CHAPTER 14
When Detective Brown interviewed Katie again on August 7, this time her lawyer, Chris Kottke, was present. They discussed the upcoming garage sale Jake had mentioned, and the one or more golf clubs that Carol may have had at the house.
“I believe my dad had said that he had given her either her golf clubs or one of his because he didn’t need them anymore,” she said. “I thought that he had given her one, but I personally didn’t know that.”
“You never saw it or anything?”
“ No.”
Brown explained that they could not find any such club at the house. They were trying to figure out what had become of it and what brand it was. But Katie didn’t know.
Katie expressed concerns about Jim Knapp being such an odd duck, that he’d been allowed back into the house before the detectives had finished collecting evidence, and that he was spreading strange stories about her mom and dad that she’d never even heard before.
“It made me sad, because at one point, I really did feel he was a nice, normal guy that was just my mom’s friend out at the property,” she said. “The word around town had always been that he had a crush on my mom. That’s totally fine if people are, you know, normal about it.”
But, she went on, Jim had been leaving bizarre messages on her phone, “where he sounds, like, drunk. . . . He sent one e-mail that was, like, ‘You know I’m sure your dad is screening your e-mails, that’s why I can’t get through,’ and I’m, like, ‘My dad’s not screening my e-mails.’ And we heard that he was talking to the neighbors and making the neighbors say things, like, ‘Everyone knows that Steve beat Carol when she was pregnant.’ We didn’t even live [at] that house when my mom was pregnant.”
In a small town gossip travels fast, so it was sometimes difficult to discern the source and veracity of these stories. They carried more weight when they came directly from Carol’s own mouth.
As Detective Brown interviewed Carol’s friends in the weeks after the murder, he heard several accounts that she’d been scared of Steve and feared for her personal safety.
Don Wood, who had known both Carol and Steve, reported that she’d called and e-mailed him that “she was in fear for her life,” although she never described a specific incident where Steve did her any physical harm. Don added that he and Carol didn’t have the kind of relationship where she would confide that sort of thing to him, although she did request that if anything happened to her, Don should look into it. He told Brown that “Steven had hacked into Carol’s e-mails and read some of the correspondence.” When Brown confronted Steve about this claim, Steve said Carol had “duped” Don into believing that she needed to fear her estranged husband.
Andrea Flanagan, a former student who had done some house- and pet-sitting for Carol, and had taken care of the girls over the years, told Brown that Carol had complained recently that Steve had broken into her house one night.
She freaked out on him and told him that it was totally inappropriate since he had been out of the house for such a long time, Brown wrote. Steven had apparently bought Carol some Thai food when he came over. He just broke in and actually startled her. Carol said that she was very angered by it and it had really scared her. . . . Flanagan could not recall how specifically he broke in, but thought it had been through a window.
Several weeks after Andrea’s first interview with Brown, she followed up with another recollection that echoed Don Wood’s, about Carol’s claim that Steve had hacked into her e-mail account and read her messages.
Carol had been very upset that he was doing this, Brown wrote. Shortly after this was happening, Carol’s computer crashed. Andrea said Carol thought Steve was getting through the windows she’d left open and the doors she’d left unlocked.
Such stories only bolstered investigators’ suspicions that Steve was their killer.
In turn, Steve’s fears of arrest grew as investigators seemed to be focusing on him as their primary suspect. Not surprisingly, this created a “very, very tense environment” at the condo, as Charlotte later testified.
Charlotte was not only deeply grieving her mother’s murder, but she also felt a constant trepidation about the ongoing investigation into her father. “It felt awful,” she said, noting that their home environment “was sad and stressed and anxious, pretty much constantly.”
After detectives seized Steve’s cell phone on July 3, he gave Charlotte his credit card to buy some “pay-as-you-go” phones at Walmart—the kind where users can pay for calls by the month or a certain number of minutes rather than entering a long-term contract. The GoPhones also can’t be traced or monitored by law enforcement.
Spurred by his fears, Steve developed a plan to flee to a destination far, far away. But because the detectives had also seized his passport, he had to apply for a new one. He wasted no time, submitting the request on July 11.
Investigators later learned that he had lied on the application. In the space asking for details of the loss or theft of his previous passport, Steve wrote: Don’t know for certain. It is simply missing from my file at home and we cannot find it. The U.S. State Department issued him a new passport on July 16.
