← AI Defense Attorney

T7 — Handsets Registered On A Foreign Carrier Were Present On Campus

:::caution Legal Disclaimer Tyler Robinson is charged, not convicted, and is presumed innocent. Nothing on this page states as fact that any living person committed a crime, destroyed evidence, or acted improperly. Court filings in this case are subject to a gag order and sealing, so the public record is incomplete by design. :::

What We Contend

This is a contention this exercise would attempt to prove. It is not a finding this site asserts, and nothing below identifies any person or attributes any handset to anybody.

Handsets purchased and registered on a foreign carrier were present on the UVU campus on September 10, 2025 — and whether that is true is answerable today, from records the State already holds, by a question narrow enough that a court would grant it: what was collected, what was analysed, and what happened to the difference.

The thesis has two halves and they must never be argued together. The first half is a records audit. A reverse-location warrant was issued in this case, served on three national carriers, and returned. The discovery corpus contains at least 25,253 cell-site location records. Nobody reads 25,253 records. A human being, or a filter written by a human being, decided which subset mattered — and that decision is an artefact, with an author, a date and a stated basis. Demanding it is ordinary Rule 16 and Brady practice, available right now, and it needs no theory about who killed Charlie Kirk.

The second half is attribution — any argument that a particular device belonged to a foreign actor, or that a foreign service was involved. That half is gated. It cannot be argued until the court has granted leave for an alternative-perpetrator defense, and the sequence is set out at the gateway instrument. Run in the wrong order, the reachable half is dismissed alongside the unreachable half in a single paragraph.

There is a reason to lead with the records audit rather than with the allegation, and it is not timidity. The audit is the half that a judge can grant on a Tuesday morning. It touches no classified holding. It asks no agency to waive anything. It requires no finding about who killed Charlie Kirk, and it survives even if every public claim about foreign handsets turns out to be wrong — because the question it asks is about the State's own process, not about anybody's phone.

The pressure point is already visible on the face of the record. Utah R. Crim. P. 40 requires the officer executing a warrant to swear a true and detailed account of the property taken. The account sworn on this warrant is eight words long, and it covers a production from three national carriers spanning four locations and two separate days. Eight words is not an inventory anyone can audit. It is not possible to tell from it how many records arrived, in what format, covering what interval, or whether any of it still exists. That single document is where the motion starts, because the deficiency is on its face and no witness is needed to establish it.

One detail on the face of that warrant deserves its own sentence, because it is the sort of thing that only shows up when somebody reads the document rather than the summary. The warrant lists four target locations. Three are on 10 September 2025, in the hour around the killing. The fourth is the same Losee Building on 8 September 2025, from 20:10 to 20:25 — two days before, at night, for fifteen minutes. The nine-page probable-cause narrative describes 10 September and never mentions 8 September at all. Something put that window in front of a magistrate and the document does not say what. That is a question, not an accusation, and it is exactly the kind of question a Franks motion exists to ask.

Then there is the technical fact that converts this thesis from unreachable to reachable, and it is the closing argument of this page rather than a footnote. The defense does not need a foreign carrier's records. Roaming works by putting a visiting device onto the host network. A handset with a foreign SIM operating in Orem attaches to a T-Mobile, AT&T or Verizon tower, and the host network writes that attachment into its own register, including the device's IMSI. The first three digits of an IMSI are the Mobile Country Code and they name the home network. So the presence question is answerable entirely from domestic material the State obtained in September 2025, with no treaty, no foreign court, and no unmasking of any subscriber.

The Chain Of Reasoning

Each link is a fact this site or the primary record already holds. The chain ends in the contention, and nowhere in it does a person appear.

