The Evidence Carnival: The Pastor's Hitman
Visualizing case evidence through a twisty tale of hitmen, deceit and solid digital investigation.
February 2016
An anonymous Internet user, dogdayGod, hops onto the darknet with a Tor browser and heads to Besa Mafia. This notorious marketplace for hitmen is one of a handful of underground, anonymized marketplaces that’ll offer you heroin, illegal abuse videos or even—allegedly—a hit on your wife. On this day, dogdayGod was trying to procure such a service, sending Bitcoin to their alleged hitman, unaware the entire thing was a scam.Â
Soon, the whole world would know.
On April 7, 2016, Romanian police arrested five men allegedly controlling operations of this hitman-for-hire dark website. The jig was up now, and it was clear that people who thought they were hiring hitmen were actually being taken for a ride—it only gets worse.
On April 26, 2016, vigilante hackers penetrated and exposed the Besa Mafia database. In this data, it was now publicly evident that the whole thing was a scam, and investigators dug into the various accounts, underground handles, Bitcoin wallets and other digital breadcrumbs. From these breadcrumbs, the FBI receives a tip that Mrs. Amy Allwine, from Minnesota, may be in danger.
The Allwine family are church-going folks. Amy is heavily involved in her parish, and her husband, Steven Allwine, is a pastor. While they’re shocked to hear that someone had taken out a hit on Amy, Amy also shares that a couple of threatening emails had come in telling her to commit suicide. It was terrifying for Amy, and whoever dogdayGod was, they wanted Amy dead.
The Allwine's respond by increasing their security, installing a Ring security system, and Stephen Allwine purchases a 9mm handgun. But this does nothing to stop the threats telling Amy to kill herself for her alleged infidelity. Infidelity that wasn't actually occurring. The Jane Doe threats implied that if Amy didn't kill herself, bad things were going to happen to her family—including her son—and whoever these threats were coming from, they knew intimate details about the Allwines, including their daily habits and movements.
On November 13, 2016, a 9-1-1 call comes in to Cottage Grove, Minnesota police. Stephen Allwine says he has discovered his wife, Amy Allwine, dead from an apparent self-inflicted gunshot wound.Â
The investigation turned up numerous physical and digital forensics artifacts that cast serious doubt on the suicide theory.Â
The gunshot wound appeared to be from Amy's non-dominant side.
There was no gunshot residue on her hands.
Digital evidence showed that Stephen Allwine had been performing various activities, such as searches, Bitcoin transactions, and other premeditation activities.
If you haven't already guessed, it might be time for a nap or to caffeinate some more.Â
On January 31, 2018, Stephen Allwine was convicted of first-degree premeditated murder, much of the case built on extensive forensic and digital investigative work on the 60 devices that were seized. He maintains his innocence; however, few doubt his guilt.
Oddly enough, Allwine isn't the only case that involved the dark website Besa Mafia. On July 21, 2023, Kristy Lynn Felkins, of Las Vegas, Nevada, was sentenced to five years in prison for sending 5 Bitcoins (~$5,000 USD at the time) to a hitman in exchange for them killing her husband.
The Evidence Carnival
Recently, the Permanent Record Research Team and a group of fellow friends and experts such as Chris Atha, Mark Piper, Shafik Punja, and more to come, have been building an indigent defense-only1 repository.
As part of this repository, I've been working on a presentation to help demonstrate how digital evidence is acquired and presented by the prosecution in a case. One unique insight from the Allwine investigation was the FBI's use of a variety of methods to connect his activities to the crime—they correlated and corroborated.
The case went to the Minnesota Supreme Court on appeal, and there is an excellent paragraph containing corroboration and verification activities:Â
The computer forensic expert testified that the user S Allwine downloaded TOR—a web browser needed to access the dark web—on the MacBook Pro laptop computer.[7] The expert testified that he found a "note" on the MacBook Pro laptop computer with an email address "sharklasers.com," which allows users to send anonymous emails. The expert testified that the user S Allwine composed an anonymous email on the MacBook Pro laptop computer. The expert testified that minutes before dogdayGod sent a message to Besa Mafia, requesting that Amy be killed while traveling to Moline, Illinois, the user S Allwine ran a Google search of Moline, Illinois on the MacBook Pro laptop computer. The expert testified that the user S Allwine used the MacBook Pro laptop computer to view Amy's Facebook account and browsed her photographs the day before dogdayGod sent a photo of Amy to Besa 184*184 Mafia. The expert testified that dogday-God sought to buy the drug scopolamine online. Last, the expert testified that the same unique 34-digit alphanumeric code that dogdayGod used to pay Besa Mafia in Bitcoin was found on the MacBook Pro laptop computer with the username S Allwine…
State v. Allwine, 963 N.W.2d 178 (Minn. 2021)
What we see here is an expert walking through the evidence, iterating, confirming and tightening the knot around Allwine’s activities. Without examining all of the evidence and transcripts, we can only make observations:Â
The expert is corroborating activities on the devices, showing that Allwine needed a TOR browser to connect to Besa Mafia.
The expert shows that Allwine heads to an anonymous email service before sending an anonymous email.
Expert demonstrates that Allwine searched for "Moline, Illinois" on his MacBook before sending the location to Besa Mafia.
Expert demonstrates that Allwine searched and found pictures of Amy Allwine on Facebook before sending them to Besa Mafia.
The dogdayGod user had searched for 'scopolamine' online—the drug found in Amy Allwine's system that may have killed her. Note the expert is not using Allwine's name here; they are using the dogdayGod username, as they may not be able to present, for certain, that it was Allwine.
The unique 34-digital Bitcoin code used to pay for the hitman was found on his machine—he had also previously said that he had Bitcoin robbed from him.
Another interesting note was how carefully the analysts used Allwine’s name and when they referenced his devices or usernames. This is a sure sign that you have digital investigators who know it is incredibly difficult to put someone in front of the keyboard or phone definitively. The more careful the language, the more likely they know what they are talking about, in my humble opinion.
From a defense perspective, each of those artifacts processes, the chain of custody, are all targets for your analysis, validation and verification processes. Ya dig? It's a big carnival, and you have to figure out the best evidence and ammunition, and so does the prosecution.
Wrapping Up
When you are examining your own cases, navigating discovery or reviewing transcripts, you should consider that the same activities should be occurring in your case—assuming everyone has done a thorough job and is disclosing all relevant materials.
You should be able to observe multiple corroborating data points along with a timeline of activities, patterns of life and other pieces of evidence that help to "tighten the knot" using the digital evidence.Â
If you don't see the type of corroborating activity shown by the FBI here, or if the State is only using a single source of information, there are likely further issues to explore and attack.
Happy hunting!
Sources
State v. Allwine, 963 N.W.2d 178 (Minn. 2021). Google Scholar. (link)
"The Alleged Scammers Behind the Most Notorious Murder-for-Hire Site Have Been Arrested". Brian Merchant. VICE. April 7, 2022. Accessed August 28, 2024. (link)
"Nevada Woman Sentenced to 5 Years Prison for Hiring Hitman on Dark Web to Kill Her Ex-Husband". Press Release. United States Attorney's Office - Eastern District of California. June 21, 2023. (link)
"Stephen Allwine Found Guilty Of Wife’s Murder". WCCO - CBS Minnesota. January 31, 2018. Accessed August 28, 2024. (link)
C/W: Suicide & 911 Calls. "Minnesota’s Amy Allwine case: Preacher stages wife’s death". True Crime News. September 16, 2020. Accessed August 28, 2024. (link)
Hit us up if you’re in indigent defense, work for an Innocence Project, or a public defender though!