Sinister Signals from the Router in the Watts Family Murders – and what it might mean

Given the colossal amount of data in the Discovery Documents, it’s difficult to imagine information might be missing. It’s difficult to see what’s not there when there’s a mountain of evidence tilting and towering against the sky.

It takes a long, rigorous analysis of the mountain of data before one begins to intuit cracks of information that should be there but simply aren’t. One example of this is the router data.

fullscreen capture 20190113 161729

First a disclaimer. The information below is of a highly technical nature. An expert, especially in regards to the Vivint system, and how [or whether] it piggybacks on a home’s WiFi network will be able to provide more clarity on how the digital system functions as an ecosystem, online and in terms of a smartphone.

The Netgear Router appears to have been located in the basement of the Watts home, right beside the staircase [coming down, on the left side]. You can view Officer Coonrod’s first view of the router from 21:50 onwards at this link. Bear in mind the first area Watts entered after leading Atkinson, her son and Officer Coonrod, was the basement. When he made this trip it was [I believe] to let Deeter out, but he may also have turned the router on if it was off. If so, it would have taken a few minutes to boot up.

If Watts did turn on the router, the phone review did not pick up any connection by Watts phone [or Shan’ann’s phone] to the router that afternoon.

From a cursory glance at the router in the relatively dark basement on August 13, roughly 3 minutes after Coonrod accesses the house for the first time, the router appears to be off. When you leave home, do you turn your router off? Most [I’d hazard a guess] do not.

fullscreen capture 20190114 164518fullscreen capture 20190114 165644fullscreen capture 20190114 165940

Whether the router was on or off is relevant because of an apparent gulf of missing data. When Shan’ann arrived home on the morning of her murder, her phone didn’t connect to the router, yet it automatically connected to the Wifi at the airport at 00:51.

fullscreen capture 20190114 161110

The same applies to Watts, when he returned home at 14:07, his phone – apparently – did not automatically connect to the router.

fullscreen capture 20190114 170954

Are these simply errors, oversights or omissions in the phone data review? Unlikely, since the extraction did note some connections to routers, though clearly none from Shan’ann’s phone except the last.

fullscreen capture 20190114 160909fullscreen capture 20190114 160934fullscreen capture 20190114 160955fullscreen capture 20190114 161011

The data extraction did recover sinister activity related to the router at 02:18, exactly half an hour after Shan’ann’s arrival.  Even the reviewer couldn’t explain what the “activity” was, but documented the time and described it as “unspecified activity”. It would be good to know what sort of digital activities could constitute this label.

fullscreen capture 20190114 161038

It is possible to log into the Netgear platform, and fiddle with the dashboard, just as it’s possible to go into browser settings and change metadata [including browser history].

It would make sense, if Shan’ann’s phone did automatically connect to the router, to erase that data from the router. He would want to and need to do that in order to conceal the fact that Shan’ann’s phone had [or hadn’t] left the building.

After murdering Shan’ann, Watts probably turned off her phone, and the router back on [temporarily]. This would have theoretically also allowed the Vivint security system to come back online, perhaps in terms of sending alerts to his phone.

It’s also possible that on the night of August 14th, Watts removed a pile of digital breadcrumbs that would have helped trace his and Shan’ann’s movement, including the router data. What the router data points towards is the sheer scale of Watts’ cover-up, as well as his premeditation.

In his first interview with FBI Agent Grahm Coder on the night of August 14, Watts was clearly aware that by turning off the Wifi, the ability to track the iPad was disabled…

fullscreen capture 20190114 161203

fullscreen capture 20190114 002658

56 thoughts on “Sinister Signals from the Router in the Watts Family Murders – and what it might mean

  1. Fascinating. Question: Would the router be connected to the home’s security system? In particular, I’m wondering if turning off the router would account for the security cameras not picking up any movement after Shanann got home. If CW had been lurking in the basement waiting for her, he could have turned it off as soon as he heard her get home.

    Like

    • Any electronic surveillance system turned off [power supply turned off] will not work. It seems to make sense, if you have a system like that in your home, and under your control, that you’d turn it off when it suited you. It would be good to get logs from Vivint that might show if the system was powered off, assuming logs exist similar to the router logs.

      Like

      • Ah, finally my area of expertise. So I’m not sure why they have the router valued at 80$ USD, but that’s an older, simplified model for people who just want to “plug and play”. You don’t have to be tech savvy to set that router up. Also, that router can be bought for like $10 used, $20 new on ebay. It’s your standard 802.11n dual band router, very common and found in tons of homes, especially if the cable company (Verizon, AT&T, time Warner etc) is supplying your internet. They often use these when they come do the activation and installation, they set everything up, give you your password and off you go.