1. A reverse-location warrant was actually issued and served in this case. Search Warrant 3212941, sworn 11 September 2025 by Detective Michael George Carle of the Utah County Sheriff's Office and signed by Magistrate Kraig Powell, commanded T-Mobile, AT&T and Verizon to produce a cellular tower dump for four target locations, each a 1,900-foot radius. It sits in the legal documents archive.
2. The State told the magistrate what it was for. The affidavit says the records would "assist law enforcement in identifying persons present near the suspect's location before, during and after the time of the homicide." The State asked a judge for this dataset in order to identify other people who were there.
3. The warrant demanded the exact fields this thesis turns on. It required "registration/connection records, the IMSI and IMEI of the number associated with the cell site(s)," plus "any available HSS (Home Subscriber Server), HLR (Home Local Registry), VLR (Visitor Local Registry) records showing subscriber equipment that was idle but still connected." The Visitor Location Register is, by definition, the register of devices whose home network is somewhere else.
4. It returned data, and the return describes it in eight words. The Return to Search Warrant 3212941, executed 9 October 2025 at 08:28, reads in full: "Tower Dump data from all three carriers." Utah R. Crim. P. 40 requires a true and detailed account of the property taken. There is no record count, no date range, no file manifest and no hash.
5. The only other reverse-location route returned nothing. The companion Google geofence warrant, 3212601, came back on 23 September 2025 with "No data was stored by Google LLC." That leaves the carrier tower dump as the sole reverse-location dataset in the case.
6. The corpus is far larger than any investigation reads. The defense's own Discovery Status Report of 28 August 2026 records 45 productions, 29,237 files, six mobile extractions totalling roughly 2,915,822 artifacts, a Discord return of over 1,000,000 communications, and carrier returns containing "at least 25,253 location records."
7. So a filter ran, and the State wrote one down in advance. The Google warrant's Production Protocol directs at stage three that "law enforcement shall review the Anonymized List to remove device IDs that are not relevant to the investigation," and at stage four permits going back for coordinates outside the original search parameters. That is a filter, a second collection tier, and an unmasking decision, all specified before any data arrived.
8. The certified record already proves this class of decision exists in this case. On cross-examination on Day 4 of the preliminary hearing, Sergeant Jennifer Faumuina was asked whether she decided to "pull the plug" on analysis of items sent to the FBI laboratory. She answered that at the time the items were sent, "we didn't have more information as far as whether or not the evidence that were collected there were probative," and agreed it would be fair to say she eventually determined those items were not related to the case. A State witness made a relevance call that stopped laboratory analysis. That is the collection-versus-analysis decision, on the certified record, for physical evidence.
9. Device data in this case passed through a filter applied by a person who has never been called. On the same certified day, Agent Brian Davis described the pipeline: the FBI transported a phone to the Regional Computer Forensic Laboratory in Salt Lake City, Cellebrite performed the download, a flash drive went to the State Bureau of Investigation, and the data then went to an analyst at the Statewide Information Analysis Center — a Department of Public Safety fusion centre — "to go through that data of his phone to look for any pertinent evidence or information that may be on there." See Forensic Phone Extraction and Lance Twiggs' Phone.
10. The public claim this thesis answers is a claim, and this site says so. Counts of 12, 16 and 44 foreign-registered handsets circulate publicly and are catalogued here as unverified: Foreign Phones at UVU, Sixteen Israeli-Registered Phones at UVU, Israeli Phones and Bumblehive, and the Chinese, Russian and Iranian breakdown. No dataset, no methodology and no vendor has been published. The count itself drifts across three values.
11. A second identifier-generating device is alleged to have been on campus that day. Open-source commentary claims an IMSI catcher was operating at the event — see Stingray Device at UVU. An IMSI catcher produces a bulk identifier log independent of any carrier. Whether one existed is answerable in one word by whoever would know.
12. A second, different warrant track exists and must not be confused with the first. Alongside the reverse-location warrants, the held set contains targeted per-number location warrants served on Verizon in mid-September 2025 — among them 3214341, 3214411 and 3214731, covering two telephone numbers. Those answer a different question. Reverse-location material asks who was there. Per-number material asks where one known device went. Only the first can ever be exculpatory about an unidentified presence, and only the first has never been described in any inventory we hold.
13. Roaming physics makes the question domestic. A visiting handset cannot be served by a network that has not first identified it, so the host network writes the visitor into its own register. The Mobile Country Code that opens an IMSI names the home network: 310 through 316 is the United States, 425 is Israel, 460 is China, 250 is Russia, 432 is Iran. A count by Mobile Country Code identifies nobody.
14. Therefore: whether devices on foreign home networks were present on campus on 10 September 2025 is a question the State can already answer from material in its possession — and the record does not show anyone being asked to run that sort, or being asked what happened to everything the filter discarded.

