelim RT 118:18-23)

Q And what else did he tell you about the phone call?
A He said that he wanted to — the caller was identifying himself, saying that he wanted to transfer the account to another account, and then once it was transferred and this subscription was canceled, that he needed to delete all of the accounts.

See the preliminary hearing transcript (p. 118)

January 31, 2019: the court is told the other call will come in

Before Baker testified, the defense told the court his opinion would be wrong once he knew about the day before. Mr. Daugherty, for the prosecution, told the court what Baker was being called for: (RT 3627:2-6)

Additionally, all of these arguments about him being called as business records, custodian, that’s not the case. He’s being called for his customer service call that he took on February 9th from Joseph McStay from a phone number associated with the defendant.

See the trial transcript (RT 3627)

Mr. McGee told the court why it mattered: (RT 3637:20-3638:17)

See the trial transcript (RT 3637-3638)

The court said Baker’s opinion could only explain why the call stood out to him, and that the defense could show what made it not suspicious had happened the day before: (RT 3638:18-3639:13)

See the trial transcript (RT 3638-3639)

Mr. Imes told the court the other call would come in through other witnesses: (RT 3639:23-3640:2)

MR. IMES: Actually, your Honor, it’s not an issue. Mr. Baker is offered for a very limited purpose, which was that contact, those notes. He has no personal knowledge of any of the transactions contained within EIP QuickBooks, transactions, themselves. He was not aware of the other customer service call. Evidence of that will come in through other competent witnesses. So Mr. Baker’s scope of knowledge and scope of relevant testimony is really limited to that interaction.

See the trial transcript (RT 3639-3640)

The State never called Shawn Augenstein. In rebuttal, Ms. Rodriguez told the jury the defense could have (Claim 8).

Baker at trial (February 6, 2019)

On direct, Ms. Rodriguez asked Baker whether there were separate instructions for a caller who wanted to keep a copy. Baker brought up the day before himself. She went straight to the e-mail address: (RT 3739:24-3740:13)

Q If the caller had asked you about wanting to make a copy of that information or retaining that information, are there separate instructions that you would provide to that caller?
A Yes, there is. The caller actually — there were notes to the account from the day before of them wanting to be able to use a different version of QuickBooks, and how to be able to get all of that data, and there was notes listed on that from the day prior to that.
Q Was that on the same account or a separate account?
A I believe it was the same account but with another customer service representative.
Q If they had provided the e-mail of JosephMcStay69@hotmail.com, can you tell us if that was the same account?
A It was not. It was not the master administrator e-mail. It was not the same account for that. So it would be listed as a separate, you know, customer — custom user to the account and it would not be a master administrator.

See the trial transcript (RT 3739-3740, Ryan Baker)

On cross-examination, Mr. Maline asked about the day before. Ms. Rodriguez objected that it was hearsay; the court let Baker answer from the business records: (RT 3753:18-3754:18)

See the trial transcript (RT 3753-3754, Ryan Baker)

Baker agreed that moving from online to desktop means exporting the data, that Intuit removed the online data after about 90 days anyway, and that on the 9th he didn’t know about the request the day before: (RT 3755:23-3756:27)

See the trial transcript (RT 3755-3756, Ryan Baker)

He agreed nothing was ever deleted: (RT 3759:24-3760:14)

Q And you indicated there was no reply to the instructions; correct?
A That’s correct.
Q So nothing got done; is that correct?
A That’s correct.
Q Nothing was deleted —
A Correct.
Q Correct. In fact, even the day before, the information on how to export data from online to the QuickBooks Pro, that was never followed through and that was never completed either; correct?
A I was not part of that case, that was handled by another agent, Sean Augustine.
Q At the end of the day, you sent off instructions on how to do something and those instructions were never replied to; correct?
A Correct.
Q And no one ever deleted anything; correct?
A Correct.

See the trial transcript (RT 3759-3760, Ryan Baker)

On redirect, Ms. Rodriguez asked whether, knowing about the 8th, he still found the call unusual: (RT 3769:6-10)

Q Okay. Knowing that a phone call came in for a transfer of data on the 8th, and then still receiving that phone call on the 9th, asking for a deletion of data, do you still find that call to be unusual on the 9th?
A Yes, ma’am, very.

See the trial transcript (RT 3769, Ryan Baker)

Mr. Maline came back to Hanke’s “any other purchases” question. Baker said that before the interview he was aware of the earlier call but knew no specifics, and did not know it was a request for help moving to Pro: (RT 3776:20-3777:16)

See the trial transcript (RT 3776-3777, Ryan Baker)

Mr. Maline asked why the State called Baker and not Augenstein. The objection was sustained: (RT 3778:3-6)

Q Do you know, Mr. Baker, why the District Attorney’s Office would call you as a witness and not Mr. Augustine, also?
MS. RODRIGUEZ: Objection. Improper. Argumentative.
THE COURT: Sustained.

See the trial transcript (RT 3778, Ryan Baker)

The court asked the last questions. If the same customer had called the day before with the same e-mail, Baker would have seen it. He didn’t: (RT 3780:14-23)

Q Okay. If that same customer had called the day before, using the same name, same phone number, same e-mail — Custom@Earthinspiredproducts.com, with a different request, would that have popped up on your screen on the February 9th call?
A The same screen would have popped up, but there also would have been the record of the call the day before associated to the same e-mail.
Q Okay. But that did not happen on the February 9th call; is that right?
A That is correct. That did not happen.

