Merritt's defense team points to alternate suspect in McStay killings

The defense team for Charles "Chase" Merritt spent two days of testimony with computer forensic analyst Bryan Charles La Rock to build a case that would implicate former business associate Daniel Kavanaugh as a possible alternate suspect in the murders of a Fallbrook family in 2010.

Merritt is accused of killing the McStay family, Joseph, Summer and their two young boys who lived in the Lake Rancho Viejo housing development east of Interstate 15 in Fallbrook.

The McStay family was last seen alive Feb. 4, 2010, and relatives reported them missing a few days later. Then, in November 2013, the skeletal remains of the four family members were discovered in shallow graves by a motorcyclist in the Mojave Desert. Records show that all four were beaten to death, most likely with a sledgehammer owned by Joseph McStay.

Prosecutors maintain that greed was the basis for Merritt committing the murders and have stated they will be seeking the death penalty in the case.

Defense attorneys have said that investigators zeroed in on Merritt early on the case and never looked at anyone else, including Kavanaugh, who they said had threatened the family due to his dissatisfaction with being bought out of the company by McStay.

Annette Bron from QuickBooks was called to the stand Tuesday, April 16, to testify about correspondences between the financial management software company and Joseph McStay and account administrators.

On cross-examination, the prosecution questioned Bron about her interviews with Detective Duvall.

"The only reason that you got involved was because Detective Duvall called asking an employee questions and the employee receiving the call wasn't comfortable answering those questions, right?" the prosecution asked.

"Correct," Bron answered.

"You indicated that you never went into the actual activity logs for the account, right?" the prosecution asked.

"I don't remember going into the activity logs," Bron answered.

"So, you don't recall if you looked at the actual custom side of the account to determine if someone had written checks and then deleted them, right?" the state asked.

"I wouldn't go into that," Bron replied.

Sarah Kane from PayPal Holdings was called to the stand by the defense, to testify about the account activity for Dan Kavanaugh, a person the defense team has offered as an alternative suspect in the McStays' murders.

Kavanaugh is said to have shown detectives his PayPal account activity statements as an alibi that indicated he was in Hawaii from Jan. 7 to Feb. 27, 2010, during the time period in which the McStays were killed.

"Do you see any activity here that gives any indication that someone else, or somebody changed the password or something to get into the account?" the defense asked.

"There is a password reset," Kane replied.

"When was that?" the defense asked.

"Ummm, Feb. 10th," Kane said.

The defense pointed out that the activity log indicated a "user reset password" action on the log. The defense ventured into the IP address locations of the activity on those logs attempting to establish that Kavanaugh may have given his card to someone so they could use it in Hawaii.

"These records don't tell us who is holding that card and going to the ATM, does it?" the defense asked.

"No," Kane said.

The defense then La Rock to the stand to discredit the investigators' findings on the McStays' computers.

"You sat in the audience when Detective Schrader testified for the prosecution, is that correct?" the defense asked.

"That's right," La Rock answered.

"Was there a difference in what he did and testified about and what you did in the examination of these two devices?" the defense asked.

"From what I read in his testimony and from what I saw from the reports that he was provided, yes, there was a difference," La Rock said. "Detective Schrader's testimony, as well as the reports, indicated to me that he had used a tool called (inaudible) to locate internet history in particular on both of these two devices. To export that internet history for a specific time period, I believe, near the disappearance, near the murder. And to then give that history to the investigating officers.

"What I did involved much more than just internet history for that time period, I looked at the history for a much, much broader period. I also looked at other items of evidence, emails, documents, etc. Other forms of user activity," La Rock said.

La Rock also reviewed Joseph McStay's phone records, and he used them to compare the time frames against computer activity.

He said during the hours of 4 p.m. and 5 p.m., a user on the computer was using a Google designing product called SketchUp.

"It looks like the user is traveling toward the Fallbrook house," La Rock said over an objection from the prosecution. "We see Ontario, followed by Norco, followed by Fallbrook. Then working on design information, so SketchUp is a design program, looking at house information, design information ..."

The remainder of his statement was granted an objection from the prosecution by the judge.

"Was there internet activity after 5 p.m. that you thought was significant?" the defense asked.

"There was additional internet activity around the hour of 8 p.m.," La Rock said. "This is a period during which a user on the computer logged on to QuickBooks Online and activity there."

La Rock pointed toward computer activity that included writing a check to Merritt for $4,000. He testified that, in his opinion that check was never printed.

La Rock returned for more testimony for the defense Wednesday, April 17, and discussed text messages between McStay and Merritt including one Jan. 3, 2010, where McStay wished Merritt a happy new year.

During a break, the defense team presented evidence of what they called a "buy out" of Kavanaugh including an email with the subject line "Dan $$$" and an attachment "dan_payoff.xls," a spreadsheet dated April 29, 2009.

"Dan Kavanaugh is broke at the time the family disappears," the defense team argued. "Our theory is that desperation that Kavanaugh is in, which was evidenced by, of course, that threatening (instant message) where Dan is wanting to be bought out, which started these payments, is a continuation of the behavior, the aggressive behavior, the threatening behavior that Dan Kavanaugh was displaying toward Joseph."

They presented searches from Kavanaugh's computer that they said pertained to his alleged involvement in the case and asked that judge reconsider his earlier decision excluding the threatening instant message and the judge ultimately decided he wouldn't reconsider.

During the prosecution's cross-examination of La Rock, the state attacked the credibility of his testimony and questioned whether the witness had complete records of what he was examining.

On his second day of testimony, the prosecution showed La Rock an email McStay sent to Merritt Feb. 1, 2010 that read that McStay had overpaid Merritt $42,845.

"You would agree that it's important to provide context to those spreadsheets you found, right?" the state asked.

"Yes, absolutely," La Rock responded. "This email adds information that adds meaning and gives context to the information on the spreadsheet."

"But in your forensic examination from the computers, you missed this one?" the prosecution asked.

"No, I did not miss it," La Rock said. "This email is not on the computer; this email is going to be in Joseph's Yahoo email account which is stored on the internet. That particular email was not stored on the computer."

"But as an investigator to be thorough and complete, this would have been helpful, right?" the prosecution asked.

During redirect, La Rock discussed whether or not Kavanaugh would have used a VPN to log on to the internet during his visit to Hawaii and varying IP address locations that show in both Hawaii and San Diego.

La Rock and the defense team implied that they considered the IP stamps bouncing back and forth between Hilo, Hawaii, and San Diego to be suspicious.

The defense team was expected to continue to present its case Monday, April 22, after press time.

Jeff Pack can be contacted at [email protected].