This is Part #8 of the Alleged FBI Tampering series.
You can find links to the other reports at the bottom of this post.
The question is not whether Keith Raniere is good or evil. Most readers have the answer. The question before us is whether the FBI played by the rules.
On February 19, 2019, the FBI found 22 photos of 15-year-old Camila on a hard drive.
The FBI had seized that hard drive almost a year earlier during a raid of Keith Raniere’s townhouse in Half Moon, New York, on March 27, 2018.
The camera was under the desk and hard drive on a shelf.
The discovery of the photos on the hard drive changed the case. It provided the prosecution with its first and only non-adult victim.
The FBI discovered the child porn accidentally. It was a few weeks before the trial. The photos’ metadata dates to 2005, when Camila was 15. This was evidence of possession of child porn.
Exploitation of a child charges required further proof. That Raniere took the pictures. For this, a Canon camera and camera card, also seized during the raid, were the main evidence.
The Government’s narrative regarding alleged contraband found on a “backup” drive.
The FBI did not disclose the camera card until just before the trial.
The camera card did not contain any of the photos of Camila. But the camera card contained photo files found on the hard drive.
They were in the same folder as Camila’s photos. The folder was called “Studies.”
The number of photos on the camera card that matched files on the hard drive seemed to have changed.
The trial began with an exhibit of an FBI report that showed four files on the camera card that matched files on the hard drive.
During trial, this exhibit was replaced with a new FBI report. The new report showed that there were 37 files on the camera card matching files on the hard drive.
Camera card
Raniere’s forensic expert, Dr. J. Richard Kiper, explains the differences between the two FBI reports.
Dr. Kiper wrote:
The FBI completed two forensic examinations and generated two
different reports on the same evidence: A compact flash (CF) card found in a digital camera case.
The Government claimed digital photographs from this CF Card were eventually backed up to a Western Digital hard disk drive (WD HDD), which also contained alleged child pornography.
The First Camera Card Report
Figure 1 illustrates the initial relationship between files on the CF [camera] card and the alleged “backup” of those files contained in the WD HDD [hard drive]. According to the FBI’s report on 04/11/2019, four photographs were reported as common to both devices.
Kiper continues:
Both forensic reports [of the hard drive and the camera card] were generated on the same day, April 11, 2019.
The CF Card report was created by FBI Forensic Examiner Stephen Flatley, who kept the CF Card until June 7, 2022.
FBI Forensic Examiner Brian Booth created the WD HDD [hard drive] report using a forensic copy made by his trainee.
Only four photos, named IMG_0180-183, are common to both the hard drive and the camera card’s forensic reports.
At this time, no other files on the CF Card report could be shown to be “backed up” to the WD HDD.
The FBI made their first report of the camera card on April 11, 2019. This was just shy of a month before trial started. The trial started May 7, 2019.
The four photos common to the hard drive and the camera card in the FBI’s first report of the camera card are #180-183. The photos are of Angel, a friend of Raniere’s.
Near the end of the trial, on June 11, the FBI made a second forensic report of the camera card.
The Second Forensic Report
Kiper explained.
As documented in the Chain of Custody, FBI Special Agent Christopher Mills delivered the CF Card in an unsealed bag to FE Booth on June 10, 2019, during the last week of trial and more than 14 months after the search team had collected it.
In Figure 2, the introduction of new files to the FBI’s June 11, 2019 “replacement” forensic report creates an obviously stronger relationship between the devices.
In all, 37 photos with filenames matching those on the WD HDD were added to the June 11, 2019 report in small, contiguous groups of files.
Unfortunately – or perhaps, conveniently – none of the new files were viewable as photographs in the second report. As a result, none of the new files could be verified visually or forensically against their namesakes on the WD HDD report.
None of the new files appearing on the June 11, 2019 report (shaded green) was viewable in the report.
No explanation was provided for the appearance of the new files or why they were unviewable.
All the previous CF Card files (in white) are viewable in both CF Card reports.
The alleged contraband [Camila’s] photos, IMG_0150-163 and IMG_0184-191, appear in neither of the CF Card reports.
If the government’s narrative was correct, [based on the newly discovered files in the second report] then one would reasonably expect some remnants of these photos to have been included on the FBI’s reports.
The FBI never provided an explanation for the appearance of new photos on the June 11, 2019 report, or why they were the only
photos on the CF card that were not viewable in the report….
A plausible explanation is that someone with physical control of the CF Card:
Recognized the weak relationship between the photos reported on the April 11, 2019 CF Card report and those reported as “backup” files on the WD HDD, including alleged contraband.
Examined the file listing of the WD HDD and chose a convenient range based on filenames (IMG_0081-100) rather than their saved folders.
