Defendant’s browser usage cited during Han family murder trial
Pierre Haobsh is arraigned May 5, 2016. He was arrested March 25, 2016, for the murder of Chinese herbalist Dr. Weidong “Henry” Han, 57; wife, Huijie “Jennie” Yu, 29; and 5-year-old daughter, Emily Han.
Browser history extracted from Pierre Haobsh’s iPhone and laptop was used to gain insight into the defendant’s mindset on the days surrounding the Han family murders.
The web history was discussed Monday during the murder trial in Santa Barbara County Superior Court.
Prior to Dr. Han’s death, the user of Mr. Haobsh’s phone searched the web for various firearm-related information. A search inquired the amount of damage a .22-caliber pistol could cause to a skull. (Dr. Weidong “Henry” Han, his wife and daughter were killed by gunshot wounds to their heads.)
One Google search asked: “What caliber used by James Bond.” Then the user searched “navy seal .22lr.”
Webpages for a Ruger MKII and M77 were accessed, including a page dedicated to movies in which a Ruger MKII has appeared.
On March 23, 2016, the day detectives believe the Han family was murdered, the user’s interest seems to shift from firearms to bank accounts.
“How long does domestic transfer take to post,” the first Google search asked. Then the user visited a Wells Fargo page for a lost username or password — a web page Mr. Haobsh’s laptop accessed 18 minutes later.
Two wire transfers were initiated from Dr. Han’s Chase Bank account to Mr. Haobsh’s that afternoon. Jeff Ellis, an investigator with the Santa Barbara County District Attorney’s office, testified that spyware allowed Mr. Haobsh to break into Dr. Han’s online bank account.
Dr. Han’s computer contained a spyware program that stores screenshots of webpages and data of the user’s keyboard clicks. The program was installed March 21 and was hidden from the computer’s desktop. Detectives found the computer in the garage of the Han home, next to the family’s bodies.
Mr. Haobsh’s laptop had the same program — installed an hour before Dr. Han’s computer. The screenshots and data collected by the program showed investigators a page-by-page breakdown of the actions of an individual possessing Mr. Haobsh’s laptop.
On March 22, Mr. Haobsh allegedly texted Dr. Han that he would like to file “the company registration” online together.
At around 1 p.m. that day, Dr. Han filled out a form for LLC incorporation on his computer. The form included spaces for his Social Security and credit card numbers.
There is a photo on Mr. Haobsh’s phone, taken at 1:14 p.m. from the Han residence, of a computer screen with the spyware software open to the key log. The photo captured the information entered during the LLC filing.
Screenshots captured by the spyware on Mr. Haobsh’s computer show the user attempting to log into Dr. Han’s Chase Bank account and using Dr. Han’s cell phone to obtain a recovery code.
Once inside the account, the laptop’s user moved $70,000 in savings over to the checking account and initiated a $100,000 transfer from Dr. Han’s linked Wells Fargo account.
A recipient was added under the name “Pierre” (no last name) with an address in Santa Monica. The user searched Santa Monica zip codes.
Then the person opened a new window and logged into Mr. Haobsh’s bank account — which contained less than $500. The routing information was entered into the wire transfer information.
The user attempted to transfer $72,000 from Dr. Han to Mr. Haobsh. The transaction was stopped by the bank.
Mr. Haobsh’s phone was used to search the internet for the speed of wire transfers.
The laptop was used to enroll in Chase QuickPay. The user initially attempted to use an email that begins with “pierreh” for QuickPay, but the email was in use by another user.
The user created a Gmail account under Dr. Han’s name with a similar username to Dr. Han’s other emails to tie to the QuickPay enrollment.
With QuickPay set up, the laptop’s user attempted to transfer $70,000, but with a QuickPay maximum of $5,000, ultimately sent $5,000 to Mr. Haobsh.
Chase Fraud sent a text to Dr. Han to verify the transaction.
Dr. Han’s SIM card was placed in Mr. Haobsh’s phone to send a confirmation text back to the bank, Mr. Ellis testified, using the phone’s cellular usage database and cell phone records.
Prosecutors tie the defendant to these actions through video evidence of Mr. Haobsh driving through a McDonald’s in Thousand Oaks at around 1 p.m. that day. A receipt from McDonald’s was also obtained from the defendant’s car.
The spyware captured evidence that while the laptop was being used to transfer money at 12:30 p.m., the laptop was near a McDonald’s wifi hotspot. Mr. Ellis said the defendant’s phone was connected to a cell-phone tower near the McDonald’s in Thousand Oaks during this time.
Prosecutors also have evidence of Mr. Haobsh at El Capitan State Beach on March 22 — when his phone was used at that location to search James Bond’s pistol of choice and watch a video of a suppressor. (Detectives believe a suppressor was used in the murder of Emily Han.)
At 1:39 p.m. March 23, the laptop is used to access an online psychic network where someone who says their name is “Pierre” pays to talk with Count Marco.
“Can you tell me about my destiny and the events to come?” asked the user. “Can you also look at my karma?”
The user types “I have done bad things,” the spyware shows, but the user deletes the line and sends “I have made bad choices” instead. The person types “unforgivable” before deleting the word.
“I learned so much,” The user said. “But it cost other people greatly.”
He later asks, “Will I get caught for what I did?”
Count Marco replies, “I have no idea what you did, Pierre.”
The evening of March 23, Mr. Haobsh sends to a business associate, “Am screwed. They just found everything.” (He told detectives in an interview someone found an invention of his in a storage unit but couldn’t give details about the storage unit’s location.)
On March 24, his laptop and phone history began with the search “Santa Barbara news Henry.” The user visited a page titled “Santa Barbara News-Press obituaries.”
Then the individual searched, “how good are finger print forensics” and “finger prints on plastic.” A Yahoo Answers page asking “Can the police scan your fingerprints off of a plastic bag?” was visited.
The user gets specific: “fingerprints on painters plastic,” was typed into Google. The Han family was found wrapped in painter’s plastic sheeting.
Then the user searches: “how long do finger prints take to process,” “how long does crime scene analysis take” and “is car searched entering tijuana.”
Mr. Haobsh was arrested March 25, 2016, with a bag of supplies in his car.
Mr. Ellis is the last witness the prosecution plans to call. Mr. Haobsh’s public defenders will cross examine Mr. Ellis when the trial resumes Thursday, and they will begin to call their witnesses.
It is not yet determined if Mr. Haobsh will take the stand.
email: ahanshaw@newspress.com