On July 25, which would have been Carol’s fifty-fourth birthday, Steve asked Charlotte to buy him a handheld GPS global device from REI while she and Jake were in Phoenix to pick up her cousin at the airport. The cousin was flying in for Carol’s private memorial service, but ended up missing Charlotte and taking a shuttle to Prescott because of a miscommunication.
As Charlotte and Jake were returning home from Phoenix that night at eight-fifteen, they got into the rollover accident she mentioned at the service the next day. They were driving in Carol’s Acura MDX on northbound Interstate 17 when they suddenly came up on a bucket that had fallen into the road. A truck, hauling something and traveling behind another car, swerved into their lane to avoid the bucket and almost sideswiped the Acura. Charlotte swerved into the dirt median to avoid the car, causing the Acura to skid and spin around, cross two lanes, crash into the opposite shoulder and roll over. The car was totaled. Jake ended up with a torn ligament in his shoulder; Charlotte suffered a minor concussion and some scrapes. Steve later managed to collect $22,000 from Carol’s insurance company for the totaled Acura, even though it was deemed her property during the divorce and was part of her estate.
As part of his escape plan, Steve also bought a motorcycle on August 2, and loaded several locked metal suitcases, designed to fit the bike, with all kinds of provisions. Those locked cases, which he stored at Katie’s apartment in Scottsdale, contained a DVD of Mexico street maps, $15,000 in cash, and a large waterproof “dry bag,” containing beef jerky, energy bars, a loaded handgun and two loaded magazines. He gave one of the GoPhones to Katie, who was working full-time on the Obama campaign for college credit at the time.
“To be quite honest, I think I put that phone in a sock drawer and tried not to think about it,” Katie testified later.
Meanwhile, Charlotte and Jake discussed her ongoing concerns that Steve was going to leave town and disappear. Steve had even given her a code word—“raspberry”—to warn him that the police had come to the condo, looking for him.
Charlotte also expressed her fears in her journal. In one entry, dated August 16, she wrote, My dad’s considering running. If he gets caught I’ll never get to hug him again. She wrote that she didn’t want to live with Katie in Los Angeles and finish her high-school education there, because she couldn’t leave Jake.
As investigators searched through Steve’s computers and Internet browser history, they found some suspicious and incriminating activities.
On February 7, 2008, Steve had installed a computer program known as the Anonymizer, which, when engaged, hides Internet searches so they can’t be traced, and masks a user’s IP address by sending it through an encrypted secure tunnel between the user’s computer and a proxy server. The program can also make the user anonymous. Anyone trying to track the user by his IP address will be directed back to the proxy.
Other functions allow the user to try to remove any traces of his computer activities from the operating system by deleting temporary files, tracking of websites he has visited, along with cookies, cached files and browser history.
Steve reinstalled the program on March 30. Independently, Steve also had his computer’s browser history set at zero days, meaning that it wasn’t supposed to keep any record of his browsing activity.
Steve may not have known, however, that the program doesn’t permanently delete these files, it only clears a space that can be overwritten if needed. Or that the program doesn’t stop the user’s computer from keeping an Internet search history. Or that when the program “deletes” the history, it isn’t a “secure” deletion, because that information isn’t removed from the hard drive.
So, despite all of Steve’s security measures, Paul Lindvay, a detective with the Arizona Department of Public Safety’s Computer Forensic Unit, was still able to find a partial record of Steve’s Internet browsing history.
Assisted by Detective Brown, Lindvay ran a series of keywords through a copy of Steve’s hard drive—suicide, homicide, insurance, hitman, invisible, fugitive, disappear and books.Google.com—where he found a number of Steve’s Google searches, contained in his daily browsing logs.
In between playing around on Facebook on June 1, three days after the divorce was finalized, five of Steve’s searches and the websites he visited caught investigators’ attention.
Around noon that day, he searched for payment of life insurance benefits in the case of homicide, then did a handful of similar searches between seven and seven-thirty that night: tips from a hitman on how to kill someone, how to stage a suicide, how to kill and make it look like suicide and how to make a homicide appear suicide.