Created the appearance (through file and metadata manipulation) that those files had been discovered on the CF Card as reported on the June 11, 2019 report
Botched the file creation and deletion of the new files, rendering them unviewable in the June 11, 2019 report.
The modified date/time stamps between the new files in the June 11, 2019 report and their namesakes on the WD HDD did match.
However… such metadata is easily changed, and in this case it was
obviously manipulated, enhancing the CF Card – WD HDD relationship required by the Government’s narrative.
Kiper Conclusion:
The Raniere defense team was provided the FBI’s forensic report of the CF Card generated on April 11, 2019 and then the second “replacement” report, generated on June 11, 2019 and contained 37 additional files.
Frank Reply:
Kiper mentions, in addition to the appearance of new files on a second CF Card forensic report, that the camera card was modified on September 19, 2018, while in FBI custody.
The FBI went on the original device and did not use a write blocker as required by FBI policy. When Booth was asked at trial who made the unauthorized access of the camera card, he did not know.
Kiper also mentions that an FBI agent delivered the camera card to Booth in an unsealed cellophane bag just two days before FE Booth took the stand.
Kiper:
FBI policy requires the securing and sealing of evidence, and employees may be disciplined if they fail to do so. In my experience with the FBI, I never received unsealed evidence other than in emergency situations.
The information above, by itself, may mean nothing.
So the FBI chose lost custody of the camera card and did not know who accessed it. Or that they handed the camera card in an unsealed bag so the chain of custody was broken.
And they did a second report on the camera card, just before the FBI put on its witnesses on the digital evidence. And so they found 37 new files.
If there were no other inconsistencies, one might write this off to “the FBI would not cheat. They had their man.”
But there are other inconsistencies. And we will get to them.
But let’s face it, this is an inconsistency. Two reports, done on the same device, with staggeringly different results.
I have not mentioned that FBI Forensic Examiner Booth violated FBI rules by making two forensic reports off the same original digital device without proper authority.
Kiper served as an FBI Special Agent for 20 years, from 1999 to 2019. In the FBI, he served as a case agent, a supervisor, a unit chief, a forensic examiner, a trainer of forensic examiners, and a
trainer of trainers of forensic examiners.
That means he trained people like Forensic Examiners Booth and Flatley.
He says making two reports from the same digital evidence is an FBI violation, unless there is top level approval.
Kiper says
The FBI Digital Evidence Policy Guide, Section 3.3.11.2 states, “Unless approved by the AD, OTD as outlined below, examinations are not conducted on any evidence that has been previously subjected to the same type of technical examination (hereinafter referred to as a ‘re-examination.’)”
One of the reasons for this policy is to “[e]nsure that the integrity of the evidence is maintained.”
During the trial, FE Booth failed to disclose that his actions constituted a prohibited re-examination of digital evidence.
According to FE Booth’s notes, FBI special agent Michael Lever requested FE Booth “process” the camera and the CF card because FE Flatley “would be overseas during trial.”
But Flatley was not overseas during the trial.
According to the Chain of Custody, FE Flatley relinquished custody of the CF card to FBI Special Agent McGinnis on June 07, 2019, so he was not yet “overseas.”
A month into trial, Flately could have testified?
FE Flatley was available to testify to his examination of the CF card, to
include the forensic report he generated on April 11, 2019, at any time during the preceding four weeks of trial, which began on May 7, 2019. There was no legitimate need to re-examine the CF card and create a second report.
If FE Flatley was available to relinquish custody of the physical CF card on June 7, 2019, then he was also available to provide FE Booth with the forensic copy of the CF card he created.
FE Booth should have used the existing forensic copy to generate a new report, if needed, rather than create his own forensic copy.
By creating a new forensic copy of the CF card, Booth conducted a “re-examination” – a duplication of all the technical steps that FE Flatley had already completed.
CART policy strictly prohibits such re-examinations, unless approved by the executive management of the FBI Operational Technology Division.
I could not find a record of such an approval. Instead, according to his notes, FE Booth only obtained approval from his acting supervisor Trenton Schmatz to proceed with the re-examination.
It reminds me of an old song, “How do files suddenly appear; every time the FBI is near?”
Of course, none of this means Raniere is innocent. The question is not whether Raniere abused Camila. Most readers have their own opinion.
The question is whether the FBI broke the law or played by the rules.
Part #1: Analysis of Allegations of FBI Tampering in USA v Raniere
Part #2 Analysis of FBI Tampering Daniela and Her Relationship With Raniere and Computers
Part 3: Analysis of Alleged FBI Tampering — Camila
Part #5 Alleged FBI Tampering: Delay, Delay, and Hide the Camera Card
Part #6: Alleged FBI Tampering: Accidental Discovery of Child Porn on Hard Drive
Part 7 Alleged FBI Tampering – New Photos Appear on Camera Card After FBI Lost Custody
