“It’s a situation where you have not got any really concrete evidence: one piece, like a CCTV camera footage or a witness, etc, all you’ve got is an accumulation of basically very low-level evidence — coincidences, etc — but when you actually accumulate a large number of these [using] something called a Bayesian analysis, it’s actually more statistically sound to have 100 little arrows pointing towards Lucy and none pointing away from her, and I think that’s how justice was actually reached.”
—Criminologist David Holmes on Sky News, 18 August 2023
“Nothing happens in Moscow.”
And so then I just ran down there and we talked and we just locked the door. We didn’t think anything of it. We’re like, “Nothing happens in Moscow”.
—Eyewitness statement to police, 22 November 2022.
Moscow Idaho, a small town in northwest America, is known principally as the home of the University of Idaho, and not a lot else. Almost three hundred miles upstate from the capital at Boise, it is remote, quiet and — usually — safe. Before 2022, the town had not recorded a single murder in seven years.
Remote, but not isolated: eight miles east, across the state line, lies similarly-sized Pullman, Washington. Pullman, too, is safe, remote and similarly academic: it houses the Washington State University campus.
That quietude was broken in the early hours of November 13, 2022 when a masked intruder entered an off-campus student house in Moscow and brutally murdered four University of Idaho students, stabbing them as many as 150 times, before disappearing off the planet’s face.
No-one called the police for 12 hours after it was clear the murders had taken place. Still, there were no obvious suspects. The victims were ordinary, outgoing, sociable kids. They had no known enemies. They weren’t dealing drugs. They were not caught up in any kind of vice or skulduggery that might explain such an awful.
Three lines of enquiry
Local police, unused to antisocial crime, found themselves facing unprovoked, inexplicable, mass-murder. There were three broad lines of enquiry: there was an eyewitnesses, forensic evidence the killer may have left behind in the house and CCTV footage of the surrounding area.
Eyewitness
The eyewitness, a housemate, didn’t see much: she briefly glimpsed the assailant before locking herself in her room:
“I saw this guy, and he was not insanely tall, but he was wearing all black and, like, this mask covering his forehead and his mouth.”
Crime scene
As for the crime scene, the perpetrator could be associated with just one item: the sheath from a “Ka-Bar” combat knife — though not the knife itself — recovered from the bed of one victim. It contained a spot of unidentified DNA.
Despite the fury of attack, and evidence some of the victims had put up quite a fight, police forensics found no other evidence of the perpetrator.
CCTV
The CCTV revealed one thing of note: a white car, repeatedly captured driving back and forth around the crime scene at the time of the murders. No other vehicle appeared on the cameras during the period of the murders at all.
Though much car footage was of poor quality — little more than a smudge of white behind a frame burned out by headlights — police forensics were able to triangulate and sequence the images to match a much clearer image caught on a camera further down the road. They narrowed it down to a white, early 2010s Hyundai Elantra.
There was no clear picture of the driver. No one was filmed getting in or out. The Elantra may have had nothing to do with the murders, but it was there, apparently circling the crime scene, and when it finally departed, it went with engine racing and tyres squealing. There aren’t many cars on the road in the dead of a cold night in small town Idaho. If the Elantra wasn’t involved it needed at least to be ruled out.
Moscow Police put out an “all-points bulletin” on the Elantra. No-one came forward. They combed local vehicle registries in the Moscow/Pullman area and polled campus police at both universities. They turned up about 100 white Elantras. None looked especially suspicious.
Forensics
Police went deeper into the forensics. They found some some DNA on the “Ka-Bar” sheath. It did not match the victims. It did not match their housemates. It did not match any records in FBI database. If it belonged to the murderer, he had a clean record.
Police uploaded a “single nucleotide polymorphism” profile from the DNA to a couple of consumer ancestry websites and got a small number of hits for distant relatives.
The police triangulated. They narrowed the DNA down. The perpetrator hailed from somewhere deep in Pennsylvania. This was good and bad, news.
Good news: it was a narrow region. Bad news: it was more than 2,500 miles from Moscow, Idaho. It could hardly be further away. It looked like the police had an evidential disconnect: murders in the remote northwest, by someone from the remote northeast.
A tailgating Hyundai Elantra
Two weeks later, on Interstate 70 outside Greenfield, Indiana — that’s nowhere near Idaho or Pennsylvania — police twice pulled over a white 2015 Hyundai Elantra, for “tailgating”.