Lindvay also found a folder on Steve’s computer titled, “Book Research,” which was created on December 23, 2007, at 6:28 P.M., and contained eighteen files. The last time a file in that folder was written or changed before the murder was May 10, 2008. Only one file was changed in the days after the murder, on July 5. Many of them were accessed on June 1, 2008, the same date as the Google searches, but no changes were made, which could simply indicate the computer did a virus search.
In that folder was a diagram that showed a homicide in a back room with some furniture tipped over, which, as prosecutors would later point out, was “strikingly similar to the office that Carol Kennedy was found in.”
Later, at trial, an Anonymizer executive testified that Steve’s account—using the username “jamiebob44” and linked to his Gmail account—was accessed on June 30, July 1 and July 2, 2008, and was not used again until August 17.
Lindvay testified that one of the links took Steve to a page for a book titled Practical Homicide Investigation, from which he viewed a page depicting a staged crime scene, then made it a cached file.
Steve’s computer also showed searches for motorcycle gear and equipment on June 1, and that he accessed a site called Writing-World.com, at 7:21 P.M., right after searching for the hit man tips and staging a suicide, and right before his search for making a homicide appear like a suicide.
Although the defense later described Writing-World.com as a site for mystery-novel writers, the site would be more accurately described as one for amateur writers and authors of any genre who are interested in getting started. The site features various links for career tips aimed at aspiring freelance writers, ads for hiring editors and consultants, as well as articles on grammar and how to write and self-publish books.
The defense also noted that Steve also had a book on his shelf that was titled, No Plot? No Problem. A Low-Stress, High-Velocity Guide to Writing a Novel in 30 Days.
When Lindvay acknowledged that some of Steve’s computer searches went to adult websites with pornographic material, the defense tried to suggest that Steve had his browser-history setting on zero because he was viewing porn while his sixteen-year-old daughter was also living in the house.
But the bottom line was that investigators never found any actual writings by Steve—no short stories, no chapters or any partial drafts of any mystery novel.
A series of Steve’s computer searches and actions concerning carbon monoxide gas and suicide raised another red flag, especially when compounded with the other incriminating searches, which prosecutors later deemed “probative of premeditation.”
In March 2008, he searched for use of carbon monoxide in suicide and a business plant safety plan. Carbon monoxide is known as “the silent killer,” because people have been found dead in their homes from undetected leaks in gas ranges and heating systems that have emitted this odorless, colorless and poisonous gas.
Steve’s phone records also showed that on March 3 and 14 he called the chemical company Matheson Tri-Gas, which sells gas in bulk and delivers liquid gas to customers by truck. That same month he obtained a federal employer identification number (EIN), a prerequisite to purchase carbon monoxide.
In his “Book Research” folder, Steve stored paperwork related to these searches, including Web pages and his EIN confirmation. He also kept spec sheets from another gas distributor called Praxair, listing its Phoenix area locations, its various cylinder sizes and information for a gas safety plan. Additionally, he kept spec sheets and forms for carbon monoxide and dichlorobenzene, halocarbon 14 and C318, different gas cylinder sizes and portable compressed gas canisters.
On May 7, he filed a partially completed Matheson delivery form in the folder, listing himself as the customer, Dr. Steven C. DeMocker, doing business as DBD Research & Consulting at his Alpine Meadows address. If this was not part of an aborted scheme to murder Carol, it is unclear what other use this carbon monoxide research may have had to Steve. He did not pursue this series of tasks any further after he was told that he had to submit a detailed gas storage plan for inspection before the gas could be delivered to his home.
Meanwhile, Steve continued to engage in other behavior that caught the authorities’ attention, namely that he had received a delivery of four books with titles of a concerning nature at his UBS office that summer.
Under industry standards, financial advisors like Steve aren’t supposed to open their own mail. In this case a coworker did it for him, and knowing that his ex-wife had just died, the coworker found the titles odd, if not suspicious.
Following up on the purchase, investigators found that the books had been bought from a secured wireless connection titled “Cheryl123,” an address assigned to a woman between July 10 and August 20, the day of the purchase. This woman, who lived in Phoenix, and part-time in a home on Country Club Drive in Prescott, was a friend of Renee Girard, Steve’s girlfriend.
It turned out that Steve, with Renee’s help, had rented this house from her friend Cheryl Hatzopoulos as a place for his family to stay when they came to visit or as a “stay-cation” home.
