Lucy McHugh: How a Facebook password trapped a killer

Stephen Nicholson served custodial sentences from the age of 14

A "violent sexual predator" who killed a 13-year-old girl in a bid to silence her is to be sentenced on Friday for her rape and murder. His arrest sparked one of the UK's biggest evidence searches and a trawl of thousands of hours of CCTV footage. But a Facebook password proved to be his ultimate undoing.

Stephen Nicholson was a prime suspect early on in the investigation into Lucy McHugh's death.

An occasional lodger at the teenager's home, he was held on suspicion of her murder a day after her body was found in woodland at Southampton Outdoor Sports Centre.

His arrest gave police up to 96 hours to charge or release him, but it would be four weeks until a key piece of DNA evidence was recovered.

The clock was ticking.

In interview, Nicholson told detectives Lucy had sent him a Facebook message the night before she was murdered.

She told him she was pregnant, he said.

This gave officers a reason to look more closely at messages sent between the teenager and a man 11 years her senior.

They soon realised Nicholson had changed his password prior to his arrest.

He refused to hand it over, denying police access to whatever information may have been contained within his account.

Lucy McHugh was found stabbed to death in woodland

Nicholson, a cannabis dealer, said he withheld his password to avoid reprisals from his criminal contacts - an excuse later branded "wholly inadequate" by a judge.

Locked out of his Facebook account and with no direct evidence linking him to Lucy's death, police needed more time.

A request to the social media giant would involve a lengthy route through the US courts - well in excess of the 96 hours available to detectives.

The answer was so-called "terrorism legislation", or section 53 of the Regulation of Investigatory Powers Act (RIPA).

Normally used in cases involving national security, the surveillance law can cover all serious crimes.

Nicholson was bailed in relation to Lucy's murder but charged under RIPA for failing to comply with an order to hand over his password.

He later pleaded guilty at Southampton Crown Court and was jailed for 14 months.

With Nicholson no longer at large, police had vital time for further investigations.

Being kept in custody meant he was unable to tamper with the evidence which ultimately convinced jurors of his guilt, according to the Crown Prosecution Service (CPS).

"If we'd used other legislation, he might not have been locked up," said senior district prosecutor John Montague.

But even with Nicholson behind bars, the key piece of evidence had yet to be recovered.

There was nothing to physically link the spot where Lucy's body was found to Nicholson - the murder weapon remained unaccounted for and no DNA was found at the scene.

Once again, investigators focused on Nicholson's online accounts, this time enlisting the help of a cloud data analyst.

Their job was to study pieces of information sent from Nicholson's phone to data servers owned by companies such as Google.

While tracing the phone's route on the day of Lucy's murder, the analyst noticed a small "blip" at an area police had not yet searched.

It suggested Nicholson had deviated from his most direct route home.

The diversion took him to Tanner's Brook: a stream which cuts through Southampton, weaving its way through woodland in the western half of the city.

A police analyst examining Nicholson's phone spotted a "slight deviation" in his route home

"It was a slight deviation on his telephone. You could say it had jumped a mast," Det Supt Paul Barton said.

"It was a great bit of work from the analyst who pointed it out."

This subtle shift was enough for police to launch the constabulary's largest ever fingertip search, which involved 190 officers from 12 other forces.

By now, it was four weeks after Lucy was found but on the first day of the search, police got the breakthrough they wanted.

They found a bag containing a blue, bloodstained hoodie and other items - described in court as Nicholson's "murder kit".

The garment contained Nicholson's DNA and Lucy's blood.

He is thought to have dumped the clothing, some of which had been partially burnt, near the brook after getting changed on his return from the murder scene on 25 July.

Police found a hoodie stained with Lucy's blood

Prior to the discovery of the clothing, police had no other direct evidence of Nicholson's involvement in her killing.

They tested fibres from her bloodstained jacket and Nicholson's clothes which suggested direct contact with the hoodie.

Detectives established that hoodies of the same type were sold to two people in the Southampton area - one of them was given as a present to a man who knew Nicholson's friend.

The DNA evidence "was the final nail in the coffin for Nicholson", said Det Supt Barton.

While officers, who would eventually study 11,000 hours of CCTV, examine 2,300 exhibits and take more than 300 reports, had a "strong circumstantial case", genetic evidence "was the bit to sink him", Det Supt Barton said.

Had Nicholson not been jailed over his password, the outcome could have been different.

The 14-month jail sentence "bought us time - it stopped him getting to Tanner's Brook", Det Supt Barton said.

Prosecutors were eventually granted access to Nicholson's Facebook log on the first day of his trial.

All that remained was a record of communications between Nicholson and Lucy, but without any content - he had deleted the messages before his arrest.

Prosecutor Mr Montague criticised the "protracted process".

"For me, the personal side, the human side, is we have a 13-year-old child that has been murdered under ferocious, despicable circumstances and for me it's somewhat frustrating."

Facebook said it had worked closely with Hampshire Constabulary, but "we agree that this legal process can be far too slow."

"We have actively lobbied for reforms to EU, US and UK laws to allow us, and others, to directly and more quickly provide information to UK law enforcement authorities," a spokeswoman said.

But despite this, Det Supt Barton said police had been able to build a case against "an extremely narcissistic, self-centred, violent sexual predator"

"He has destroyed a family - a family who have looked after him, put a roof over his head," he said.

"He has taken all of that, groomed Lucy and lost interest in her - that was his motive."