The car was on Moscow PD’s list. At the wheel was Bryan Kohberger, a doctoral candidate in criminology at WSU Pullman. Kohberger was with his father. They were on their way home from Washington for the Winter holidays. It was a 38-hour drive.
“Home” was a small town called Albrightsville. Albrightsville was deep in Eastern Pennsylvania, right in the middle of that narrow region identified by DNA triangulation.
Bryan Christopher Kohberger became the prime suspect. The began investigating him in earnest.1
A FBI team went out to Albrightsville to comb the family’s trash for DNA.2 They snagged some Q-tips. They got a match. Investigators checked out Kohberger’s Amazon purchase history. It revealed: he bought the very model “Ka-bar” knife that matched the sheath just months before the murders.
But the car was clean. An FBI forensics team tore it apart, panel-by-panel. They found nothing: no blood. No crime scene evidence. They found nothing in his residence. Given how frenzied the murders were — stabbings, at close range, with struggling victims — you would expect the perpetrator to be covered in blood. But there was no sign of it, if so.
The policed pulled cellular phone data. Kohberger’s phone “pinged” a GSM tower in Pullman before the murders, then went “dark”, then came back on line — pinging a tower much closer to Moscow — after the murders. The police said this was consistent with Kohberger being away from home — on the road — at 3 am and then then switching off his phone, as if he wanted to “go incognito” for a while.
Kohberger denied switching off the phone: he told police he had been “star-gazing” alone. He said he must instead have been outside cellular coverage as he drove into rural Idaho in search of the cosmos.
Arrest
The police thought they had enough information to convict him and, on December 30, 2022 arrested and charged Bryan Kohberger with four counts of first-degree murder and one count of felony burglary. Prosecutors announced they would seek the death penalty. As is evidently common in Idaho, Mr. Kohberger “stood silent” to the charges, and a plea of not guilty was entered on his behalf.3
After his arraignment the defence made several unsuccessful applications to the court to have the death penalty taken off the table. After six months’ of reversals, Kohberger’s team proposed a “plea deal”: in return for pleading guilty, Kohberger would accept four consecutive life sentences and would avoid the death penalty. Against his victim’s families wishes, the police accepted the proposal. Kohberger was sentenced to life in prison. The criminal trial never took place.
And there, but for the inevitable cascade of mediocre TV documentaries4 it might have ended, had not Bryan Kohberger moved, on 27 July 2026, to withdraw his guilty plea on the grounds that it was made, on defective legal advice. It is not clear yet whether the State of Idaho will allow this reversal, but if it does he will be tried, and the families may yet have their day in court.
Idaho has, since his original sentencing, reintroduced the firing squad.
Circumstantial evidence and the small arrows
And this is where Ms. Letby’s case comes in. For, not unlike Ms. Letby, Mr. Kohberger has attracted a body of opinion — though appreciably smaller — that he, too, is innocent. This is based on superficially similar grounds: there is little solid direct evidence that it was him. The one eyewitness identified a masked man with “bushy eyebrows”. Mr. Kohbergber’s eyebrows do not seem especially bushy. The DNA evidence, though appearing compelling, is oddly isolated to a single artefact. It is vulnerable to “chain of custody” issues. It is vulnerable to skulduggery: it is not impossible that this single item was planted to “frame” Mr. Kohberger.
The remainder of the evidence against him is circumstantial and what Professor Holmes might call “low-level”: it is only when taken together with other “little arrows” that it starts to point at Mr. Kohberger. His supporters say that it has been deliberately marshalled and framed so to as to create a misleading impression of his guilt.
Ms. Letby’s case is also founded on circumstantial evidence. Her supporters say much the same thing. It is a useful point of comparison.
By way of reminder, “circumstantial evidence” is not eyewitness or CCTV evidence of the deed being done — there is often no such “direct” evidence of unprovoked murder — but rather is evidence surrounding the allegations that invites the jury to infer what happened. Circumstantial evidence is evidence that the crime is more or less likely to have happened. It is inherently probabilistic.5
The prosecution must prove two things: that it was murder; and who the murderer was.
In Kohberger’s case, almost all the circumstantial evidence concerned that second question. In Ms. Letby’s, almost all concerns the first.
That it was murder
Here there is another interesting similarity between the cases: as causes of death go — even death by murder — both are are extremely unusual. You are most unlikely to die by unprovoked mass-murder by a stranger with a hand-held blade.6 You are even less likely to succumb to a healthcare serial murderer.7 Both are extremely rare events.
