← AI Defense Attorney

Getting The Recovered Flight Data Into Evidence

:::caution Legal Disclaimer Tyler Robinson is charged, not convicted, and is presumed innocent. Nothing on this page states as fact that any living person committed a crime, destroyed evidence, or acted improperly. Court filings in this case are subject to a gag order and sealing, so the public record is incomplete by design. :::

The One Thing We Would Do Differently

Treat the recovered ADS-B archive as an exhibit that has to be admitted, not as a fact that has been found — and build the Rule 901(b)(9) and Rule 902(13)/(14) foundation for it now, while the archives that produced it still answer.

This site holds 1,831 aircraft-days of primary ADS-B position data on 15 case aircraft — 3,619 trace files, 308 MB, pulled from four independent free archives. That work is documented on Flight Data Recovery. Nobody has to take this site's word for any of it, because every payload sits beside a provenance record naming the exact URL, the HTTP status, the byte count and the UTC time of retrieval.

None of that is evidence yet. A courtroom does not care what a dataset shows until somebody establishes that the dataset is what its proponent says it is. Utah R. Evid. 901(a) states the whole test: the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims. A hard drive full of JSON files clears no part of that on its own.

The good news is that authentication of machine-generated position data is a solved problem with a specific answer, and the answer is three rules deep:

1. Utah R. Evid. 901(b)(9) — evidence about a process or system. Describe the process and show it produces an accurate result. This is the correct primary route for ADS-B, because ADS-B is not a person's statement about where an aircraft was. It is a machine's output, produced by a system, and 901(b)(9) is the subsection written for exactly that.
2. Utah R. Evid. 902(13) — certified records generated by an electronic process or system. A record generated by an electronic process that produces an accurate result becomes self-authenticating on the certification of a qualified person. No live witness required.
3. Utah R. Evid. 902(14) — certified data copied from an electronic device, storage medium or file, authenticated by a process of digital identification. In practice that means a hash value. This is the subsection that turns "we downloaded a file" into a certified copy.

Both 902(13) and 902(14) carry the certification and advance written notice requirements of Rule 902(11). That notice requirement is a feature, not an obstacle: it forces the fight over this data to happen in a pretrial motion, in writing, months before a jury is seated.

What The Defense Team Did Instead

Nothing in the material we hold shows this line being worked, and the honest description of that is narrow. The filing archive holds 374 PDFs against 867 known docket entries, of which 258 ever had a public PDF. A grep of every filing in that archive for ADS-B, flight record, aircraft, tail number and Flightradar returns a single hit, and it is in a congressional oversight transcript rather than a court filing.

What the record does show is a defense team that already uses every mechanism this page needs. On 6 April 2026 the defense filed two notices under Utah Code § 77-17-13 of intent to offer expert testimony — one for Dr. Christine L. Ruva, one for Dr. Bryan Edelman. On 1 April 2026 it served a Notice of Subpoena Duces Tecum, signed by Staci Visser, Kathryn Nester, Michael Burt and Richard Novak. On 8 October 2025 it moved to preserve evidence, and after the State moved to set aside a prematurely entered order, the parties stipulated to the wording that Judge Graf entered on 4 November 2025.

That stipulated order is the single most important document on this page, and its reach is the point:

The court ORDERS the Utah County Attorney's Office, its agents and any law enforcement agencies involved in the investigation of this case, to preserve all evidence in their custody or under their control.

Read the custodians in that sentence. It binds the State and its agents. It does not reach a volunteer ADS-B archive, a commercial flight tracker, the Internet Archive, GitHub, or any fixed-base operator. Those custodians are outside this case entirely, and their retention windows have been rolling the whole time. The filings are gagged and partly sealed, so this is a statement about the material we hold and nothing more.

Where This Belongs In The Case

Stage of the case	When that stage runs	Status of this step
Third-party preservation letters and captures	Available from day one; perishable throughout	Not visible on the public record
Rule 902(11) written notice of self-authenticating records	Pretrial, before any evidentiary hearing that uses the data	Not yet due — no bind-over
Utah Code § 77-17-13 expert notice for an ADS-B witness	Pretrial, after bind-over	Not yet due — no bind-over
Motion in limine and Rule 702 threshold showing	After bind-over, before trial	Still fully open