See the trial transcript (RT 3780, Ryan Baker)

Baker first told the jury, “I believe it was the same account but with another customer service representative.” Only when the State asked about the e-mail address did he say it was “not the same account.” That is the State’s answer to the February 8 call: a different e-mail address. It was the same caller and the same phone number, a day apart, about the same thing: getting Joseph’s data off QuickBooks Online and onto Pro. The first call asked for the copy; the second asked about deleting what was left. Baker only ever saw the second.

The e-mail nobody answered

This is how I put it to my lawyers in 2017: (my QuickBooks conclusions, pp. 10-11, Folder F)

See my notes (QuickBooks conclusions, pages 10-11)

When the court denied my motion for a new trial in January 2020, it said the same thing about the e-mail: (RT 8946:2-10)

THE COURT: “And then we know that Mr. Merritt contacted Intuit and indicated that he wanted the account and all of the data deleted.
And the individual thought that was rare — rarely happened. Defense presented someone, if they were switching from one form to another and maybe that would be reasonable. But at any rate, Mr. Baker sent e-mail instructions to Joseph’s e-mail of what need to be done to accomplish that and it was never done.”

See the trial transcript (RT 8946)

“It was never done.” If I had been covering my tracks, the last step was one reply away, from an e-mail account I could get into. I never took it.

Dron told the jury the same about Baker’s e-mail: (RT 6280:5-14)

Q … Do you know whether or not someone actually deleted it at QuickBooks, meaning somebody responded and then it got deleted by QuickBooks?
A So from the e-mails, you could tell that no one responded to Ryan Baker. I have no information if that happened later.
Q Okay. So as far as you know, the information that you have, nothing was ever — not only not deleted, but no one even responded to the instructions that Mr. Baker sent?
A As far as I know, yes.

See the trial transcript (RT 6280)

After February 9: who was in Joseph’s QuickBooks

My last call to Joseph was at 1:07 p.m. on February 9. After that, someone kept signing in to the custom account as “Joseph McStay”: on February 14 from 1:12 to 4:38 p.m., many times; February 15 at 10:21 p.m.; February 16 from 7:35 to 7:42 a.m.; and then May 19, 24 and 27, June 1, July 14 and 15, August 4, September 15, and September 30, 2010, when the account was resubscribed. None of them were me. (Activity log, pages 1-2)

See the QuickBooks activity log, custom account (page 1 of 5)

Dan had access, and DuGal knew it. He told Intuit in 2011: (recorded call, May 11, 2011, pp. 47:23-48:2)

DETECTIVE DUGAL: — a web master for — for the company. But he was also a business partner. And I know he had access to QuickBooks for a fact because he’s the one who first gave me Joseph’s QuickBooks stuff.

See the recorded call (pp. 47-48)

Dan admitted to San Bernardino that after Joseph disappeared he went into QuickBooks and “maybe entered some transactions into it,” “probably like five days later.” He was describing the main account, not the custom one, but it shows he was in Joseph’s books: (Kavanaugh interview, September 20, 2014, pp. 146:19-147:22)

See the Kavanaugh interview (September 20, 2014, pp. 146-147)

Dan went on, later in the same exchange, to say what he saw happen to the account: (Kavanaugh interview, September 20, 2014, pp. 147:24-148:17)

MR. KAVANAUGH: No — no Paul Mitchell deal. That was all in Chase’s account. There was no Saudi Arabia deal. That was on Chase’s account (inaudible).
I think I went and just created my own Quick Books account that I started from scratch, started recording new transactions.
…
DETECTIVE HANKE: Did you add any journal entries? Did you delete anything?
MR. KAVANAUGH: No.
DETECTIVE HANKE: Did you dispute any charges, or anything like that?
MR. KAVANAUGH: No disputing of charges, no deleting of journal entries, no deleting. He said that he deleted the account. I could see that he had deleted it within a couple days after Joseph had disappeared. An e-mail confirmation (inaudible).

See the Kavanaugh interview (September 20, 2014, pp. 147-148)

Then the cards. On June 10, 2010, the card on Joseph’s main QuickBooks account was changed from his MasterCard ending 1815 to a MasterCard ending 4743 (INT 000052). That is the card on Dan Kavanaugh’s own QuickBooks order two months later, billed to “dan kavanaugh” in San Diego (INT 000008). On September 30, 2010, at 10:07 a.m., the main account was reactivated with an American Express card ending 6000, billing address 6965 El Camino Real, Encinitas (INT 000051). Four minutes later, at 10:11, the custom account was reactivated too (INT 000048). Intuit told DuGal that “somebody named John Pugsley is paying for it.” My daughter, Taylor Jarvis, an attorney, found through a records search that John Pugsley is Dan’s grandfather.

See Intuit’s account records (INT_MCSTAY000008, 000048, 000051, 000052)

Dron told DuGal about the card change in 2011: (recorded call, May 11, 2011, pp. 50:1-24)

See the recorded call (p. 50)

And that whoever did it put the card in online, and it might be the business partner: (p. 51:10-17)

MS. DRON: They can put it in. He put it in himself. He didn’t call us to do it. He — yeah. He’s — they’re work- — somebody is accessing the company and using it, it looks to me like.
DETECTIVE DUGAL: Huh.
MS. DRON: So, you know, I don’t know. You said they have business partners. Maybe it’s the business partner.