        As far as Vivint is concerned, you don’t need WiFi to have our use the system: It’s designed to work off either GSM or CDMA networks depending on what service is in your area and what they use (Verizon and Sprint run on CDMA, T-Mobile and ATT on GSM). Now, if you want to be able to control the system with your smart devices like your iPhone, and you have cameras, then yes you’d need WiFi, such as the case here with the Watts family. However the system is designed to work off cell signals so that even if your power goes out or a intruder cuts the Wi-Fi, the system can still get the distress signal out to the police, however your smart devices won’t be able to connect to the system to control it or check the cameras until Wi-Fi comes back up. Any home automation (garage door opener, lights, etc) wouldn’t work without the Wi-Fi but it’s not integral for the system to work.

        In Regards to the router, Im assuming Chris kept all the info standard and didn’t change anything after the cable company setup the connection. If you go-to your browser and type in either 10.0.0.1 in the address bar, or 192.168.1.1 (one or the other will work) you’re brought to a login page for your router. Most people aren’t aware of this and so the default username and password are never changed, making it not that much of a challenge for someone to reconfigure your Wi-Fi for their use. For this modem, the default username is “admin” and the password is “password”. Try it on yours, you may be amazed at how simple it is. Then change it in the login settings to something different for your own safety. Many people don’t even know it exists do they don’t bother to change it, and setting as Chris was the “tech savvy” one, he probably left it as is because he knees Shanann would never attempt that kind of thing. He would also be able to restart the modem without leaving the computer, as well as block certain devices or services connected to the network, like three Vivint Security System or Shananns phone, all while keeping his phone connected to the network. To Shanann though, he could lie and say the Wi-Fi went out or was having connectivity issues. Blocking the security system this way wouldn’t disable the alarm if they were to arm it as that system uses cell signals, but it would block the cameras so they couldn’t be viewed or record anything and upload to the cloud.

        If Shananns phone didn’t connect to the Wi-Fi when she got home, it could be that her phone was still on airplane mode from the flight, which allows the phone to be on but no packets will be sent or received and no data transmissions will take place. If her phone was on with WiFi enabled, then Chris could’ve changed the login password or disabled the modem from broadcasting a signal all together by manually doing so or just unplugging the modem. If his phone wasn’t connected either, I’d say that the Wifi was turned off. No devices could connect, the cameras would go down on the Vivint System but the core of the system, the door alarms and such would still be active if, for instance, the security system was set to “armed away” where it engages all the motion detectors and magnetic connections on doors and windows, and someone broke in. If the system was set to “stay” then all the motion detectors and magnetic connections on the doors and windows wouldn’t be engaged, that’s usually the mode you leave the security system in when you’re home.

        In the thumbnail from the YT video you posted, I can tell a few things from that little bit of log. Granted that isn’t from the Watts router, but it illustrates something none the less.

        See where it says “LCP Down?” The LCP is your link connection protocol, and what the router is telling you is that the broadband connection is disconnecting, not usually just once but repeatedly. Then right after I see “LCP is allowed to come up” which tells me the router is trying to reconnect. I can’t see any times associated with this, so it could be 5 minutes after or 2 hours after, I would need to see the log file. Then as it comes back up, it does a CHAP authentication. This is the router checking the peers credentials, and if it’s correct, the router says “hey I know you, you’re good to go, I’ll connect you now” and establishes a handshake with the ISP (“authentication successful”) putting you online. So now the router is back online, and right after that (although the screenshot is cut off) it looks like like someone logs into the router with the correct username and password. See where it says “administration login successful” at the bottom? It’s kind of cut off but what it is telling you is that someone just manually logged into the router as an administrator, therefore they have full access to all the routers functions and capabilities.

        Looking at this from my perspective though, this was done manually. If it lost connection due to a service outage, the log info would be a bit different. I understand that this isn’t info from the Watts router, just using this as an example. You can see that right after the modem established a connection using the proper credentials there is a successful login to the routers admin panel, whereas if the router just lost connection and came back up manually the log entries made by the router would look a bit different.

        I’d be interested to see the logs from that night, because I’ve long suspected he either pulled the power cord out on the router in the basement, perhaps when he went and put dieter down there so he wouldn’t bark. I believe if there is any doubt to this murder being premeditated, that would pretty much eliminate any reasonable doubt someone had remaining. The router would log such an event, and they could’ve very well asked Chris at some point “If this was all something that happened spur of the moment, why does the router show it was manually disconnected from the network at 1:30am, then bring back up by someone in the home around 4am”? That would be pretty damning to his case, no?

