Keith Raniere’s forensic experts won’t get to analyze the FBI’s copies of a Lexar camera card before Judge Nicholas G. Garaufis decides the fate of Raniere’s Rule 33 Motion for a new trial – in which he claims the FBI tampered with the camera card.
Last month, Judge Garaufis denied Raniere’s motion to view the copies of the camera card that the FBI seized from his library in 2018.
A Lexar camera card similar to the one the FBI seized at the executive library of Keith Raniere.
The DOJ used the camera card as evidence of two predicate acts of racketeering: possession of child pornography and sexual exploitation of a minor. In June 2019, Raniere was convicted of racketeering and six other counts, and in October 2020, he was sentenced to 120 years in prison.
Legal End of the Line for Camera Card?
On March 6, 2024, Raniere requested Judge Garaufis stay his Rule 33 motion for a new trial pending an appeal of his denial of access to the camera card copies. On March 28, the judge denied Raniere’s request and ordered Raniere to make his final reply to support his Rule 33 motion by April 22, 2024 – without the camera card copies.
Judge Garaufis wrote, “Any stay pending appeal would simply unduly delay the resolution of Mr. Raniere’s third Rule 33 motion which has been outstanding almost two years for a conviction that was entered almost five years ago…. Mr. Raniere’s appeal has no merit.”
The Loveall Report
The DOJ, in opposing Raniere’s Rule 33 motion, utilized a report by David Loveall II, a senior FBI computer scientist. Unlike Raniere, Loveall had access to the two FBI forensic copies of the camera card.
The first was created in April 2019, and the second was created in June 2019.
The camera card does not contain contraband. The contraband—22 photos of Camila—was found by the FBI on a hard drive seized in Raniere’s library.
Keith Raniere in his library. The blue light shines from the hard drive that contained the contraband.
The hard drive where the contraband was found.
The contraband, which was found surprisingly 11 months after the FBI seized the hard drive, has conflicting digital data, which the FBI said points to the photos being taken in 2005 when Camila was 15. However, some digital evidence shows the photos were taken in 2003, a year before the camera was manufactured. Other digital evidence makes placing any date on the images somewhat uncertain, such as a 2009 date found on the hard drive.
The Camera Card as Evidence
A Forensic Toolkit (FTK) report made from the second forensic copy of the camera card was used to prove that Raniere took 41 nude photos of adult women, also allegedly in 2005, and placed them in the same folder on the hard drive where the contraband was found.
Camera to camera card to computer to hard drive.
Despite a requirement to produce forensic copies of the camera card for the defense in discovery before or during the trial, the DOJ elected not to provide them, and Raniere’s legal team failed to demand them. Instead, the DOJ only produced FTK reports, which summarized the contents, but did not contain the camera card’s complete data.
There has been ongoing legal debate over whether Raniere has a post-conviction right to evidence, even if it was suppressed at the trial. However, Raniere argues the DOJ opened the door to access by providing the camera card copies to Loveall, who then used them to rebut Raniere’s tampering claim in his Rule 33 motion.
Without the camera card copies, Raniere argues he cannot challenge Loveall’s assertion that the two camera card copies are identical.
One Copy Was Enough
Raniere points out that his forensic experts say the FBI making two forensic copies of the same device is improper.
J. Richard Kiper leads Raniere’s team of forensic experts. View his report here.
According to these experts and published reports, FBI protocol for handling digital evidence involves creating only one (not two) forensic copies of an original device. Once the forensic copy is made, it is verified with hash values to ensure it is an exact replica of the original. After verification, this copy, rather than the original device, is used for all subsequent investigations and reporting.
FBI Forensic Examiner Stephen Flatley made the first forensic copy of the camera card in April 2019, about a month before the trial. From this copy, he created an FTK report showing that only four image files on the camera card were found on the hard drive.
During the trial, FBI Forensic Examiner Brian Booth made a second forensic copy of the original camera card. He also made an FTK report from this second copy. He found 37 more image files that matched the hard drive than Flatley found in his FTK report.
How Did New Images Appear?
The discrepancy between reports raised the question: Did someone add these 37 newly appearing images to the camera card after FBI Forensic Examiner Flatley created his copy?
In his report, Loveall says no. He said Flatley’s failure to detect the 37 newly appearing image files was simply due to his not entering the correct settings in the FTK software.
How does he know?