The titles were: How to Be Invisible: The Essential Guide to Protecting Your Personal Privacy, Your Assets, and Your Life; Cover Your Tracks Without Changing Your Identity: How to Disappear Until You WANT to be Found; The International Fugitive: Secrets of Clandestine Travel Overseas and Advanced Fugitive: Running, Hiding, Surviving and Thriving Forever.
Concerning indeed.
On August 20, the same day that these books were purchased, Steve also submitted his first death benefits claim to Hartford Insurance Company, trying to collect on Carol’s two life insurance policies for which he’d been paying for years. He provided a blank check to Hartford so the money—a total payout of $770,492 for the combined policies—could be transferred to his personal account at Bank of America.
But every time he tried, Hartford denied his claims, citing the fact that he was a murder suspect in his ex-wife’s death. Hartford denied five such claims—on August 27, October 1, November 21 and December 16, 2008, and January 15, 2009.
In the first denial letter on August 27, from claims analyst Debbie Dettman, she told him that Hartford couldn’t release the proceeds until he was cleared of involvement in Carol’s death.
Steve e-mailed a response on September 3, copying his attorney, John Sears, asking how to disclaim the death benefits and to allow his daughters to collect on them, referring the matter to Sears and his daughters’ attorney.
I am trying to determine if there is a way to disclaim the proceeds to our daughters, or failing that, to determine the most tax-efficient way of gifting the money to them for their sole benefit, he wrote.
As investigators continued to build their case against Steve, they put together a timeline of his activities on the day of the murder based on forensic evidence they had collected, including his e-mails, text messages, phone records and the times his remote control was used to open the gate to his condo complex:
Steve started his day at 6:32 A.M. by texting Renee, whom he usually met for coffee in the morning.
At 6:47 a.m., he logged on to his UBS computer. A satellite office of the Phoenix location, the Prescott site had only a few employees, including Steve, John Farmer and a secretary.
At 7:11 A.M., Steve called Renee, then called Carol at home at 7:41 A.M., and got her voice mail.
At 7:59 A.M., Steve sent his first text to Carol about picking up Katie’s car.
Steve and Renee texted about meeting for coffee until 9:27 A.M., when someone, most likely Steve, used his gate code to enter his complex.
Around 10 A.M., Steve picked up Renee and took her to Wild Iris, a café they frequented together. As usual, he picked her up in his BMW, only this time, his bike was in the backseat, with the front wheel taken off to fit.
Steve volunteered that he was planning to go for a ride after work. But in all the time they’d been together, she’d never seen him put the bike in the car, nor had he ever mentioned going for a bike ride. Given that he lived so close to his office, and headed home to change into workout clothes after work anyway, why didn’t he wait to put his bike into the car after work? Because, investigators figured, Steve was setting his alibi in motion.
After Steve dropped off Renee at ten forty-five that morning, the detectives couldn’t determine what he did for the next few hours. However, forensics showed that he began texting Carol again at 1:42 P.M. about Katie’s car and exchanging checks.
Steve received a text from Charlotte at three twenty-eight that afternoon—the last time he used the cell phone before turning it off—saying she was on her way to bring him some cookies.
At 3:34 P.M., Steve sent an e-mail to Jennifer Rydzew-ski, who was filling in for his assistant in the Phoenix office, asking if she would mind closing his and Carol’s joint bank account: And then setting it on fire and burying it? Thanks!
Jennifer didn’t read the message until she came into work the next morning, at which time she was informed of Carol’s death. She printed out the e-mail and immediately turned it over to her manager. The account had a zero balance.
In early September, detectives sprayed the Bluestar blood-revealing agent on Steve’s clothing, his bicycle, its tires and rims, along with various other accessories they’d seized. They also obtained a search warrant allowing them to get back into his BMW and spray it as well. But after doing so, they found no traces of blood anywhere in the car. (The reddish brown substance in Katie’s car turned out to be chocolate.)
Brown checked to see if they could determine through the BMW’s navigational device in Steve’s car where he’d been that night, but was told that the system didn’t store GPS points.
Although they were gearing up to arrest Steve, investigators still had not found the murder weapon or any DNA linking him to the crime scene. They knew that Steve was a wily, smart and cunning man, so they kept investigating him and his background, hoping for that “aha” moment.