        Liked by 1 person

      • Just making a correction to my post. In the third paragraph from the bottom, I wrote :

        “whereas if the router just lost connection and came back up manually (I meant to say automatically, not manually) the log entries made by the router would look a bit different”

        My Apologies

        Liked by 1 person

      • Nick would the 2:18 actually be 4:18am with the time zone change? That fits in with the first motion sensor which would explain him going to basement to turn in off

        Like

  2. More grist for the mill, and another pointer indicative of a sinister premeditation.

    So many forums hold the belief that some sudden argument occurred upon Shannan’s return, escalating into a sudden and unplanned murder of 3. Posts like this one, as well as the oxycodone search and various other incidents, strongly suggest otherwise.

    Liked by 1 person

    • I think it’s very likely it’s connected to the security system. In the picture there is quite a bit of wiring in that area. If not connected to security, I think it’s odd that it is located in the basement. for such a huge house, would the WiFi signal from the router be readily accessible? I have a two-story house and my router is on the main level. The signal begins to weaken the more interference there is (walls, distance, etc.). With Shanann’s dependence on using her phone to post videos seamlessly anywhere in the house, you would think the router would be in a central location.

      Liked by 1 person

      • it really wouldn’t mage much of a difference honestly. It may be a bar weaker, but nothing damaging as broadband runs on shared loops anyway, where each loop services 10000sq ft which is usually a few homes. They may have also had extenders plugged into the outlet. The basement may have been a good location as to access or run the coaxial cable where the children and dog wouldn’t bother it. Heavy noise or interference would really only occur if it’s close to 10,000sq ft, which it was nowhere near. Furthermore, it’s kinda centralized, even if in the basement, it’s not on the far east corner of the home when all the electronics are on the opposite side, and it looks like the home is mostly wood/sheetrock/siding, as opposed to say… Poured concrete which would really disturb the signal. I don’t think they have dedicated fiber, looks like a standard copper broadband connection.

        Liked by 1 person

    • This article really is jaw-dropping and, like you added, points to dark events happening very likely within minutes of her returning home. Massive cover-up is a huge understatement. This honestly raises the level to diabolical.

      Liked by 1 person

  3. Super interesting. The one thing I’m thinking of is the fact that Shan’ann’s phone may have been on airplane mode? That may be why her phone did not receive the text messages and why it didn’t connect to WiFi? Am I completely off base?

    Like

  4. Interesting. Chris is tech savvy. As part of his premeditation he may have tested turning off the Vivint security system and moving around downstairs. Also tested using his phone and turning off the Wifi and checking what data was on the reports. He had time while his family was in NC.

    I don’t know why everyone doesn’t categorize these murders as premeditated. Why are people willing to believe Chris’s story about an argument, when he’s a known liar, cheater and murderer?

    The FBI, who profiled the case and have access to ALL documents/evidence not made public, concluded that they were planned murders and that the children were killed first. This should have been announced to the public even without a trial.

    Nickvdl:
    In the second paragraph after the Netgear Settings Screenshot, add a comma after Shan’ann,
    “After murdering Shan’ann, Watts…”

    Liked by 3 people

    • Why are people willing to believe Chris’s story about an argument, when he’s a known liar, cheater and murderer?>>>It often happens that the defendant’s version is treated as factual by the media. Since there is so little info, people take it as gospel. It’s so much harder to fill in those gaps when we eliminate the version as a lie.

      Liked by 1 person

      • Wow, this guy made some huge errors but if he did tinker with the router he was good at some planning. I don’t believe there was any discussion after she got home either, not sure this guy ever had enough emotions to have an emotional conversation

        Like

      • You are totally right. I don’t believe anything about the “emotional conversation” where they both cried. Not for a second. Shortly after 4 a.m. when he said that conversation took place, none of those poor souls was still alive.

        Liked by 3 people

      • In order to take the death penalty off the table, one of the conditions should have been a full confession without the BS of Shanann killing the girls, and him flying into a rage. What a load. Why didn’t the prosecution made this a condition. They didn’t believe Shanann killed the children…..I am so addicted to this case….there are so many unanswered questions. I read one report that stated NK’s father is a Freemason which makes her untouchable…any thoughts???

        Liked by 1 person

  5. Watts had called Vivint Security several times in the days leading up to the murders. Might he have needed tutorials? He told Sha’nann the system wasn’t working properly but he thought it was all set after he spent time with them getting it right. I’m sure he knew how to shut everything down as after the Vivint video monitor captured S walking up to the home and enter at precisely 0148, there was no movement detection on the main floor of the home from 0148 – 0423.