See the recorded call (p. 51)

In a later recorded call with DuGal about that card, dated May 24, 2011, Dron said: “And no one cancelled, they just turned off the credit card.” (at about 1:59 in the recording; the clip below starts at 1:35)

Intuit’s records match: the main account went from active to suspended on May 14, 2011 (INT 000051).

Fact check

• Mr. Imes: “it’s immediately at 8:06 a.m. that there’s a call to QuickBooks … asking to delete the account.” The call began at 7:34. 8:06 is when Baker opened his case (Exhibit 794, item 9167; INT 000033).
• Mr. Imes told the court the February 8 call would “come in through other competent witnesses” (RT 3639:28-3640:1). The State never called Augenstein, and Ms. Rodriguez then told the jury the defense could have (RT 8428:6-9).
• The case summary puts Baker’s February 9 notes on a “February 8, 2010, at 1444 hours” phone call. There was no call at 2:44.
• Hanke’s report says the calls Baker described “involved some type of fraudulent activity.” Baker never used the word fraud; he said “business partners that have gone awry” (Baker interview, p. 24).
• Baker’s e-mail went to custom@earthinspiredproducts.com, the custom account’s address (Baker, RT 3741:18-20; Hanke’s report, Bates 007469). In my 2017 notes I called it Joseph’s e-mail; it was his business address for that account.

Claim 10 of 15

“He impersonated Joseph.”

What the State said

Hanke’s report of the Baker interview says the caller was not acting for Joseph: (Bates 007469)

“The caller did not represent himself as anyone other than Joseph McStay. The caller was not acting on behalf of Joseph McStay. Baker would not process any requests for anyone other than Joseph McStay.”

See Det. Hanke’s report (Bates 007469)

Ms. Rodriguez told the jury, “So he impersonates Joseph McStay and calls QuickBooks” (RT 8428:19-20, quoted in full under Claim 8).

What the State already knew

DuGal knew in 2011 that the order came from my phone, called me, and “resolve[d]” it (Claim 8). I told him then the switch to Pro was to keep Dan out of Joseph’s accounts.

The record

He asked whether I said I was Joseph: (p. 185:1-17)

MR. MERRITT: him. It was sent to his house. I know for a fact it was.
DETECTIVE BACHMAN: It wasn’t sent to his house. It was sent to San Clemente.
MR. MERRITT: It ended up being sent to San Clemente.
DETECTIVE BACHMAN: Why would it be sent to San Clemente?
MR. MERRITT: Apparently, that was the — the last address he had. I assumed that the last address that he had was —
DETECTIVE BACHMAN: Okay. So when you called Quick Books on the 8th, did you say, this is Chase Merritt, and I — I need to order Quick Books? Or did you represent yourself to be Joseph McStay?
MR. MERRITT: I don’t think I represented myself to be Joseph. No.

See my interview (p. 185)

See my notes (QuickBooks conclusions, pages 11-12)

Fact check

• Baker said QuickBooks verifies a caller by name, phone number and “the e-mail that the business is associated to” (Baker interview, p. 30:22-24, Claim 9). It does not deal with anyone but the account holder.

Claim 11 of 15

“Joseph had no reason to move QuickBooks, would have fixed the shipping address, and didn’t place that order.”

What the State said

Mr. Imes told the jury there was “no credible evidence” Joseph wanted to move QuickBooks, and that “we know that he didn’t place that order”: (RT 8224:19-8225:5)

You would have to believe that Joe wanted to or would move QuickBooks in the first place. And there is, really, no credible evidence of that. You would have to ignore coincidence or believe that Joe wouldn’t think to update his shipping address for QuickBooks, if he did, in fact, place that order. But we know that he didn’t place that order. We know it came from the defendant’s phone.
You would have to believe that Joe wasn’t the only one with administrator abilities to QuickBooks or had found the ability or password to get into QuickBooks. You would have to believe that the defendant, in some way, had the ability to access Joe’s e-mail. Because remember, what did QuickBooks do? They sent an authorization e-mail to Joseph McStay’s e-mail address that went unanswered. That was probably a step in the covering of his tracks that the defendant didn’t think about.

See the trial transcript (RT 8224-8225, Mr. Imes)

He said there was “no coincidence” to the QuickBooks activity: (RT 8224:2-8)

There’s no coincidence to this QuickBooks activity, ladies and gentlemen, none, whatsoever. The only innocent explanation requires you to believe that Joe was changing his entire business practice over night and giving control to a person that he was clearly not trusting and attempting to sideline. Is that a reasonable interpretation to that QuickBooks activity? No.

See the trial transcript (RT 8224, Mr. Imes)

What the State already knew

On February 17, 2010, I told DuGal I bought QuickBooks Pro on Joseph’s card, “two, three, or four days after February 4th,” and why: Summer (Why). In June 2011 I told him the February 4 meeting was about getting Dan out of Joseph’s accounts (What I told them, and when).

The record

See the QuickBooks Pro order (INT_MCSTAY000004)

And that only the backup disc came back. The program was a download, and it was downloaded: (pp. 37:13-25)

MS. TAYLOR: And, you know, also on that order number that you had given us, that one, it was ordered — it was an order for a download. They were going to ship out a reinstall disc. But it did come back to us as an undeliverable address.
DETECTIVE DUGAL: Really?
MS. TAYLOR: But, originally, they did order the product for a download.
DETECTIVE DUGAL: So that first item that I talked about that was sent out, came back? Does that —
MS. TAYLOR: Right, just the CD. But he actually did get the product and received — actually, I could see something else.