Loveall said he examined both forensic copies and determined them to be identical:
“Although both reports used the same processing tool—AccessData Forensic Toolkit 6.3.1.26—There are numerous configurations and setting options for this tool, which can result in the generation of different reports. The fact that additional files appeared in one report is a result of the use of different settings.”
How Did Flatley Miss So Much?
FBI Forensic Examiner Stephen Flatley- Did he miss a lot on the camera card or was it not there at the time?
In his report, Loveall did not specify what FTK settings Flatley might have failed to use in his analysis of a forensic copy of the camera card, which would cause him to miss 37 image files on the camera card — evidence that Raniere took the contraband photos.
Loveall also did not specify which possible settings FBI Forensic Examiner Brian Booth might have used to find 37 new photo flies – all used as evidence – while using the same FTK software on what were supposedly identical copies of the camera card.
It would behoove Loveall to share that information with FBI FE Flatley who, if Loveall is right, clearly does not know how to analyze a camera card. It might explain why the FBI sent Flatley to Ghana during the last week of the trial, making him unavailable to testify.
Loveall might also provide some instruction to FBI Forensic Examiner Brian Booth, who apparently did not know that he should not have made a second forensic copy to make his FTK report, but should have made his FTK report (with its different settings) from the original forensic copy made by Flatley.
While Loveall is at it, he might school the FBI on evidence handling. The custody history of the camera card is filled with inconsistencies. At first, the DOJ did not disclose the camera card’s existence, and instead gave the defense printed photos taken from it, suggesting they were from the camera and not the camera card. The original camera card went in and out of the evidence room and was handled by various FBI employees, including at least two FBI agents who were not authorized to access the card and should not have had custody of it.
Someone at the FBI accessed the camera card without authorization and failed to use a required write-blocker, and, therefore, altered at least the last access date on the files on the camera card.
In addition to unauthorized access, the chain of custody was broken, and it appears the camera card was transferred from agent to forensic examiner to agent to forensic examiner without sealing the evidence.
DOJ Does Not Want Raniere to Have a Look
Raniere by MK10ART
Despite this list of anomalies concerning the camera card, the DOJ argues Raniere has no right to see the camera card copies to challenge the new evidence that the DOJ is currently using against him in the Rule 33 proceeding. The judge agrees.
Instead, Raniere should simply take Loveall’s word that the two forensic copies are identical.
Loveall’s word might be more persuasive if he provided the “hash values” (a unique string of characters generated by a hash function, it is like a digital fingerprint) of the two forensic copies of the camera card. After all, that is the standard proof required to confirm that the two copies are byte-for-byte identical.
As FBI FE Booth testified at Raniere’s trial the FBI uses “MD5 [Message Digest Algorithm 5, a type of hash value] to verify that files haven’t been changed from me burning it onto a disk for you to then later look at, to going back to the original evidence and making sure that what we have as a copy hasn’t changed.”
MD5 produces a 128-bit (16-byte) hash value, typically a 32-character hexadecimal number. The term “digital fingerprint” is often used because, much like a human fingerprint, the MD5 hash uniquely identifies a particular data set. If even a tiny aspect of the original data changes, the MD5 hash will be entirely different, making it a valuable tool for ensuring data integrity, like for instance proving nobody changed the camera card.
However, Loveall chose not to provide the MD5 digital fingerprints to prove his point.
If nothing else, the DOJ could disclose the hash numbers of the two forensic copies of the camera card, which could confirm the two forensic copies of the camera card are the same.
Denial Leaves Mystery
Denying the camera card copies to Raniere will likely ensure that the court record will not show how 37 photo files appeared in Booth’s FTK report, which were not in Flatley’s FTK report.
If given access to the camera card copies, Raniere’s forensic experts could inspect the contents and check the digital fingerprints of each forensic copy.
If it is shown that the 37 images were added to the camera card between its first and second copies, it would suggest the contraband photos were also added or altered on the hard drive, as Raniere claims.
On the other hand, if there is nothing amiss, as Loveall says, why not provide access to the forensic reports of the camera card which Raniere should have had during the trial, and end all doubt?
I can think of only one reason why the government would not want to release the camera card copies.
There is no contraband on it. And there is certainly nothing Raniere could do with the copies to tamper with them, since the FBI still has the original camera card, and of course two forensic copies, which are supposedly identical (but hidden from the defendant) and two FTK reports, which are about as different as any two FTK reports seeking the same image file evidence could possibly be.
Raniere in his abode by MK10ART