So before moving onto whodunnit, prosecutors must first satisfy the court that there were murders at all. If the evidence about that is at all flaky, they face an uphill battle to get a conviction.
And here, the similarity between Moscow, Idaho and the Countess of Chester Hospital’s neonatal intensive care unit ends.
For in Idaho, there was no chance the victims died of “natural causes”. No-one argued for a moment — not state prosecutor, not public defender — that these were not murders.
If you know an event has happened, it does not matter how unlikely it was in the abstract. Probabilities only help you resolve intrinsic uncertainty, about things that haven’t happened yet, and anecdotal uncertainty, about things that have.8 Here there was neither kind of uncertainty. The only question the state prosecutor needed to answer was whodunnit.
Ms. Letby’s case was different. Multiple health professionals had attended each collapse. Not one suspected malice at the time. The crown prosecutor needed to satisfy the court, beyond reasonable doubt, that these collapses were the result of malice. Almost all the medical evidence — relating to air embolus, insulin, endocrinology, radiography — was directed at that question. It was not about Ms. Letby, but murder in the abstract. The deficiencies with it are legion — I have covered them at length elsewhere — but they are not relevant here.
The evidence relating to the second question — whodunnit — was quite different.
Whodunnit
The “who” profiles for the Idaho 4 and for the Countess of Chester were vastly different. In Idaho, anyone within a reasonable travelling distance of the crime scene could have perpetrated this murder. About 160,000 people live within 50km of Moscow.9 That’s a big haystack.
By contrast the number people who could plausibly commit murder in the Countess of Chester Hospital — access-authorised employees — is institutionally bounded. They can quickly be triangulated down, just by who was there and when. So, for healthcare serial murder if you can satisfactorily answer the “that” question, the “who” question tends to answer itself.10
The very rarity of unprovoked stabbings tells us that, although many people could physically commit them, very few are likely to actually do so. The “plausible suspect pool” is much smaller than the population at large.
Even if the haystack contained that starting 160,000 people — it would quickly triangulate down to a much smaller number than that — we would not expect to find more than a couple of plausible suspects to carry out.
This presented Mr. Kohberger’s defence with a problem. The “that” was granted: the four students were definitely murdered. But Kohberger was not merely a “random draw” among 160,000 citizens of the northwest. He had been found: he fitted the offender profile, had the opportunity, and was linked by physical evidence. His problem was explaining how the investigation could have matched all the circumstantial features and yet still converged on a wrong person.
If Ms. Letby’s “that” was satisfied — if the crown could satisfy the court that there had been a series of murders — Ms. Letby had the same problem: assuming the collapses were murders there was, as Professor Holmes put it:
An accumulation of basically very low-level evidence — coincidences, etc — 100 little arrows pointing towards Lucy and none pointing away from her
It is worth comparing Mr. Kohberger and Ms. Letby in more detail.
In Mr. Kohberger’s case, the evidence is low-level, but discriminating, in the sense that it discriminates against him: each additional piece adds meaningfully to the factual matrix comprising the sum total known about the night of the murders. The evidence correlates and corroborate sin fairly direct ways. Mr. Kohberger owned an Elantra and cell data indicated he was driving it at the time of the murders.
This reduces the possibility that an alternative defendant will emerge exhibiting stronger evidence, in turn making the odds that Mr. Kohberger was simply an unlucky innocent, in the wrong place at the wrong time, increasingly remote.
This is what Professor Holmes means when he talks about a “cumulative Bayesian analysis”: each new fact meaningfully updates the known factual scenario. Likelihoods get higher. Probabilities move away from their abstract “base rates” — whereby Mr. Kohberger is an average citizen, no more likely than anyone else to be the murderer — to an updated “posterior” in which he is quite a lot more likely to be involved than a random person.
After all: it is one thing to simply live in the general area. It is another to own a white Elantra: hundreds did that. But living locally, owning an Elantra and being out and about in it at 3am on the night of the murder: that is unfortunate. And happening to lose cell connection just before the murder, and regaining it just after — that is accursed.
And that is before we even get to the DNA-covered sheath. It is a single piece of evidence, true — but it was recovered on the first day of the investigation. If it was planted, then whoever did that must have already had Mr. Kohberger in mind, known that owned such a knife, that he drove a white Elantra, and would be inexplicably out in it, beyond cell range at just the moment of the attack. The probabilities of this being staged seem low. For this to represent a reasonable doubt, Mr. Kohberger will need to produce a plausible master, murderous antagonist, bent on fitting him up.