See the recorded call (p. 37)

Once, that afternoon: (p. 39:1-4; “it’s only been downloaded once… on that day, on February 8th,” p. 39:21-24)

MS. TAYLOR: I don’t — I — honestly, I don’t know who downloaded it. But I can tell that it was loaded because it was validated that day at — that afternoon after they placed the order.

See the recorded call (p. 39)

This is what I said about the download in June 2011: (recorded call, June 9, 2011, p. 15:8-20)

DUGAL: that’s where it got sent to and then there was a online download that accompanied the product CD that they sent and that was downloaded somewhere by somebody, do you remember that at all?
MERRITT: You know I honestly I don’t remember um it’s a it’s a good possibility it-it I did it I don’t know it-it depends on when it was done if it was done um sometime after the 4th it depends
DUGAL: It was after the 4th
MERRITT: Then it’s then it was probably me because I don’t think he was trying to get away from Dan and I don’t think Dan would have doing it
DUGAL: Yeah
MERRITT: so um it-it-it would have been me and but and-and if I had um if I ordered the-the QuickBooks uh I god I can’t remember whether I did or not or whether he did but

See the recorded call (June 9, 2011, p. 15)

In the same call, DuGal raised the shipping address himself, and I disagreed with him: (recorded call, June 9, 2011, p. 15:21-27)

DUGAL: What I’m afraid of it-it may not be you telling them the address what I’m afraid of is they probably referenced his original account he may never have changed his address on the QuickBooks
MERRITT: Oh I’m pretty sure he changed his address he’s-he’s pretty damn thorough
DUGAL: Yeah?
MERRITT: He’s yeah-yeah he’s pretty thorough
DUGAL: Yeah it got sent to the wrong place but I’m

See the recorded call (June 9, 2011, p. 15)

Asked when I made the call, I said I didn’t remember, and guessed it was probably before Joseph disappeared: (my interview, October 22, 2014, pp. 135:12-136:3)

DETECTIVE BACHMAN: So you said he asked you to upgrade Quick Books about two weeks prior to him going missing?
MR. MERRITT: Yeah. I think it was —
DETECTIVE BACHMAN: How long did it take for you to actually call and upgrade Quick Books?
MR. MERRITT: I don’t remember.
DETECTIVE BACHMAN: Before or after he went missing?
MR. MERRITT: Don’t remember. I’m assuming it was probably before. But it could have been directly after. I didn’t have a whole lot to do the week or two after he disappeared because I couldn’t get a hold of him, you know.
So I was probably looking for stuff to do and — I don’t know. It could have been a week before. It could have been a week after. I’m not sure.

See my interview (pp. 135-136)

Then Bachman told me I had called on the 8th to delete Joseph’s account. I told him I never asked for anything to be deleted on the 8th; I asked them to change it, or send him a new one: (pp. 183:6-184:25)

See my interview (pp. 183-184)

Fact check

• “We know that he didn’t place that order”: I placed it, on Joseph’s card, at his request, and told DuGal so in February 2010.
• “Joseph could have gone to the store and bought the desktop version”: he asked me to do it, and it went on his card (INT 000004).

Claim 12 of 15

“He kept telling different stories.”

What the State said

Asked at the preliminary hearing whether I told him I never attempted to delete the QuickBooks account, Hanke said: (prelim RT 124:22-28)

Q Did you ask him about deleting the QuickBooks online account?
A Yes.
Q Did he tell you that he never attempted to delete the QuickBooks online account?
A I believe he told me — there was multiple stories. I’m sorry.

See the preliminary hearing transcript (p. 124)

What the State already knew

The table in “What I told them, and when.”

Bachman swore in his own warrant affidavit that I contacted Intuit “as he stated in his original interview with SDSO investigators,” and tried to transfer the accounts “like he stated in his interview” (Claim 8).

The record

DuGal told Intuit I hadn’t told him about any transactions after Joseph went missing. That isn’t right. I told him about the Pro order, and when I made it (above, and Why the jobs were kept from Dan and Summer). But he also said it could be harmless: (pp. 48:12-49:4)

DETECTIVE DUGAL: His phone number at that time was the one you mentioned, 909-374-0102. He lived in Rancho Cucamonga. And I interviewed him February 16th, 17th. And he didn’t talk to me at all about any transactions that occurred after the — Joseph went missing.
But it could be harmless. It could be that he didn’t remember doing that. You know what I’m saying? If Joseph — because Joseph wasn’t discovered missing — and this is part of the story I didn’t tell you yet. He went missing on February 4th. He was not reported missing until February 15th by his brother.
So I was already 11 days behind the curve.
So these transactions that we’re talking about, even though they happened after Joseph was missing, could have been business as normal for Joseph’s business partners because they didn’t know he was missing at that time — or allegedly didn’t know.

See the recorded call (pp. 48-49)

What DuGal told QuickBooks in May 2011

Fifteen months after my notes were read aloud to him, DuGal talked with Annette Dron at QuickBooks. These are his words as I copied them for my lawyers:

He told her I was a bad guy: (Dron call, May 12, 2011, p. 5:14-22, as I copied it)

“Well, another thing is that credit card is unusual. But I know you don’t know a ton about the case. But Chase Merritt is a bad guy. It’s a business partner. But he has a criminal history.”