The Day-One Track

Our attorney has been counsel of record since 12 September 2025 — see the day-one track for the full calendar. Everything in this family is perishable, because carrier roaming and visitor-register records are among the shortest-lived data any network holds. The affiant said so himself: the affidavit of 11 September 2025 warned the magistrate that this class of record "is also subject to deletion from the service providers within a very short time period."

When	What our attorney serves	What was still recoverable then	When that window closed
This is where the counterfactual bites hardest, and it is worth being precise about why. Nothing in this thesis needed a clever motion in September 2025. It needed a letter and a two-page request, served while the data still existed. Every row below is ordinary practice; the only scarce resource was the calendar.

Two things about this calendar matter more than the individual rows. The first is that a preservation letter is not a motion — it needs no court, no filing fee and no opponent's consent, and it converts an ordinary business record-retention decision into a documented one. The second is that a defendant cannot send the statutory version. 18 U.S.C. § 2703(f) gives that power to a governmental entity, so the day-one act is a motion asking the court to direct the State to send them. That motion is cheap and very hard for a prosecutor to oppose out loud, because the State has its own interest in the same records surviving.

| 2025-09-12 | Motion for an order directing the State to send 18 U.S.C. § 2703(f) preservation requests to T-Mobile, AT&T and Verizon, covering the full un-narrowed datasets for each location rather than the four windows the warrant selected. A defendant cannot send one; the State can, and can hardly oppose it out loud | Everything the carriers held beyond the four warrant windows, including the control-window baseline | Carrier retention. The return was not executed until 9 October 2025, and the court's preservation order did not arrive until 4 November 2025 — and it reaches only material in the State's custody or control, which carrier records never produced are not | | 2025-09-15 | Rule 16 demand for the collection inventory and analysis log for every reverse-location warrant: carrier, warrant number, coordinates, radius, window requested, window served, delivery date, file names, row counts, hashes | The logs were being generated in that fortnight. Memory of who tasked what was days old | Does not close as a document. Closes as testimony — witnesses forget tasking within months | | 2025-09-15 | Demand that the IMSI field be preserved unaltered, plus a written statement of who performed the anonymisation required on the face of the warrant, when, and whether the pre-anonymisation copy still exists | The carriers still held pre-anonymisation copies | Carrier retention. Probably weeks | | 2025-09-17 | Demand for a control-window tower dump — the same towers, the same radii, an ordinary day with no event | The control is the only thing that makes a foreign-network count mean anything | Same carrier retention as the event windows. Closed | | 2025-09-20 | Records demand to the university and the event organiser for any IMSI-catcher, distributed-antenna or campus Wi-Fi association logs for 10 September 2025 | Wi-Fi association logs and any device-identifier capture log | Campus systems commonly retain 30 to 90 days. Closed | | 2025-09-30 | Motion to compel a detailed Rule 40 return on warrant 3212941 in place of the eight-word inventory | The people who executed it could still reconstruct it accurately | Still open — this one has not closed | | 2025-10-06 | Demand for the disposition of the non-responsive remainder, plus a litigation hold on it | Everything the filter discarded, before any retention schedule reached it | Retention schedules run while a case is litigated. Records nobody designated as responsive go first |

The honest accounting on the closed rows is that the control window is the loss that hurts most. A foreign-network count without a base rate is unusable, and the base rate had to be pulled from the same towers on an ordinary day while the carriers still held it. That is the one item on the list nobody can reconstruct later at any price, and it is the item least likely to occur to anyone in the first fortnight of a capital case.

The Gap Analysis

Read the right-hand column first. It says what our material shows, never what any lawyer did. T1 means a certified transcript covers that witness on that day and we searched it. T2 means we searched the filing archive, which holds 374 PDFs against 867 known docket entries. T3 and T4 mean the question cannot be answered from anything we hold, and a stage not yet reached has not been missed by anybody.