    On 7/20/18 he also researched toyapagroup.picaboo. A bit hard to understand their site, but it seems that one can organize or hide snapchat information. That site also led me to Griffeye Technologies, which can be used by law enforcement in media investigation, analyze “VICS” hash records determine relationships and share it. So I at first thought law enforcement used toyapagroup.picaboo to investigate Chris’s snapchat and picture content, but from the documents p.2088, Chris visited the site. Might mean nothing, might mean something. He sure as hell has deleted a font of information.

    There is no doubt he was tech saavy. “Rain Man” they called him at work. Yes, this was pre meditation on a grand (and covert, quiet, introverted) scale CBH. He was no dummy. Socially awkward should not be equated with a lack of intelligence. In fact it’s the ones who talk less and listen more who learn more.

    Liked by 4 people

    • “There is no doubt he was tech saavy. “Rain Man” they called him at work. Yes, this was pre meditation on a grand (and covert, quiet, introverted) scale CBH. He was no dummy. Socially awkward should not be equated with a lack of intelligence. In fact it’s the ones who talk less and listen more who learn more.”

      Fully agree. The socially awkward ‘Aspie’ (some have suggested he seemed like a high-functioning Aspberger Syndrome type) is more likely to be ‘inward’ which would lend itself to planning, plotting, subterfuge and deception when necessary.

      Liked by 1 person

      • I have to somewhat disagree; while I don’t think he was a moron or anything, he was not much above the standard average IQ range. He may have planned out a lot, but he also made a number of very stupid and obvious mistakes that guaranteed he was going to get caught sooner or later (even if Shan’ann’s concerned friend hadn’t thrown him off). He had to have known he’d be the first and most obvious suspect, and that one of the first places they’d look for his family’s remains would be at the sites he visited for work – especially the first site he visited the morning his family was reported missing. It was only a matter of time before they asked Aanadarko to let them search that area, and only a matter of time before their bodies would be found there, and Chris Watts would be arrested immediately afterwards. A smarter killer would have come up with a better plan than this…just as a normal human being would never have done it to begin with.

        Liked by 1 person

  6. Given Chris Watts’s “Rainman” profile, I’m not surprised at his being technologically savvy, nor would I be surprised if he took some cerebral satisfaction in planning and executing his crimes from this standpoint, ergo his apparent arrogance during the porch interviews. On the other end of the spectrum, he failed in anticipating the human/societal responses to his family’s “disappearance,” which were immediate and suspicious. Moreover, Chris’s inabilitiy to plan for the aftermath of his crimes underscores his lack of self-realization and by extension his cognitive and predictive blind spot to others’ reactions. Like the router/security system nexus, if Chris had a robust connection to himself and how others’ perceived him, he would have recognized the need to modify his flat aspect during the porch interviews, as well as the need to avoid or limit engagement with law enforcement prior to securing legal representation.

    Liked by 2 people

    • Excellent points, and goes to show how a defect can foil the best laid plans. It’s not that he was unintelligent as some have suggested; rather, his high intelligence was offset by weakness in human perception and interaction.

      Like

    • Agree 100%, especially in his inability to anticipate people’s reactions to his family’s disappearance and what behavior appears abnormal in such circumstances. Good analogy between Chris’s self/people connections and the router/security systems.

      Liked by 2 people

    • This entire topic has been interesting and disturbing on so many levels. The psychopathic mindset is incredible. Oxycontin. Lord Jesus! After reading this and everyone’s response, it is hard to imagine that the girls were alive when SW stepped inside the house at 1:48. Off went the router at that point and quick and horrendous end for SW. He obviously couldn’t allow her to go up to the nightmare upstairs. This topic just stuns you silent to the premeditation, crime and attempted cover-up involved.

      Liked by 4 people

  7. I wonder how long it would have taken him to report his family missing after he returned home after work had Nickole A. not spoiled it. If his routine was to leave around 4, he would get home around 5 – would he have done some cleaning before reporting his family missing? Maybe a load of laundry? Make a protein shake? Was his plan to keep “calling home”? He wouldn’t have wanted to alert the police before he had a chance to run inside. I think he forgot she had a doctor’s appointment Monday morning. He didn’t forget it was Bella’s first day of school – he called ahead on that one but I suspect that was more to keep funds from being deducted from his account. People would have been calling him even if Nickole hadn’t of showed up on his doorstep.

    Liked by 1 person

    • Yes, I wondered if no one had missed SW all day, which was unlikely unless he texted from her phone pretending to be her, what would he have staged next….her phone, purse, kids medications left in the house…would he have put them in her car and driven it somewhere? Maybe left her car in a parking lot. His neighbor’s video would have seen her vehicle leave so maybe he’d have done it when it was dark out.