See my copy (Folder F, tab 9HH)

Listen (recording, about 3:01 to 3:30):

He told her I had never mentioned calling QuickBooks: (p. 6:9-18, as I copied it)

DUGAL: “And I’ve interviewed him a couple times, and he never mentioned calling you guys and doing this.
Because this is something that — well if I was questioning you on a missing person, wouldn’t you say, ‘Oh, my god. I just called this business, and it was after the day he was missing,’ and blah, blah, blah, blah.
Wouldn’t that seem like something you would tell a cop?”

See my copy (Folder F, tab 9II)

Listen (recording, about 3:39 to 4:02):

And he told her what he hoped I would say: (p. 17:5-10, as I copied it)

DUGAL: “Well, I have to talk to Chase. It would be awesome if Chase said, I didn’t do it. I didn’t call. I didn’t give a number. See, then I could tell a judge, well, now, maybe somebody is using Joseph’s name, Chase’s number. Which I don’t believe, but, you know.”

See my copy (Folder F, tab 9LL)

Listen (recording, about 12:37 to 13:05):

The transcript of this call isn’t available to me, but the recording is. The words above are as I copied them from the transcript in 2017; the clips are from the recording.

What else DuGal told her in the same call

Those three lines are not all he said. In the same call he told the QuickBooks supervisor what he could and couldn’t tell a judge:

He said it wasn’t criminal: (p. 8:12-16, as I copied it)

DUGAL: “Again, it’s not criminal. It’s just going to be, hey, Chase, why don’t — you know, tell me about this. Did he use your phone? Did you use your phone? Why would somebody say it was your phone?”

See my copy (Folder F, tab 9II)

He said it wasn’t unusual, and Dron agreed: (pp. 9:1-10:2, as I copied it)

DUGAL: “I’ll go a step further with you because we’ve talked about it. The problem now is, the information you gave me is too logical for criminal — remember I was telling you to convince the judge I need a search warrant?”
“I have to say it’s suspicious and outside of the normal business behaviors of Joseph, Chase and Dan.
Well guess what? It’s not unusual and it’s not outside the normal business practices. See what I’m saying? So —”
DRON: “It really isn’t. But nothing looks weird to me that I can see like that we don’t have happen constantly.”
“So it’s just — it’s — it’s so common. I mean, nothing, you know, comes — you know, I did, I seriously looked for anything I could think of. It just looks normal.”

See my copy (Folder F, tab 9JJ)

Listen (recording, about 6:00 to 6:52):

And he said he knew we had access: (p. 13:7-12, as I copied it)

DUGAL: “I can’t lie to a judge, I can’t play the game.
That, you know, Joseph was a private man and these guys just invaded his privacy. No, I know they had access.”

See my copy (Folder F, tab 9KK)

Listen (recording, about 8:58 to 9:52):

The transcript of this call isn’t available to me, but the recording is. The words above are as I copied them from the transcript in 2017; the clips are from the recording.

What DuGal told me a month later

On June 21, 2011, DuGal said the same thing to me, that QuickBooks hadn’t come up at my first interview: (recorded call, June 21, 2011, p. 30:2-6)

DUGAL: Oh okay but here’s I’ll give you an example of something that came up after the investigation that made me go God dang it is that whole uh Quick Book thing. You didn’t think about it when we first interviewed and you know why you didn’t think about it, it is relatively unimportant because the business was existing beyond the fourth of February right?
MERRITT: Oh yeah

See the recorded call (June 21, 2011, p. 30)

Later in the same call I asked him why it had taken so long, when they had Joseph’s computers. He said: (pp. 36:17-20, 37:23-26, 38:13-22)

See the recorded call (June 21, 2011, pp. 36-38)

He then explained why he never got a warrant for QuickBooks: (pp. 39:26-40:8)

DUGAL: Absolutely but I have to have, I have to have a complete link to why I think it’s criminal. A judge doesn’t, doesn’t give me a carte blanche search warrant to go explore to find the criminal element I have to as an investigator have an idea as what criminal action happened so if it’s Quick Books let’s use that as the example
MERRITT: Okay but okay go ahead
DUGAL: If it was a problem with Quick Books and Joey was abducted because somebody did something in his business account on Quick Books and you had told me in our first interview you need to look at this Quick Books thing because Joey told me that this guy from Mexico was gonna kill him because he was doing something in Quick Books. I guarantee you I could get a search warrant to go into Quick Books for that but that’s not what I heard, that’s not what anybody told me, that doesn’t fit what’s been

See the recorded call (June 21, 2011, pp. 39-40)

Fact check

• Hanke told me in 2014 that I never told San Diego I wrote checks and signed Joseph’s name (interview pp. 142-143, Claim 4). My February 17, 2010 notes, as DuGal reported them, included “went over when to write the checks,” and five days later, on speakerphone, I added up for him what had been taken out (What I told them, and when).

Claim 13 of 15

“He used short calls to erase his messages from Joseph’s voicemail.”

What the State said

This is what the State’s detectives made of those calls (case summary, Det. Bachman, Bates 000020-000021):

“Detectives noticed of the 11 calls from Merritt to Joseph, aside from one 37 second call, all additional calls ranged from 52 seconds to 2 minutes 3 seconds. This was significant to detectives because when they listened to voicemails from Joseph’s cell phone; all the voicemails were left after the family was reported missing on February 15, 2010. Of the 25- voicemail messages, no voicemails in the mailbox were from Merritt, leading detectives to believe Merritt was listening to and deleting Joseph’s voicemail message by accessing his mailbox during the calls made to his phone.”