The rows are ordered by how load-bearing they are, not chronologically. The first three are the only ones where a certified transcript can support a real answer, and one of them comes back Partly — which is the most useful row on the page.

#	What we would do, and of whom	Stage and date	Witness took the stand?	Asked on the record we hold?	How we checked
1	"Sergeant, you told this court you eventually determined that items sent to the FBI laboratory were not related to this case. Who made that same kind of call about the carrier location records?" — to Jennifer Faumuina	Preliminary hearing cross, 9 July 2026	Yes — 7 and 9 July 2026	Partly. The analysis-stop decision was put to her directly, for physical evidence. No location-data version of it appears	T1 — certified Day 4, searched. The "pull the plug" exchange is at Day 4 pages 143–144
2	"Agent, you said a fusion-centre analyst went through that data to look for any pertinent evidence. Who defined pertinent, and was that definition written down before the review started?" — to Brian Davis	Preliminary hearing, 9 July 2026	Yes — 8 and 9 July 2026	Not found. The certified record shows the witness passed with no cross-examination	T1 — certified Day 4, searched. "No cross-examination for Agent Davis" appears in the transcript
3	"Sergeant, you authored several reports in the master binder and reviewed the rest. Is any one of them a report about the carrier tower-dump return?" — to Jennifer Faumuina	Preliminary hearing cross, 9 July 2026	Yes	Not found. Her report-authorship was covered on cross; no tower-dump report was identified	T1 — certified Day 4, searched
4	"Is there a written log of every query run against the tower-dump records, and a written list of the selectors used?" — to whoever the State designates to sponsor location evidence	Rule 16 and trial foundation; available now	n/a	Not found	T1 — both certified days searched for tower, cell site, CSLI, carrier, Verizon, AT&T, T-Mobile, IMSI, IMEI, roaming, geofence, subscriber. Zero occurrences of every one
5	"Was anyone asked to sort the returned identifiers by Mobile Country Code — to separate devices whose home network is outside the United States?" — to the State's location-evidence witness	Rule 16 and cross; available now	n/a	Not found	T1 for the two certified days — zero network terms of any kind. Days 1–3 are uncertified and nothing is claimed about them
6	Rule 16 motion to compel the collection inventory and analysis log for warrant 3212941 — served on the Utah County Attorney's Office	Motion to compel; live right now	n/a	Not found in the material we hold	T2 — the archive holds 374 PDFs against 867 known docket entries, 258 of which ever had a public PDF
7	Court order directing the State to produce, from returns it already possesses, a count by Mobile Country Code of distinct IMSI values for each of the four warrant locations and windows	Rule 16; available now, identifies nobody	n/a	Not found in the material we hold	T2 — no such request appears in the archive
8	The same count for a control window at the same towers on a date with no event, sufficient to establish a base rate	Rule 16; available now	n/a	Not found in the material we hold	T2 — no control-window demand appears in the archive
9	"Detective, your return says 'Tower Dump data from all three carriers.' Rule 40 requires a detailed account of the property taken. Where is the inventory?" — to the affiant on warrant 3212941	Suppression and Rule 40 practice; not yet due — no bind-over has occurred	No — no warrant affiant has testified in the certified record we hold	Not yet due	T2 — the warrant and its return are both held in the archive and were read in full
10	"Warrant 3212941 demanded VLR records — the register a network writes when a device from another home network attaches to it. Did any return include that register?" — to the affiant or a carrier custodian	Rule 16, then trial foundation; not yet due for a custodian	No	Not found	T2 — the warrant text is held; the return is eight words
11	"The face of that warrant required anonymization of all devices. Who performed it, the carrier or the State — and does anonymizing remove the Mobile Country Code, or only the subscriber's name and number?"	Rule 16 and any motion to unmask; available now	No	Not found	T2 — the anonymisation notice is printed on the warrant we hold
12	"Location 4 on that warrant is 8 September 2025, 20:10 to 20:25, at the Losee Building — two days early, at night, for fifteen minutes. The nine-page affidavit never mentions 8 September. What put that window in front of the magistrate?"	Franks and suppression practice; not yet due	No	Not found	T2 — the affidavit was read end to end; 8 September appears in the target list and nowhere in the narrative
13	"That warrant states the Location 1 window as 11:40 to 12:55 in one paragraph and 11:40 to 12:30 in another. Which was actually run, and against which record set?"	Suppression and foundation; not yet due	No	Not found	T2 — both paragraphs are in the held warrant
14	"Was any request for records directed to a carrier outside the United States in this investigation — by whom, on what date, and what was the response, including a refusal?" — to the State	Rule 16; available now	n/a	Not found	T2 — the archive holds no filing seeking foreign-carrier records, an MLAT request, or letters rogatory
15	Records demand to the university and the event organiser for any IMSI-catcher, distributed-antenna or Wi-Fi association logs covering the campus on 10 September 2025	Institutional subpoena and GRAMA; reachable today	n/a	Not found	T3 — the device allegation is open-source only. See Stingray Device at UVU
16	"Has any part of the non-responsive remainder been purged, and under what retention schedule?" — to the State and to each carrier	Rule 16 and spoliation practice; available now	n/a	Not found	T2 — the 4 November 2025 stipulated order reaches material in the State's custody or control, not records a carrier never produced
17	Production of the native tower-dump files under the existing protective order, so a defense analyst can derive the Mobile Country Code count directly	Governed by the 15 October 2025 Order For Discovery Protection	n/a	Not checkable	T4 — the discovery corpus will never be filed. Confirmed gaps item L
18	Motion in limine under Utah R. Evid. 1006 requiring production of the originals behind any mapped or summarised location exhibit the State offers	Motions in limine; not yet due — the case has not been bound over	n/a	Not yet due	T4 — a stage not reached. A step not yet due has not been missed
19	"Was any cellular location record in this case obtained without a warrant — for example on an exigent-circumstances request to a carrier — and if so, where is the record of that request?" — to the State	Rule 16 and suppression; available now	n/a	Not found	T2 — the held warrant set runs 3212261 to 3229461 with a 19-day, roughly 12,000-number gap and nothing at all after 6 October 2025
20	Demand for the State's Utah Code § 77-17-13 expert notice for any witness who would sponsor mapped or summarised location evidence at trial	Expert notice; not yet due for trial	n/a	Not yet due	T2 — a grep of all 867 docket rows for expert returns two hits, both defense. No State expert notice appears anywhere on the public docket

