Randi Kaye | Bio
Good old-fashioned police work and a self-proclaimed digital detective may be why the prime suspect in April’s Craigslist crime spree may be behind bars. Twenty-three-year-old Philip Markoff, a second year medical student at Boston University, is charged with murder, attempted robbery, kidnapping, robbery, and unlawful possession of a firearm. He has pleaded not guilty.
Markoff was arrested while driving in his car with his fiancé. The engagement has since been cancelled. The arrest took place April 20, six days after the murder of Julissa Brisman, who had advertised as a masseuse on the popular online classifieds website, Craigslist. Authorities say Markoff targeted women like Brisman and set a trap for them in Boston hotel rooms.
CNN has obtained the email communication police say took place between Markoff and Brisman the day before her murder. In the emails, Markoff allegedly used the name “Andy” and Brisman went by “Morgan.”
The first email was allegedly sent by Markoff at 4:37p.m. on April 13. It reads, “"I Myself am visiting Boston and looking for a 10pm or later appointment tonight or tomorrow…” A later email said, “I can still make it tonight but .. tomorrow at ten would be better for me.. thanks, Andy.” Brisman's employer wrote "Andy" back on her behalf, saying “I could do it tomorrow night or we can do 10:30 or 11 tonight…” She signed it, “Kisses, Morgan.” Then, another allegedly from the killer at 7:30pm that same night: “Hey Morgan, 10pm tomorrow is best for me. Thank you, Andy.”
Markoff, police say, is a predator who went to great lengths to hide his tracks. But as careful as he was, police say even before his first attack he was leaving a trail that would lead right back to him.
The man investigators believe is Markoff, and also the killer, was seen on the hotels’ surveillance cameras walking calmly, emailing or texting, around the time of the murder of Julissa Brisman. Brisman was found bleeding to death in her hotel room. She’d been shot three times at close range. On her wrist, police say they found a plastic tie they later matched to similar ties used in the other hotel attack. According to police, the woman who survived that attack said it was Markoff who bound her hands with plastic ties, duct-taped her mouth, disabled her cellphone, and stole $800 and two pairs of her panties before leaving her hotel room at the Westin Copley Hotel in Boston’s upscale Back Bay.
CNN interviewed Mark Rasch, the former head of the computer crimes unit at the U.S. Department of Justice. Rasch is now an internet forensics expert with Secure IT Experts who helped Boston police track the alleged killer via his online communication.
“The first thing you start with is the email address,” said Rasch. “In this case, it's an email address from Live.com, which is Microsoft.” Rasch showed CNN he used a tracer program to follow the alleged killer’s emails. “A trace route does exactly what it says: traces the route that the email took, on its way from its origin, to its destination,” he said.
According to Rasch, police got the Internet Protocol address for the emailer's computer. From there, investigators tracked down the company providing internet service to the suspect, which told them the subscriber lived outside Boston, in a Quincy, Massachusetts apartment building.
But even though police had what they believed was the killer's name and home address it still wasn't enough information because so many people lived in the building and shared a wireless computer connection. That meant anyone within range could have been sending those emails. “They have to validate and actually get this guy’s fingers on the keyboard, and show that it was him, and not somebody else who sent that email,” Rasch said.
Maureen Orth investigated the case for Vanity Fair magazine. She said what fascinated her about the story was that, “we have no privacy, every time you’re on the internet somebody knows where you are.”
Orth told CNN, “In the end, (authorities) reverted to the old gumshoe thing of a stakeout.”
Police zeroed in on Philip Markoff because they’d seen a tall blonde male they believed was the killer on the hotel's surveillance cameras– walking calmly – emailing or texting. And they did what most people do on a daily basis, they "Googled" him.
That’s when police learned their "prime suspect" was a medical student at Boston University and engaged to be married. They got a better look at him through pictures with his fiance online, a piece of a digital trail our expert says criminals rarely think about. “Lots of times, people, before they commit a crime, and they want to have an email address, they’ll just log onto Hotmail, or, or Google, and get a, an email address, use it for a couple of days, and then never use it again. And they think they’re being safe. What this shows is, first of all, even if you just created the account, there’s still a record that you’ve created the account,” Rasch told CNN.
The alleged killer's cyber footprint was growing clearer to authorities every day.
Finally, on April 20, six days after Julissa Brisman was murdered, authorities moved in and arrested Markoff. According to police, he had with him a New York driver’s license with a photo of someone named Andrew, or “Andy”, Miller. They say he used that license to buy the gun that killed Brisman and that his fingerprints were on the paperwork used to buy it.
Markoff’s attorney, John Salsberg, would not comment for our story.
Anderson Cooper goes beyond the headlines to tell stories from many points of view, so you can make up your own mind about the news. Tune in weeknights at 8 and 10 ET on CNN.
Questions or comments? Send an email
Want to know more? Go behind the scenes with