See the State’s case summary (Bates 000020, 000021)

What the State already knew

I told DuGal in June 2011 that I would “just about bet anything” I left Joseph a message whenever I did anything with QuickBooks or money, and that “you’ll find a lot of messages from me” (What I told them, and when).

The record

I would not have written a check without letting Joseph know it had been done, at least by voicemail. This is what happened after each check, with the call that followed it on my AT&T record, Exhibit 794. Joseph’s cell phone was (949) 295-7451.

• February 1: two $2,500 checks to me were created in QuickBooks, printed and deleted, and neither was cashed. Mr. Imes put the deletions at 12:47 and 12:52 p.m. At 1:03 p.m. Joseph called me, and we talked for 9 minutes 56 seconds. (Bates 000022; RT 8190:24-25; item 8865)
• February 2: I wrote the $2,495 check at about 11:30 a.m. and deleted it. At 11:46 a.m. I called Joseph to let him know: 3 minutes 24 seconds. Joseph’s record shows him on another call then, so it would have gone to his voicemail. (item 8924; Bates 005511)
• February 5: starting just after noon, I wrote checks for $4,500, $6,505 and $2,350 to me and $1,650 and $250 to Metro, all dated February 4, and deleted them. The $6,505 check was never cashed. At 12:49 p.m. I called Joseph and left him a message: 53 seconds. (Bates 000023-000024; item 9088)
• February 8: I wrote the $6,500 check at 2:20 p.m. and deleted it at 2:25. I was on the phone with QuickBooks from 3:11 to about 4:58. At 5:01 p.m. I called Joseph and left him a message: 52 seconds. (Bates 000024; activity log; items 9159, 9163)
• February 9: after my second call to QuickBooks, which ended about 8:17 a.m., I called Joseph at 8:56 a.m. (2 minutes 3 seconds), 9:17 (55 seconds), 12:22 p.m. (1 minute 4 seconds) and 1:07 p.m. (37 seconds). (items 9167-9179)

See Exhibit 794 (AT&T pages 362, 365, 371, 374, 375)

See the State’s case summary (Bates 000022, 000023, 000024)

The February 1 call was a conversation of nearly 10 minutes; the February 2 call, just over 3 minutes, came while Joseph was on another call. The February 5 and 8 calls were under a minute, which is about the length of a message. On February 9 they ran from 37 seconds to just over 2 minutes.

See what I gave counsel: “Messages left after checks” and the voicemail (Folder D, pages 39, 76, 77, 78, 79, 80)

Who called Joseph’s voicemail number

Joseph’s voicemail was a Google Voice number, 805-637-7243. His own phone record shows it: every time he checked his messages, his phone called that number, listed as “VM Retrieval” (Joseph’s T-Mobile record, Bates 005482). His last check was at 4:31 p.m. on February 4 (Bates 005515). That number never appears on my phone record (Exhibit 794).

See Joseph’s T-Mobile record (Bates 005482, 005515)

It appears on Dan’s phone record 40 times between February 2 and February 18, 2010, as “0111805637724” (the statement’s column cuts off the last digit). Three of those calls were before the family disappeared: February 2 at 3:39 p.m., February 3 at 9:07 a.m., and February 4 at 4:30 p.m. Those three were made while Joseph was still here, when he was worried that Dan was getting into everything of his. McCargar told Joseph’s mother that Joseph was trying to buy Dan out “due to Dan having total control of Joseph’s accounts and website” (Bates 001819, under Why the jobs were kept from Dan and Summer). Joseph wasn’t being paranoid: Dan was calling his voicemail. The other 37 were from February 5 through February 18, almost all of them one or two minutes long. (Dan Kavanaugh’s T-Mobile statement for (858) 717-6508, dated February 19, 2010, pp. 13-27.)

Dan was in Hawaii, and his statement lists times two hours behind California: his February 3 call to Joseph at 3:58 p.m. on his statement shows on Joseph’s record at 5:57 p.m. So his February 4 call to the voicemail number, 4:30 p.m. on his statement, was about 6:30 p.m. California time. The times below are as his statement lists them.

Again and again he called Joseph’s cell and the voicemail number within a minute or two of each other: February 7 at 9:41 and 9:42 a.m.; February 9 at 2:35 and 2:36 a.m., at 10:36 a.m., at 2:48 p.m., and at 8:39 and 8:41 p.m. On February 17, two days after the family was reported missing, he called the voicemail number five times: 10:16 a.m., and 8:19, 9:11, 9:13 and 9:15 p.m.

In 2014 Dan gave a reason he might call that number: (Kavanaugh interview, September 20, 2014, p. 99:3-9)

MR. KAVANAUGH: Honestly, I don’t know if I even had their house line number, unless — you know what he did is, he had a Google voice number that we maintained on the site. And we had simultaneous rings. So you could put a house number or a cell phone number. And then whatever one you’re at, you’d pick it up. It goes to that.

See the Kavanaugh interview (September 20, 2014, p. 99)

See Dan Kavanaugh’s phone record (February 2-18, 2010, pages 13-27)

Claim 14 of 15

“Hanke could only look at a locked copy, and had to screenshot every page.”