Where this chain breaks the State's case

The link this thesis attacks is not identity and it is not the rifle. It is the completeness of the investigative picture the jury will be shown. The State swore to a magistrate that it wanted this dataset in order to identify who else was present; it obtained the dataset; and the public record contains no description of what was done with it. If material tending to show an unidentified device at the relevant place at the relevant time exists and was filtered out, that is exculpatory on its face under Brady v. Maryland and Kyles v. Whitley, because it is inconsistent with the sole-actor account the State has pleaded — and the obligation attaches whether or not anyone thought to look.

And the reverse is just as damaging to the State. A filter that never ran cannot have found nothing. Nothing in the material we hold shows the question "who else was in that radius" being put to the dataset the State swore it needed in order to ask exactly that. Until the analysis log says otherwise, the sole-actor conclusion rests on a dataset that was acquired to test it and may never have been queried.

What would defeat this thesis

Production of the warrant 3212941 returns with the IMSI field intact, plus a count by Mobile Country Code across all four windows, showing the foreign-home-network share at or below the share in a control window at the same towers on an ordinary day. That single result ends this thesis. It is cheap, it is derivable in an afternoon by anyone holding the native files, it identifies no person, and it may already have been run. If it comes back flat against a control, this page says so on its face and the thesis is closed.

It is written that way on purpose. A falsification test that requires a classified holding, a foreign court or a treaty is not a test at all — it is a way of never being wrong. This one can be run by the State this month, from files it already possesses, and the defense would learn the answer at the same moment the prosecution did.

The instruments that serve this thesis

• File The Alternative-Perpetrator Notice First — GATEWAY. Nothing in the attribution half of this thesis may be argued before this is filed and ruled on.
• Cell-Site And Tower-Dump Discovery — the reachable demand. The collection inventory, the analysis log, the filter criteria, the disposition of the remainder.
• Foreign Carrier Records And MLAT — the unreachable route, written out so a reader stops asking for it, and the subpoena rider that replaces it.
• Order An Independent Re-Extraction Of The Devices — the device-side companion to the network-side demand.