For all Professor Holmes’ assurance, this is not like the circumstantial evidence brought against Ms. Letby. Except for one aspect — her very presence, and we will come to that — the circumstantial identification evidence is ambivalent. It does not progressively exclude alternative explanations. Much of it is nothing like contemporaneous. It is evidence capable of being interpreted consistently with either guilt or innocence. A sympathy card to bereaved parents, for example, is equally compatible with a guilty person attempting to appear normal and an innocent colleague expressing genuine sympathy. Likewise, apparent opportunism can be characterised by the prosecution as a murderer exploiting opportunities, but by the defence as behaviour inconsistent with a premeditated serial killer.
Mr. Kohberger was confronted with a plausible case around him with a lot of quite-hard-to-explain, inconvenient circumstantial evidence. To be sure, he offered explanations: he said he drove his white Elantra across the state line into Idaho on an overcast night to go stargazing, alone, at three in the morning and out of cellular range — at just the moment four students were being murdered in the rough vicinity. Each taken, by itself, seems unlikely but not impossible — but for all to be true at once, seems outlandishly improbable. If it wasn’t him, Mr. Kohberger is a galactically unlucky man.
Of the evidence in his favour, while it might seem likely that a violent intruder would leave some fingerprints or DNA traces at the scene — Mr. Kohberger did not — and so their absence apparently supports his story, an eyewitness described an assailant in a ski-mask, and a pair of gloves were recovered from Mr. Kohberger’s car. These facts dilutes the value of this missing evidence. The suggest an assailant who has taken proactive steps to avoid leaving evidence.
There are competing probabilities here: On one hand, there is probability of an actually-innocent person being out in a white Elantra in the rough vicinity and at the precise moment such a car is involved in a statistically improbable murder; on the other, there is the probability that the perpetrator of that crime would take positive steps to destroy evidence before police can find it.
The same is not true of the circumstantial evidence offered against Ms. Letby. Much of it is equally consistent with innocence as guilt, and not especially probative of either. While it might be self-serving for a murderer to bemoan her own misfortune at always being on deck when a collapse happens — but, Q.E.D., you would expect exactly the same reaction from an innocent: that is exactly why it would be “devious” behaviour. And where the little arrows in Ms. Letby’s case point anywhere at all, they tend to be discrete: they do not have a cumulative effect the way a white Hyundai outside of cell-tower range, in the dead of night, at the time of the murders does.
And there was a lot more opportunity to collect real-time evidence about Ms. Letby: she was operating in a “data-rich environment” under at least informal suspicion11 for months before the final collapse for which she was charged. The weakness of the identification evidence ultimately presented against her — barring her “constant presence” — tells its own story.
The constant presence
And this brings us to the last strand in this circumstantial case against Ms. Letby, and in my view the most important: her opportunity. If this one falls, all else falls beside it.
As noted, “mere presence” does not address the “that” question: whether any murders happened at all. The staff attendance record is relevant only to the second question: given that there were murders, “whodunnit?”
We would expect an attendance record more easily rule out potential suspects than implicate them: those who weren’t in the building can hardly have been the villain. Just being in the building is not, of itself, positive evidence of malice.
But given the small total pool of suspects — fewer than 50 people were authorised to be in the Countess of Chester’s neonatal ICU at all — that ruling out process is likely to boil the set of prime suspects down to a very small number: in the Countess of Chester’s case, almost certainly just one.12 If you do know there is murder, and only one member of the staff has the opportunity, that person is in the headlights.
This is identification by elimination, Sherlock Holmes style:
When you have eliminated the impossible, whatever remains, however improbable, must be the truth.
Weed out staff members were not present for every collapse. The group that remains contains your perpetrator. With a fair wind, it will be a group of one.
Event selection
But there is a danger here of being lulled into “categorical blurring” and using a nurse’s mere presence to buttress weaknesses in the evidence for murder in the first place.
Remember, the prosecution must prove two distinct propositions:
That: The collapses were the result of deliberate acts by someone
Who: Ms. Letby was that someone.
While both questions may in theory be discharged by the same facts — a direct eyewitness catching the murderer red-handed would do it — they are nevertheless logically distinct: both must independently be proven. There is a danger of taking proof of presence as proof of murder.
The danger lies in plumping for identification via the Sherlock Holmes method before you have earned the right to use it.