Witness Or Discovery Target

#	What we would do, and of whom	Route	Reachable?	Status on the record we hold	How we checked
1	Serve a Rule 902(11) notice with a custodian declaration and a per-file hash table, so the traces are self-authenticating under 902(13) and (14) without a live witness	Utah R. Evid. 902(11), (13), (14)	Yes — a paper route	Not yet due; no bind-over has occurred	T2 — no such notice in the 374-PDF archive
2	Notice a qualified ADS-B expert under Utah Code § 77-17-13 to describe the process and system and show it produces an accurate result	Utah R. Evid. 901(b)(9); Utah Code § 77-17-13	Yes — an ordinary retention	Not yet due	T2 — the two § 77-17-13 notices held are Ruva and Edelman, both defense, both on courtroom-publicity questions
3	Subpoena a records custodian at the Internet Archive, San Francisco, to certify the CDX index and the raw captures behind the 42 archived tracking pages	Utah Code § 77-21-3 out-of-state certificate	Yes — a US custodian	Not found in the material we hold	T2 — filing archive searched
4	Subpoena GitHub, Inc. to certify what release assets it served for adsblol/globe_history_2025, and when	Utah Code § 77-21-3	Yes — a US custodian	Not found	T2 — filing archive searched
5	Obtain a certification from the adsb.lol and airplanes.live archive operators describing their receiver, aggregation and daily-write process	Voluntary declaration, or 902(13) certification	Uncertain — volunteer projects with no established Utah or US custodian on this site's material	Not found	T2 — filing archive searched; operator jurisdiction not established here
6	Cross a State witness on whether any aircraft-movement material was collected, and if so where it went	Live cross	Yes	No aircraft witness has appeared in five days of preliminary hearing	T1 — certified Day 4 and Day 5 transcripts searched for flight, aircraft, ADS-B, tail number, airport: zero hits in either
7	Put our own custodian through the voir dire the State already runs on foundation	Live foundation examination	Yes	The State's voir dire practice is on the certified record	T1 — certified Day 4, Karner 27 exchange, searched
8	Offer the control-aircraft directories as part of the same exhibit, not as rebuttal	Utah R. Evid. 901(b)(9)	Yes	CONTROL-RYANAIR holds 914 files and CONTROL-LUFTHANSA 911 in this repository	Direct file count, 1 September 2026

Row 6 is the one to read twice. Across two certified transcripts totalling 16,311 lines, the words flight, aircraft, airplane, ADS-B, tail number and airport do not appear once. Whatever else is true, aircraft movement has not been a subject at this hearing.

Row 7 is the one that shows this is real. On Day 4, when the defense offered Exhibit Karner 27, Deputy County Attorney Ryan McBride asked to voir dire the witness and then argued: "The witness cannot authenticate the exhibit that's been offered, so it should not be received into evidence." Judge Graf admitted it anyway — and said exactly why: "I remind the parties that this is a probable cause finding." That relaxed posture ends at bind-over. A jury trial applies Rule 901 in full, and any exhibit built on citizen-recovered data will meet the objection Mr. McBride already made once, from a prosecutor who has demonstrated he makes it.

The rider, written out

A subpoena that says "all flight records" is quashed as overbroad. Both of the reachable custodians in the table above take a narrow, dated, technically specific rider. These are written to be served, not described.

Rider A — to the records custodian, Internet Archive, San Francisco, California, under Utah Code § 77-21-3:

1. For each URL listed in Schedule 1, the complete CDX index rows held by the
   Wayback Machine, including for each capture: the capture timestamp in UTC,
   the original URL as requested, the HTTP status code recorded at capture,
   the MIME type, the length in bytes, and the content digest.

2. For each capture identified in response to paragraph 1, the raw archived
   response as stored, served through the identity modifier so that no
   rewriting, banner injection or link substitution is applied.

3. A certification under Utah R. Evid. 902(11) and 902(13), executed by a
   person qualified to speak to the process, stating: that the Wayback Machine
   captures and stores responses by an automated process; that the process
   produces an accurate copy of the response received; that the records in
   paragraphs 1 and 2 were made at or near the time of capture by that process;
   and that they are kept in the ordinary course of the archive's activity.

4. A statement of the SHA-256 digest of each file produced under paragraph 2.

Schedule 1 lists, for each of the sixteen aircraft in this matter, the tracking
site URLs and the capture window 1 September 2025 through 31 October 2025.

Rider B — to the records custodian, GitHub, Inc., under Utah Code § 77-21-3:

1. For the repository adsblol/globe_history_2025, for each release tag listed
   in Schedule 2, the release metadata: tag name, creation time in UTC,
   publication time in UTC, and for each release asset the file name, the
   size in bytes, the content type, and the download count.

2. Records sufficient to show whether any release or release asset identified
   in Schedule 2 was edited, replaced, retagged, deleted or made private after
   first publication, and if so on what date.