Two of those four are new pages written for this thesis, and the division of labour between them is deliberate. The tower-dump instrument carries the demand that a court would grant. The MLAT instrument carries the demand a court would refuse, written out in full so that a reader who wants the foreign-carrier records understands why that door is shut and where the open one is. This thesis page is the argument the two of them serve, and it never duplicates their bodies.

How This Reaches A Juror

This page serves Route 2 — the investigation itself. It needs no alternative perpetrator, no foreign service, and no theory about the mechanism of death. It needs only the gap between what was collected and what was examined.

This is deliberately not Route 1. Route 1 is the mechanism argument — if the fatal wound was not caused by a rifle round, the identity of the person the State alleges was on the roof stops mattering. That is the shortest route and it is carried by thesis T1. This page does something narrower and more durable: it goes at the reliability of the investigation, and it holds up even for a juror who accepts every word of the State's account of the mechanism.

The reason it holds up is that the State chose this ground itself. It did not stumble into a tower dump. It went to a magistrate the day after the killing and swore that it needed these records in order to identify who else was present. Having said that to obtain the dataset, it cannot now describe the dataset as irrelevant to a defense asking the same question. That is the sentence counsel builds the closing around.

"The State went to a judge on the day after Charlie Kirk was killed and asked for the phone records of everybody who was near that courtyard. It said, in writing, that it wanted to know who else was there. It got the records. Twenty-five thousand of them. And in five days of testimony nobody told you what they did with them — who looked, what they searched for, what they threw away, or whether any of it still exists. You are not being asked to trust the evidence. You are being asked to trust a filter you have never seen, written by somebody you have never met, applied to records nobody has counted. That is not proof beyond a reasonable doubt. That is a process you cannot inspect."

A juror does not have to believe any of the public foreign-handset claims to be moved by that. The claims are not what the argument rests on. The argument rests on the difference between a dataset the State swore it needed and a courtroom record that never mentions it. That gap is the State's to close, and closing it is easy — which is precisely why leaving it open is worth pointing at.

What Would Have To Be Obtained

The separation below is the working part of this page. Keep the two columns apart in every filing and every sentence, because the reachable half survives on its own and dies if it is argued in the same breath as the unreachable half.

REACHABLE — available today, no gateway, no agency waiver. Each of these concerns records the State already possesses or that a private party holds, and a court finds them easy to grant.

• The collection inventory for every reverse-location warrant: carrier, warrant number, coordinates, radius, window requested, window served, delivery date, file names and formats, row count per file, hash per file.
• The analysis log: which records were loaded into which platform, by whom, on what date, under what task number.
• The tool, the version, and the literal query strings and selectors as run — not a description of them.
• The exclusion criteria, the instruction they came from, and the device identifiers removed at the anonymised-list stage before any subscriber was identified.
• Every analyst report generated from this material, including superseded drafts and the versions that superseded them.
• The disposition of the non-responsive remainder: retained, sequestered, purged or returned, and under what schedule.
• A count by Mobile Country Code of distinct IMSI values per location and window, and the same count for a control window. This is the demand that answers the thesis, and it identifies nobody.
• A detailed Rule 40 return replacing the eight-word inventory on warrant 3212941.
• Whether any request went to a non-United States carrier, by whom, when, and what came back — including a refusal.
• Institutional records from the university and the event organiser on any IMSI-catcher, distributed-antenna or Wi-Fi association logging on campus that day. A private-party and public-records demand, reachable by subpoena or GRAMA.

A compliant answer to the reachable list is not a letter saying "we produced everything." It is a table. For each production: the carrier, the warrant number, the target coordinates and radius, the window requested, the window actually served, the delivery date, the file names and formats as received, the row count per file, and a hash per file as delivered. For each analysis pass: the platform and version, the operator, the date, the query as run, the result count, and the report identifier. None of that is exotic, and if it was never recorded, that answer is itself the finding.