What the State said

This is how Hanke described the “clones” to the jury on direct examination: (RT 4055:16-4056:21, February 14, 2019)

Q Okay. Now, additionally, as part of your investigation, did you actually receive some clones of accounts belonging to Earth Inspired Products?
A That’s correct.
Q And can you tell us how you actually received those clones?
A Absolutely. I wrote — authored a search warrant that was signed and I sent a copy of the search warrant to Intuit, QuickBooks. I was contacted by a legal team member who provided me a login and password, which had two cloned accounts involving the business — two business accounts of Earth Inspired Products.
Q Okay. And let’s talk a little bit about once you received those clones, tell us what — what they looked like?
A So normally — and I will explain. Normally, records are given on a CD. If I write a request of a bank, may get a stack of records or a file or something like that. In this case, it wasn’t. It was a logon to QuickBooks website from a desktop computer. Once I logged on, it had links — copied cloned links that I was not able to modify or change in any way. But I had to view the dashboard and each screen I had to screenshot.
So I screenshot what was contained in those files. So the vendors, the transactions, the checks, the audit logs. I went through each account and took screenshots of both.
Q Okay. So when you actually log in, did they provide you with a particular username and password?
A They did. They provided me with a username. I believe I set up my own password. But the username they provided me was Detective Dan Hanke.
Q Okay. So after you log in, tell us what you see on the screen?
A So after I log in, it says user, Detective Dan Hanke, there’s an audit log where it shows sign ins and sign outs. They did that so it didn’t appear that somebody else was accessing the account. They wanted to be very clear that it was my — myself accessing the account during the investigation.

See the trial transcript (RT 4055-4056, Det. Hanke)

And that there was no way to copy it, so he made screenshots of every page: (RT 4057:10-4058:4)

Q Okay. And so you are actually seeing data that the account holder would see; is that right?
A Yes. They gave me access as I was a QuickBook user, and I saw the dashboard, how it would look for the user.
Q Okay. Were you able to modify those accounts in any way?
A No, I was not able to.
Q Could you copy the accounts to be able to go through them on a separate CD?
A No, there was no way to copy it. It was — it was an online subscription, so there was no way to copy data and transfer it. So like I said, I had to go through and take out — snipping — snipping tool, and I did screenshots.
Q How many pages are we talking about?
A A lot, over a thousand.
Q So there was two accounts; correct?
A That’s correct.
Q Okay. So when you say over a thousand, was that for one account or for both?
A I believe one account had almost 900 pages, and the other one had a few hundred pages. I don’t recall exactly how many.
Q Okay. So you literally had to take a tool and do a snipping tool, make a screenshot of that, and print out every single page?
A Yes.

See the trial transcript (RT 4057-4058, Det. Hanke)

What the State already knew

Intuit’s own investigator testified the copy couldn’t be changed “as long as it remains” canceled, that a change would show in the audit log, and that he had “no idea what was done” in it after the log was printed (below).

The record

His own report, dated October 14, 2014, says something else again: the clones let him “view and print records,” he “printed copies of the reports,” and he used screenshots only “to assist the writing of this report”: (Bates 007451)

“On Friday, September 26, 2014, I received an email from QuickBooks Online to add me as a user on two of Joseph’s accounts. QuickBooks authorized me to log in as user “Detective Dan Hanke.” QuickBooks cloned both accounts which allowed me to view and print records. The accounts were cloned copies of Joseph’s original accounts. I was not able to modify the records in any way. I printed copies of the reports, and later placed them onto an evidence disk. I used screen shots to assist the writing of this report.”

See Det. Hanke’s QuickBooks report (Bates 007451)

At the preliminary hearing, he had said something different: he could view and print the records: (prelim RT 101:5-10)

Q How did you receive access to these records from Intuit?
A Intuit cloned Joseph’s accounts and made me an authorized user on the accounts. It was an online-based account, so I signed in using my information, and I could view Joseph’s account. I couldn’t alter it. I couldn’t change it or modify it. I could view and print the records, only.

See the preliminary hearing transcript (p. 101)

What his exhibits show

A screenshot made with a snipping tool is a picture of part of the screen. It has no page header, no web address and no print date. Hanke’s QuickBooks exhibits have all three, in the places a web browser puts them when it prints a page:

• The audit histories of the checks, Exhibits 425, 426, 427 and 429: each page has the browser’s header, “Audit Trail ID … Page 1 of 1,” and its footer, the web address of the QuickBooks Online page, “https://qbo.intuit.com/c29/v78.347/1886106241/lists/audit/auditdetail?f_elementid=…,” and the print date, 10/13/2014. Exhibit 425 is shown below.
• The activity log of the custom account, “All activities by all users, From: 01/01/2001 To: 10/13/2014”: the footer is the web address of the page, “https://qbo.intuit.com/c29/v78.347/1886106241/lists/audit?f_audit_userid=-2…,” printed 10/13/2014.
• The vendor list from the main account (Exhibit 421, as I have it): the footer is “https://qbo.intuit.com/qbo29/reports/8251610321/execute?rptid=8251610321-VEND_CO…,” printed 10/5/2014. “Execute” is a report being run on command.
• Intuit’s own records of the two accounts, Exhibits 808 and 809, were printed from Intuit’s live administrative page, “company_dump_backend,” on 9/4/2014 (INT 000047-54).