3. A certification under Utah R. Evid. 902(11) and 902(13) as to the foregoing.

Paragraph 2 of Rider B is the one worth serving on its own. It is the only demand in this exercise that could establish, from a third party's own records rather than from inference, that published flight data was altered after the fact. On the material this site holds it would almost certainly come back negative — and a negative answer, certified, is worth having.

The Questions That Were Not Asked

These are the questions our own custodian and expert have to survive, because they are the questions a competent prosecutor asks. Written to be spoken.

On voir dire of the defense custodian, by the State:

1. You did not operate any of the radio receivers that produced this data, did you?
2. You have never met a single person who contributed a receiver to either of these networks?
3. You do not know the identity of the volunteer whose antenna heard this aircraft on this date?
4. You cannot tell this court whether the file you downloaded is the same file the archive wrote at the end of that UTC day?

On direct of the defense ADS-B expert — the 901(b)(9) showing:

5. Describe the system. Where does the position in this file originate?
6. Is that broadcast encrypted, and who is it addressed to?
7. Since 1 January 2020, is ADS-B Out equipment mandatory in most controlled United States airspace?
8. What is a Mode S hex address, and how does the six-character code 0101d3 connect a stream of radio broadcasts to a specific airframe?
9. Explain multilateration, and say plainly which fixes in this exhibit depend on it and which do not.
10. What is the position accuracy of a fix in this file, and how do you know?
11. Tell the jury what this data cannot show.
12. Does this file, or any file in this exhibit, place any human being aboard that aircraft?

On the integrity of the copy — the 902(14) showing:

13. Take the SU-BTT trace for 10 September 2025. The provenance record says the archive returned 315,232 bytes. What is the size of the file on disk?
14. That file was fetched twice on 24 August 2026 — once at 16:29:36 UTC and again at 17:18:17 UTC, 48 minutes apart. What did the second fetch return?
15. If the second fetch had returned different bytes, would the version-control history show it?
16. The whole tree is committed to a public repository under a content-addressed hash. What does that let a person who distrusts this exhibit do?

On the control discipline — the questions we want asked:

17. Before you characterised any missing record as a removal, what did you do?
18. What is a control aircraft, and why is a Ryanair 737 the right one?
19. Has this methodology ever produced a conclusion you had to withdraw?
20. Tell the jury about that.

Why A Defense Attorney Would Want This

Day-one date: A preservation letter and a capture sweep would have gone out on 15 September 2025 — five days after the event and three days after our attorney's appearance. On that date FlightRadar24's free page still showed the previous seven days for every tail in this case, which covers 10 September 2025 itself. That window closed on about 17 September 2025 and no subscription reconstructs it. What we hold instead is 42 archived captures that exist only because strangers happened to save those pages, and the one sequence that caught the window closing — thirteen captures of a single page that gets 7,239 bytes lighter exactly once, between 13 and 18 September 2025. Everything else from that week is gone, and it is gone for a reason that has nothing to do with anybody in this case.

The strategic case has three parts and they build.

First, this is Route 2 evidence and it does not need a perpetrator. The recovered archive does not have to prove that anybody flew anywhere on anyone's instruction. It has to show a jury that there was a category of contemporaneous, machine-generated, publicly available evidence about this case, that volunteers with no budget recovered 1,831 aircraft-days of it from free archives, and that the investigation the jury is being asked to trust produced no witness who mentions aircraft at all across five days of testimony. A refusal is also an answer, and so is an absence of anyone to ask.

Second, the control discipline is the authentication. This is the argument that matters most, and it is counter-intuitive, so it goes to the jury plainly.

On 24 August 2026 this site published, on a public page, that a tracking site's page for one case aircraft "returns HTTP 403 to the public today" and called it "A REAL REMOVAL, DOCUMENTED." That was wrong. It was retracted, and the retraction is published in full rather than quietly edited away. The site returns 403 to any scripted client — including its own home page — and in a real browser twenty pages loaded, twenty HTTP 200s, identity blocks intact. Five unrelated control aircraft, chosen for irrelevance, had failed in precisely the same way.

Eight apparent removals were tested that way. All eight dissolved. Two of them were this investigation's own tooling: a parser that matched the wrong row shape and reported zero flight rows on 39 records, and a timed-out query logged as an absence. Re-reading files already on disk recovered 153 flight legs. The published tally today is that zero flight records have been shown to be removed from anywhere — which is not the answer this investigation set out to find.