GATED — behind the alternative-perpetrator notice. Subscriber identity behind any particular device identifier. Any argument that a device belonged to a foreign actor. Any foreign-carrier subscriber record sought through a treaty channel.

UNREACHABLE — do not spend the court's patience here. A Utah trial court's process does not reach a telecom incorporated abroad. A criminal defendant cannot compel a Mutual Legal Assistance Treaty request; that is an executive act made through the Department of Justice Office of International Affairs, and most treaties say expressly that they create no privately enforceable rights. Letters rogatory are available in principle under 28 U.S.C. § 1781 but routinely take a year or more and may be declined. Any classified holding of a signals-intelligence agency is outside a state criminal case entirely — the Bumblehive material discussed publicly around this case is not evidence a defense lawyer can reach, and should never be promised to a client.

Being blunt about that boundary is part of the method here. A page that lets a reader believe a defense lawyer can subpoena a signals agency, or force the executive branch to open a treaty channel, is selling a courtroom that does not exist. What a defense can do with the unreachable half is serve the demand, docket the refusal, and use the refusal itself: a dated record of what was sought, who declined, and on what stated ground. In a case where exactly one federal witness has testified live across five days of preliminary hearing — a laboratory examiner, called by the defense — a documented refusal is not nothing. It is evidence that the picture the jury will be shown was assembled by people the defense could not question.

The Honest Counterargument

There are nine answers to this page and the first three are strong enough that a reader should weigh them before accepting anything above.

The published counts are not evidence, and a defense that adopts them is borrowing someone else's arithmetic in a capital case. The figures of 12, 16 and 44 trace to a single open-source analyst and a single anonymous administration tip. No dataset, no vendor, no geofence radius and no methodology has been released, and the analyst's own graphic was labelled a recreation. The count does not hold still: eleven in some retellings, twelve in another, sixteen in a third. A number that drifts across three values while the story around it stays fixed is a number being retold rather than measured. This site catalogues those claims as claims and this page adopts none of them.

A foreign Mobile Country Code proves nothing about anybody, and without a control it means nothing at all. Utah Valley University hosts a Center for National Security Studies, one of the largest such programmes in the region, and draws exactly the international enrolment that puts foreign SIMs on campus every ordinary day. A public political event at midday draws visitors, journalists, exchange scholars and tourists. A 1,900-foot radius on a public campus captures students, staff and people driving past. A foreign-network count with no denominator is the single most misusable figure in this entire investigation, and a defense that puts it before a jury without the control count is handing the prosecution a cross-examination it will enjoy. It is also worth saying plainly: the same claimed dataset reports Chinese, Russian and Iranian devices in comparable numbers, and nobody suggests those were assassins. The selection is being made by the narrative, not by the data.

The anonymisation order may already have defeated the method. The face of warrant 3212941 requires "the anonymization of all devices associated with the reverse-location information." If the carriers complied by removing or tokenising the IMSI, the Mobile Country Code goes with it, and the whole pivot collapses into a motion to unmask that a court may well refuse — on privacy grounds that exist to protect the students and members of the public swept into that radius. That notice is not an obstacle a judge invented to frustrate this defense. It is the reason the demand above asks for a count and not for identities.

A tower dump cannot do what people think it does. Cell sites are commonly half a mile or more apart and the affidavit says so. Tower-dump data can place a device in a sector. It cannot place a device on a rooftop, in a courtyard, or in anyone's hand. Oversell it and the State's own witness will correct the record in front of the jury.

Most of this may be happening privately and better. The 28 August 2026 Discovery Status Report is a defense filing, and it is the document that put the 25,253 figure on the record in the first place. It shows a team holding the 12.1 TB drive, a paralegal averaging 100 hours a month since October 2025, provider returns at Stage One of a five-stage review, and a motion to compel forensic discovery the FBI and ATF have declined to provide in preparation, with a briefing schedule to be requested on 1 September 2026. A demand for an analysis log is an obvious item on any capital discovery request, and the September 2025 Rule 16 request that would contain it is not a document the public archive holds. Concluding it was not made because we cannot see it is exactly the error this section exists to avoid.

