In Craigslist slaying, Internet was also suspect’s undoing

Internet forensic expert Mark Rasch used high-tech sleuthing to help police in Boston's Craigslist crimes.
They were crimes born of the Internet age — romantic solicitations on popular Web site Craigslist that police say led to the fatal shooting of one woman and the robbery of another in Boston hotels this past spring.

And it was high-tech, 21st-century sleuthing, along with some old-fashioned gumshoe detective work, that put police on the trail toward a suspect and eventually an arrest. CNN’s Randi Kaye recently took a behind-the-scenes look at how technology was used to lead police to 23-year-old medical student Philip Markoff, who has been indicted on seven counts, including first-degree murder. Prosecutors said Julissa Brisman, a model from New York who advertised as a masseuse on Craigslist, was shot three times at close range and suffered blunt head trauma at the Marriott Copley Place hotel on April 14. And a 29-year-old Las Vegas, Nevada, woman was robbed of $800 in cash and $250 in American Express gift cards at the Westin Copley Place hotel, police reports said. Investigators knew they had crimes born of the Internet on their hands, but how were they able to use that same technology to help them find a suspect who went to great lengths to hide his tracks “The figures involved communicated with each other [via] text and e-mail, and they only met at the very last minute,” said special correspondent Maureen Orth, who investigated the story for Vanity Fair magazine. “And then the way the police were able to solve the crime was going back, using the clicks and the Internet addresses.”

Don’t Miss
Craigslist suspect pleads not guilty

Markoff indicted

Mother of Craigslist victim ‘devastated’

In Brisman’s case, police knew she had communicated on Craigslist with a person calling himself “Andy.” Mark Rasch once headed the computer crimes unit at the U.S. Department of Justice. Now an Internet forensic expert, he helped Boston police track the alleged killer. “The first thing you start with was the e-mail address. In this case, it’s an e-mail address from, which is Microsoft,” Rasch explained to CNN’s Kaye. Watch Randi Kaye’s full report Rasch showed Kaye the tracer program he used to help follow the e-mails from “Andy.” “Trace Back does what it says — traces the route that the e-mail took on its way from its origin to the destination,” Rasch said. Rasch says police got the Internet protocol address for the e-mailer’s computer. From there, investigators tracked down the company providing Internet service to the suspect, which told them that the subscriber lived in a Quincy apartment building, outside Boston. Even though police had what they believed was the killer’s real name and home address, that still was not enough, Kaye reports. “They have to validate and actually get this guy’s fingers on the keyboard,” Rasch said. “So in the end, they reverted to the old gumshoe thing of a stakeout.” Police zeroed in on Markoff. They’d seen a tall, blond male they believed was the killer on the hotel surveillance cameras. And they did what many people do on a daily basis — they Googled him. Police learned their prime suspect was a medical student at Boston University. He was engaged to be married. Again, the Internet helped. They got a better look at him through pictures with his fiancee online. It’s a piece of a digital trail criminals rarely think about, Kaye reported. “As one of the law enforcement people told me, if you can see it, they can see it,” Orth said. Markoff’s cyber footprint was growing more clear to authorities every day. On April 20, six days after Brisman’s slaying, detectives arrested him.

They said he was carrying on him a New York driver’s license with a photo of someone named Andrew or Andy Miller. Police say Markoff used that driver’s license to purchase the gun that killed Brisman and that his fingerprints were on the paperwork. In June, Markoff pleaded not guilty to Brisman’s death and the other charges against him. He remains in jail.