In 2011, romance writer Nancy Crampton Brophy published an essay titled: “How to Murder Your Husband.” Eleven years later, Crampton Brophy made international headlines when she was convicted of that very crime.
The investigation into Crampton Brophy wasn’t an open-and-close case. Much of the evidence pointed to her murdering her husband at the cooking school where he taught, but police were missing one crucial piece: the murder weapon. The Portland Police Bureau recovered a gun from Crampton Brophy’s home and even though it was a Glock 17 like the murder weapon, the ballistics didn’t match. But they had a theory to explain that: Crampton Brophy, they thought, switched out the slide and barrel from her gun to murder her husband and then switched them back to conceal the murder weapon. A photo of her Glock 17 showed the slide and barrel weren’t properly seated. They suspected the evidence they needed to prove their theory was on her laptops.
Former Portland Police Bureau Officer Aaron Sparling led the digital investigation into Crampton Brophy’s laptops. We sat down with him to discuss how he used digital evidence to trace Crampton Brophy’s activity in the months leading up to her husband’s murder.
Q: This case drew quite a lot of international attention because of the essay Crampton Brophy published before she murdered her husband. There’s already a TV movie about the murder. Was the actual digital investigation as unique?
Sparling: “What made this case unique to me is that everything, for the most part, is all Internet-based. It’s all search history. A lot of cases nowadays are built on peoples’ communications, their location histories or photographs. That’s how a lot of cases are solved in law enforcement. This case wasn’t built around photographs and text messages, it was built [entirely] around Internet evidence.
When you’re dealing with Internet evidence, unless it’s the downloads you’re looking for, it’s more like you’re searching for a pattern of life. It’s what is the user doing in that browser that shows a particular behavior relevant to the crime being investigated vs. here’s a photo of subject one holding a murder weapon .”
Q: After the detectives approached you for your help, how did you begin the digital investigation?
Sparling: “There were three computers I analyzed [with a digital investigation platform called Magnet AXIOM, developed by Magnet Forensics].
[The detectives] were looking for anything that had to do with firearms and murder. In this case, I preprocessed the evidence with a keyword list: ‘handgun,’ ‘gun’ ‘glock’ and ‘murder.’ As the evidence was processing, Magnet AXIOM was flagging on those particular items.
There was only one [laptop] that was of major interest and ended up providing most of the data.”
Q: What did the results tell you about Crampton Brophy’s activity leading up to the murder?
Sparling: “There were a couple of things that were of interest to the investigators. Internet browser searches showed this individual was interested in purchasing a firearm and that she took the reasonable steps to purchase a firearm, specifically a Glock handgun. We saw her researching how to buy a gun, how to clean a gun and the kickback of a gun.”
During Crampton Brophy’s trial, Sparling explained that he examined Crampton Brophy’s Internet browsing history from Nov. 2017 to March 2018. In January 2018, she began by researching ghost guns and logging into a website where they’re sold. She then pivoted to looking into if Glock pistols “have a big kick back.” One month later, her search results suggest she was looking for where to buy a gun in Portland.
“We also found evidence that showed this individual took the steps to not only potentially purchase a firearm but purchase parts of a firearm including a slide and barrel. You see the digital breadcrumbs of her appearing to purchase and having delivered a slide and barrel and a Glock. Why would someone be interested in just a slide and barrel? It’s not totally out of the norm to look up a Glock 17 purchase, but when you break it down to a slide and barrel, well that’s a little more interesting.”
In early 2018, Crampton Brophy’s internet activity suggests she won an eBay auction for a Glock 17 slide and barrel. She also watched a video that provided a guide into disassembling, cleaning and reassembling Glock 17 guns.
In cross-examination, Crampton Brophy admitted to buying an extra slide and barrel, which she said she lost in a closet.
She was convicted and sentenced to life in prison.
Q: You’ve described this investigation as a team effort between yourself, the detectives and the prosecutor. How did you work together on the digital investigation?
“We take a three-party approach to how our digital forensics is handled. There’s the detectives. It’s their case — they have the historical knowledge, they know the value of the data and they’ve done all the interviews and secondary interviews. Then there’s the forensics team. We image devices, process the evidence and put it in front of the detectives. We’ve showed them how to use the Magnet AXIOM interface so they can go through and bookmark the evidence they’re interested in.
One of the things that makes Magnet AXIOM unique is it has a collaborative ethos to it. The interface is very investigator friendly and with very little tutelage on my part, investigators can search through the dataset and find what is important to the investigation. The forensics team then comes back to do a forensic analysis on the evidence and tries to build a picture of what the evidence means, how important it is and what its relevance is. And then we bring the results to the prosecutor.”
Q: Aside from the work you did, your colleagues at the Portland Police Bureau analyzed other digital evidence that played a crucial role in Crampton Brophy’s conviction. There was CCTV video and cellphone tower data that helped place Crampton Brophy at the culinary school at the time of the murder. Twenty years ago, before police had the technology to carry out digital investigations, would she have gotten away with the crime?
Sparling: “If digital forensics wasn’t available, you would’ve had a much more difficult time with this case. If you take in the fact that we did cellphone tower data and surveillance video collection, that’s three different types of digital evidence that were collected and played significant roles in the case and in the prosecution.”