An expert who can say that on the stand is an expert who cannot be broken on cross. An expert who has never tested a finding against a control is destroyed on the first question. A methodology that has publicly corrected itself is more credible than one that has never been tested, and putting the retraction in the exhibit is how you say so before the prosecutor does.

Third, the honest limits are said out loud, more than once. A trace proves presence. It never proves purpose, and it never proves occupancy. No recovered dataset anywhere places any person aboard any aircraft. The recovery work makes this point on its own pages and the exhibit must make it too: 1,113 aircraft entered the 50-mile circle around Orem on 10 September 2025, out of 74,405 in the archive that day. Two of them were Egyptian-registered jets on the ground at Provo — and Duncan Aviation runs a maintenance plant on that field and holds Egyptian Air Force work, which is an ordinary and sufficient reason for them to be sitting there. This data cannot separate those two readings. Say it first, or the State says it for you.

The gateway. None of this becomes relevant to a third-party theory until an alternative-perpetrator defense is actually before the court. That sequence is fixed and it is set out at Alternative-Perpetrator Notice. Serve the notice, obtain the ruling, then offer the exhibit. In the other order it is a fishing expedition and it is excluded in a paragraph.

The Honest Counterargument

The strongest objection is that this exhibit currently fails 902(14) on its own terms. Rule 902(14) authenticates data copied from a file by a process of digital identification — a hash value. This repository holds 25,446 provenance records and, as of 1 September 2026, not one of them contains a hash of the payload it describes. They record the URL, the HTTP status, the byte count and the retrieval time. That is a chain-of-custody record in substance, and it is one field short of the rule.

The answer is available but it is second-best: every file is committed to a public git repository, where objects are addressed by a content hash and carry a commit timestamp, so an integrity record does exist. It is SHA-1 rather than SHA-256, it was created for version control rather than for evidence, and a competent prosecutor will say both of those things. The fix is trivial — write a SHA-256 into each provenance record and publish the table — and it should be done before anybody relies on this in a filing.

The second objection is more serious and it has no fix. This exhibit relies on an archive assembled by anonymous volunteers. There is no employee to depose about the receiver in a particular back garden, no calibration record, no maintenance log, and — on the material this site holds — no established custodian in a jurisdiction a Utah subpoena reaches. Rule 902(13) needs a certification by a qualified person, and if no such person will sign one, the self-authenticating route closes and the data has to come in the hard way under 901(b)(9) through an expert who did not build the system.

The third is the reason a real defense team might be right to leave this alone entirely. A capital defense that is winning on an inconclusive ATF comparison and a DNA mixture has a coherent, conventional, jury-legible case. Adding Egyptian aircraft to it risks trading a defense the jury already understands for one it may find outlandish — and the State would be entitled to point out that this site's own aircraft work has now retracted eight of its own headline findings. Every one of those retractions is a cross-examination question, and a lawyer who has read them may reasonably conclude that the exhibit costs more credibility than it buys. Delay is not neglect, and declining a theory is not missing it.

Sources On This Site

• Flight Data Recovery — what was erased, what was not
• What A 403 Actually Means — the control test and the retraction
• Per-Aircraft Recovery Status
• Overlap Recovery — the 85 claims checked against primary data
• Deleted Flight Records — the tally
• The Volunteer Network — how ADS-B actually works
• Public Open-Source Flight Data — the archives and their URL shapes
• The Four Data-Source Passes
• SU-BTT and SU-BND
• SU-BTT at Provo, 10 September 2025
• SU-BND at Provo, 10 September 2025
• Provo Municipal Airport (KPVU)
• Erika Kirk Flight Logs — the absence no backup restores
• Egyptian Jets At Provo
• Alternative-Perpetrator Notice — the gateway
• FBI Agents On The Stand
• Brady Enforcement And Sanctions
• Preliminary Hearing Day 4 and Day 5
• Bind-Over Argument, 1 September 2026

---

:::danger Theoretical Exercise Only This page is a theoretical exercise. It is a written simulation of how an idealised defense attorney might approach this case. We make no claim that there is any problem with the current defense attorney, with any member of the defense team, or with any decision they have made.

Real capital defense is conducted under a gag order, with sealed filings, and on the basis of full discovery that the public has never seen. Counsel of record know facts we do not. A step described here as "not on the public record" may already have been taken privately, may have been considered and rejected for good reason, or may not yet be due at this stage of the case. Silence in the public record is not evidence of a failure.

Nothing here is legal advice, a criticism of any licensed attorney, or an allegation of professional misconduct. :::

This website's author is @HolonCitizen on X and YouTube/@HolonCitizen. Follow me there.