      Liked by 1 person

  8. Last paragraph: Turning off the wi-fi doesn’t have anything to do with tracking the iPad. The cop was asking if the IPad would show where she was and CW says it doesn’t work unless it’s connected to wi-fi. So if she was gone and had the iPad it would have to be connected to a wi-fi somewhere in order to track it, which has nothing to do with their home router.

    Like

    • Turning off the wi-fi doesn’t have anything to do with tracking the iPad. – Of course it does. Whether the iPad is connected to the wi-fi at home or somewhere else, it can be tracked – if the wi-fi is on.

      Liked by 1 person

      • She’d have to be connected to a wifi network though. He was basically saying it didn’t have a data plan, unlike phones that have data plans, tablets are optional obviously. So if she had it, and the Wi-Fi was on but she was in a area without Wi-Fi, there was no cell signal to use on that tablet instead of Wi-Fi and you wouldn’t be able to see her current location. If she was in an area that has Wi-Fi connectivity open to the public that the device could connect to, then sure but that’s not usually the case.

        Like

  9. I may have missed it in the document dump – is the brand/model of the baby monitor ever released? I’m curious to know if the cameras in the girls’ rooms were connected to the network via WiFi. If so, turning off the router would interrupt the signal, displaying nothing, right?

    I had a baby monitor hooked to our home network years ago. I would get frustrated with a weak WiFi signal because the picture was so grainy and would freeze up – couldn’t see a darn thing! Again, this was 8+ years ago so I’m sure the technology is better today.

    Liked by 1 person

    • That is a great question! I would love to know the make/model as well.
      If the signal was interrupted, it might have given Shan’Ann a reason to go in and check on the girls. Chris had over emphasized that she was on top of Cece and liars often mix truth with lies in order to make it believable.
      However, I truly hope my intuition is wrong and this is speculation on my part.

      *When I mention I do believe she was on Cece, I mean in order to revive her.

      Like

  10. So tinytech, what are the many possibilities for “unspecified activity” in the Watts home router at 2:18 a.m. – a full 30 minutes from the time Sha’nann entered the door?

    Also does anyone want to venture a guess as to why at 1045 military time, Watts looked up Mt. Colima, a volcano – then at 1656 he did another volcano search – Paricutin. I don’t take him for a reader, so why the interest in active volcanoes? Was he thinking to himself “I’m gonna blow”? Or were they two items on his bucket list to take Nichole Kessinger to see – like Travis Alexander’s 100 places he was going to go see (and take Arias, or so she hoped)? Intertextuality.

    Like

  11. Maura, they are tacked on to the original discovery files which is in pdf file format – see if this address gets you there:
    18CR2003-discovery-redacted-final.pdf

    Then when you have it, bookmark it so you can go back and forth

    Liked by 1 person

  12. Log entry on Watts phone. WiFi and Wan out at 2:18am. Vivant does use WiFi, but it doesn’t need to. I think that’s for home records, only.

    Like

    • I’ve got some more info from the router. CW . First of all, it’s 2 hour “late” so you need to add 2 hours on all timestamps: https://imgur.com/VS0YtGY. If we look at the log from 6.20 pm the 14th to 8.22 am the 15th, there are many devices who connects to the router, including both of CW’s Iphones, a HP laptop, Ipad/Mac. Cw was sleeping over at his friends that night, so how is this possible? Check this: https://imgur.com/yqchr3Q https://imgur.com/CAocv6m and especially this: https://imgur.com/CAocv6m His Iphones connected at 4.30 am and 6.20 am ?? According to this, CW gave permission the evening before, so he knew they were coming the next morning. The police responded 6 am, and on arrival they had to call CW for the access code. They were inside around 7.15 am. They started taking photos immediately and this is the first photo taken: https://imgur.com/F3WKNai Did he sneak in and connect his phones, laptop, Shanann’s Ipad (or Mac) to tamper with Vivint? And then sync them to Vivint server? Not realizing the router logged every device he turned on? It looks fishy anyway… He shouldn’t have been there that night. If this is correct, the FBI would know of course. Which again means this would be part of the documents held back (in case of a trail). I seriously doubt he sneaked in to water the plants….Ps: The Amazon entry plus a couple of others are most likely either associated with the router or cable tv subscriptions.

      Like

      • John, can you elaborate on the attachments you provided? What do the entries that begin with “DoS Attack” mean? Are you sure it was CW accessing the system, or could it be LE accessing without a warrant? If it were LE doing something without obtaining a warrant first, it would be extremely detrimental for the prosecution if the case went to trial.

        Like

Leave a Reply to Sylvester Cancel reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.