Declining to cross a foundation witness is orthodox capital practice, not an oversight. At a Utah preliminary hearing, where the standard is probable cause and Rule 1102 permits hearsay, cross-examining a conduit witness mostly teaches the State where its foundation is thin, in time to fix it before trial. Saving it is a real tactic and many experienced capital lawyers would make the same call.

The vendor-nationality argument is the weakest thing anyone could attach to this thesis, and it should be left alone. Cellebrite is an Israeli-headquartered firm and its UFED product is standard law-enforcement equipment worldwide. That fact is catalogued on this site at Israeli Technology Inside the Investigation, and the decisive counterweight is recorded there too: the defense is not challenging the extraction, and the party best placed to expose a fabrication holds the full images. A separate open question — that a State filing said it did not intend to offer forensic-extraction evidence while an agent testified to relying on a Cellebrite extraction — is real and is catalogued at the extraction contradiction, but both statements can be true at different procedural stages. Neither point strengthens a network-side records demand, and stapling them to it invites the whole thesis to be dismissed as atmosphere.

The ranking argument is real, and it cuts against filing this first. The same judicial goodwill spent on a location-data audit would buy an explosive-residue panel, an independent autopsy review, or a Rule 702 hearing on the toolmark comparison — each of which goes at the mechanism of death rather than at the population of a courtyard. Those are shorter routes to an acquittal. A defense attorney who serves this thesis before those has misread the room. The right answer is that the records audit is cheap enough and early enough to run alongside them, not instead of them, and that the perishable half of it had to be served in September 2025 or not at all.

And a negative result is a real risk. If the returns arrived with IMSI intact, an analyst sorting by Mobile Country Code is an afternoon's work, and a fusion centre holding the file has every reason to have done it. A demand that produces a flat result, in a case whose defense theory has been publicly associated with a foreign-nexus claim, hands the prosecution a clean rebuttal exhibit. That risk should be weighed before the demand is served, not after — and it is the reason the falsification test above is written as sharply as it is.

Sources On This Site

• Cell-Site And Tower-Dump Discovery — the reachable instrument
• Foreign Carrier Records And MLAT — the unreachable route, written out
• File The Alternative-Perpetrator Notice First — the gateway
• Order An Independent Re-Extraction Of The Devices
• Brady Enforcement And Sanctions
• Putting FBI Agents On The Stand
• The Day-One Track · Two Tracks Compared · Method
• Foreign Phones at UVU
• Sixteen Israeli-Registered Phones at UVU
• Israeli Phones and Bumblehive
• Chinese, Russian and Iranian Presence Claims
• NSA Cellphones and Bumblehive · The counterweight page
• Israelis Present at UVU
• Stingray Device at UVU
• Cell Tower, Phone Data and Movement Timeline
• Forensic Phone Extraction · Robinson's Phone and Devices · Lance Twiggs' Phone · Cellebrite
• The Cellebrite Extraction Contradiction
• Israeli Technology Inside the Investigation
• Technology and Surveillance
• Proof Intel Services · FBI Intel Cover Signatures
• The NSA · The NCTC · Joe Kent and the Halted Foreign Inquiry
• Discovery and Brady Disputes · Gag Orders and Sealing
• Legal Documents Archive
• Preliminary Hearing · Day 4 · Day 5
• Bind-Over Oral Argument, 1 September 2026
• Score Card — where you decide, area by area

---

:::danger Theoretical Exercise Only This page is a theoretical exercise. It is a written simulation of how an idealised defense attorney might approach this case. We make no claim that there is any problem with the current defense attorney, with any member of the defense team, or with any decision they have made.

Real capital defense is conducted under a gag order, with sealed filings, and on the basis of full discovery that the public has never seen. Counsel of record know facts we do not. A step described here as "not on the public record" may already have been taken privately, may have been considered and rejected for good reason, or may not yet be due at this stage of the case. Silence in the public record is not evidence of a failure.

Nothing here is legal advice, a criticism of any licensed attorney, or an allegation of professional misconduct. :::

This website's author is @HolonCitizen on X and YouTube/@HolonCitizen. Follow me there.