Here is how it might happen:
Say the forensic evidence of murder is a bit underwhelming. You’ve done your best, but the strongest evidence that there were any murders — if you squint a bit — comes from a couple of cases the hospital only threw in at the last minute to make up numbers. Sure, there’s an arguable case for murder — air embolus, immunoassays and whatnot — but none of it is overwhelming.
Nor do any of the cases in isolation stand up as definitive provable murders by anyone, let alone Ms. Letby. Instead, they seem, spookily, to bolster each other, when collected together generating a sort of emergent credibility they don’t have when taken individually.
Though the case for murder is underwhelming, you run your “Sherlock Holmes” analysis on the staff records anyway. Hey presto: thar she blows, standing out in a row of grim black crosses: the angel of death. Twenty-two events, twenty-two crosses, and no-one else even close.13
The CPS nixes the idea of calling a statistician, but you don’t need one to see that the chance of this happening by sheer coincidence is off-the-scale unlikely — way beyond the scope of any “reasonable doubt”.14
This is where the confusion comes in. The “Sherlock Holmes reduction” becomes evidence not just identifying the murderer but supporting the hypothesis that they were murders in the first place. Just as it is off-the-scale unlikely that one nurse would be present by coincidence at twenty-two random events, so it is off-the-scale unlikely that unexplained collapses would happen by coincidence on twenty-two random days. If the data are fair, you shouldn’t therefore need compelling evidence of murder: the improbable coincidence does that for you.
This feels a bit of a sleight of hand, but it need not be, as long as the samples are both fairly — that is to say, independently and without regard to any “theory of the case” — drawn. If so — and if Ms. Letby’s presence was no kind of filter to eligibility as a suspicious collapse — if this is the totality of all unexplained collapses that occurred in the suspect period, defined by reference to independent criteria, and the attendance records are indeed comprehensive — then presence alone may be probative — strongly probative — of murder. The “who” also answers the “that”.
The problem for the prosecution — and now, for the defence! — is that they may not have been independently selected. That might not have even been possible. The selection criteria are paramount. If it turns out that the 22 collapses were chosen because they took place when Ms. Letby was on duty, the constant presence is not a statistical outlier, but a certainty. The “Sherlock Holmes” method works for neither “who” or “that”.
So, how were the 22 collapses selected? We don’t know. Ms. Letby’s defence applied to the court for disclosure of how the prosecutor selected the charges for which she was prosecuted.
The prosecution objected.
As it often did, over the nine-month trial, the court declined the defence application.
Kohberger and Letby, redux
Mr. Kohberger’s and Ms. Letby’s cases could hardly be more different, but both being in the public eye they make for a good comparison. I hope you found reading this exercise as enlightening as I found researching it! If you did, please share it.
It’d make a great play.
The sequencing here might not be quite correct — they probably did not search his amazon account until he was arrested — but it does not matter, and it needlessly confuses a good story.
This is legal, apparently! Trash is treated as abandoned material, and is fair game without a warrant.
Evidently, this is standard protocol under Idaho law.
Netflix offers The Idaho Murders: College Nightmare. Amazon offers One Night In Idaho: The College Murders. Neither are incisive, especially given that Kohberger has now recanted his confession.
Fun fact: “prove” & “probability” share the same etymology: “prove” comes, via Old French, from the Latin “probare”—to test or make good. “Probability” comes directly from “probare”. “Prove” now means “establish as true”, while “probability” means “plausibility or likelihood.”
There are three reasons for this: most homicides involve people who know each other. “Stranger homicides” in any case are a minority. Knife murders are usually interpersonal, arising from domestic violence, arguments, gang disputes, bar fights — generally situations where the offender and victim have some connection.
On the statistics, and assuming all convictions are fair — which I don’t think it a safe assumption — they still meaningfully rarer even than blade murders.
This is yet another reason a sophisticated healthcare serial killer is likely to avoid healthcare facilities — like Harold Shipman — or at any rate rapidly move between them — like Charles Cullen and Michael Swango.
Revealed: How trust execs resisted concerns over Letby, Health Service Journal, 18 August 2023. By June 2015, the court heard, “all eyes were on her”.
The excellent Tried By Stats website lets you play with the permutations.
Let’s not spoil a good story by remarking that Ms. Letby was not actually present for every collapse.
There might be a bona fide explanation other than the nurse’s malice — but at this point, like an Elantra driver in a cellphone dead-spot at three in the morning, the defendant has some explaining to do. If she can’t come up with a plausible connection, she is likely done for.