See Exhibit 425 (check audit history, ID 159)

See the activity log, custom account (page 1 of 5)

See the vendor list (Exhibit 421)

Exhibit 425 is ID 159: check 4093, $2,500, “deposit,” added at 12:34 p.m. on February 1 and deleted at 12:52 by the user “Joseph McStay.”

“That’s going to be me”

When Hanke interviewed Baker, Baker said he believed the record had been accessed in 2014 and would have to look up the date. Hanke told him that was him, and that the history would show “Joseph McStay” authorizing a new user, Detective Dan Hanke. Baker offered to check for activity after February 4. Hanke said it wouldn’t be necessary: (Baker interview, October 24, 2014, pp. 34:9-35:22)

See the Baker interview (pp. 34-35)

The activity log shows what Hanke described. On September 26, 2014, “Joseph McStay” signed in, added the user “Detective Dan Hanke,” and sent him an e-mail invitation. Hanke then signed in on September 27, October 5 (three times), October 7 and October 13, 2014, the day the log and the audit pages were printed (activity log, page 1).

So entries made in 2014 were recorded under Joseph’s name. Hanke agreed the name in the log doesn’t tell you who was at the computer: (RT 4066:1-12)

Q And when you say “user, Joseph McStay,” you don’t know who is behind the computer; right?
A I don’t.
Q Okay. It just automatically populates that account as Joseph McStay if somebody signed in that way?
A If someone logged into the account, it shows Joseph McStay. You will see later where I logged in as Detective Dan Hanke.
Q Okay. We can actually take a look at that right now just to show the difference. Is this what you are referring to, page 1 of the exhibit?
A Yes. On September 26th, 2014, Intuit added user Detective Dan Hanke and then sent me an e-mail invitation to that account.

See the trial transcript (RT 4066, Det. Hanke)

What Intuit said about the copy

Mike West testified that the cloning script cancels the account so it can’t be modified: (RT 3975:13-26)

Q AND DOES QUICKBOOKS HAVE THE ABILITY TO ACTUALLY CLONE AN ACCOUNT?
A YES.
Q AND CAN YOU TELL US HOW THAT WORKS?
A ONCE A REQUEST HAS BEEN MADE, USUALLY THROUGH OUR LEGAL DEPARTMENT, REQUEST IS SENT TO A SOFTWARE ENGINEER, AN OPERATIONS ENGINEER, AND THEY RUN A SCRIPT OF A PRERECORDED SET OF INSTRUCTIONS. THEY TELL THE SCRIPT WHAT THE COMPANY I.D. IS AND WHO THE CLONE WILL BE ACCESSED BY, AND THE SYSTEM WILL CREATE A UNIQUE USER NAME FOR THAT NEW USER AT THE CONCLUSION OF THE SCRIPT. THE SCRIPT CANCELS THE ACCOUNT. SO IT COPIES ALL OF THE RECORDS, CANCELS THE ACCOUNT SO NO MODIFICATIONS CAN BE MADE AND THEN ALSO CANCELS ANY RECURRING TRANSACTIONS.

See the trial transcript (RT 3975, Mike West)

Asked by Ms. Rodriguez whether Hanke could print or screenshot documents from the copy, Intuit’s own witness said he could: (RT 3980:26-3981:2)

Q OKAY. AND ONE LAST QUESTION WITH RESPECT TO THE CLONES THAT WERE PROVIDED TO DETECTIVE HANKE, IS HE ABLE TO ACTUALLY PRINT UP OR SCREEN SHOT SPECIFIC DOCUMENTS FROM THERE?
A I BELIEVE HE IS.

See the trial transcript (RT 3980, 3981)

When the court then asked him about the clone, West added that he had not looked at that particular clone himself (RT 3981:23). His answer is about what a clone allows, not about this one.

But only “as long as it remains” canceled: (RT 3978:13-20)

Q OKAY. AND AGAIN, TO BE CLEAR, THAT CLONED ACCOUNT CAN’T BE MODIFIED OR ANYTHING LIKE THAT BY DETECTIVE HANKE IN ANY WAY; IS THAT RIGHT?
A AS LONG AS IT REMAINS IN THE CANCELED DATE. IF IT WAS CHANGED, IT WOULD ALSO BE REFLECTED IN THE AUDIT LOG.
Q AND DO YOU SEE ANYTHING ON THIS AUDIT LOG THAT WOULD REFLECT THAT?
A NO, I DO NOT.

See the trial transcript (RT 3978, Mike West)

And he had no idea what was done in it after the log was printed: (RT 3990:15-23)

Q OKAY. SO THERE WAS — THERE WAS NO ACTIVITY AFTER OCTOBER 13, 2014, AT LEAST ACCORDING TO THIS AUDIT LOG?
A FROM THAT PRINTED LOG. I HAVE NO IDEA WHAT WAS DONE AFTER THIS DATE IN THE CLONE.
Q OKAY. THAT’S WHAT I WAS — THAT’S WHAT I — THAT’S A BETTER QUESTION.
YOU DON’T KNOW WHAT WAS DONE IN THE CLONE AFTER THIS DATE; CORRECT?
A I DON’T, NO.

See the trial transcript (RT 3990, Mike West)

Fact check

• At trial: “each screen I had to screenshot,” “there was no way to copy it,” and “print out every single page? A Yes” (RT 4056-4058). His own report: “I printed copies of the reports… I used screen shots to assist the writing of this report” (Bates 007451). At the preliminary hearing: “I could view and print the records” (prelim RT 101).