Keith Raniere went on trial on May 7, 2019. A jury convicted him on June 19, 2019, of, among other charges, racketeering, with predicate acts of possession of child pornography and sexual exploitation of a minor.
For this article, I am uninterested in his guilt or innocence.
I am not interested in whether he took photos or not, or how old Camila was when he took them.
I am interested in how the FBI testifies about metadata.
FBI forensic examiner Brian Booth testified about metadata, in particular a kind of metadata called EXIF data, which is, among other data, a kind of birth certificate for photos. EXIF data provides a creation date of photos.
Booth testified that EXIF data was reliable.
As we pointed out earlier, FBI Senior Forensic Examiner Stephen Flatley was taken off the case near the end of the trial because, as the DOJ prosecutors told Judge Garaufis, he had to go to Ghana, Africa.
Longtime readers of FR know Ghana is where a woman named Nancy claimed to live when a group of scammers swindled Ronnie, an old and lonely man, out of his life savings.
This photo above was used to lure Ronnie Robinson to send money to Ghana.
We do not know what lured Flatley to Ghana, whether it was Nancy or something else altogether.
We pointed out that there may have been another motive to get FBI FA Flatley out of New York and over to Ghana, though the Ivory Coast, Burkina Faso or Togo would have worked just as well.
That was because Flatley testified at another trial three years earlier that metadata, including EXIF data, is unreliable.
But EXIF data had to be reliable for Raniere’s case. For that was the only direct evidence of child porn – metadata creation dates.
They had circumstantial evidence that Raniere had sex with Camila when she was 15 or 16, texts and hearsay from her sister, but Camila was not going to testify. They had no proof he took underage pictures of Camila without the metadata. The charges concerned photos, not whether he had sex with her.
And there was conflicting metadata. One set of metadata showed the photos were taken in 2003, a year before the camera was manufactured.
The US DOJ alleged Raniere used a Canon camera to take 22 explicit photographs of Camila when she was 15.
The prosecution relied on information embedded inside the digital photographs, called Exchangeable Image Format (EXIF) data.
A Canon digital camera records how a photo was taken, on what date, and with which camera settings. This is called EXIF data.
The prosecution used Camila’s photos’ EXIF data’s creation date – November 2005 – to prove she was underage in the pictures.
How reliable is EXIF data?
Brian Booth started with a regular sized nose until the prosecutor touched him with her magic wand.
According to the FBI’s expert witness, Senior Forensic Examiner Brian Booth, a photo’s EXIF data is reliable because it is “very hard” to change.
Question: Is there a particular reason why EXIF data is more
difficult to alter?
Booth: They purposely designed it that way.
Question: Do you know —
Booth: It’s mainly to be able to store information. And they
don’t want data to be moved around and changed, especially time and date information. Those things are very hard for the
consumer to be able to modify, unless you wind up getting
software that’s just developed to do that (p.4820).
Booth: Well, the best reference is the EXIF data because that
gets put into the JPEG file and it’s not easily modifiable and
it moves with the file the same way from device to device, no
matter where you place it. It has nothing to do with the bearing
of a file system at all or the dates and times associated with
it. So it’s on its own, but are created at the same time that
you take the picture (p.4830).
Booth:… But when it comes to photos, they still keep you from
changing dates and times. It’s not easy to change those. You
have to go through special processes to change those things.
(p.4977)
The above are a few of Booth’s statements about the reliability of EXIF data and how hard it is to modify.
The FBI’s expert witness told the jury EXIF data is “extremely reliable” and “very hard” to modify.
The FBI witness, a digital forensic examiner, swore under oath that EXIF data cannot be easily modified.
The prosecution wanted the jury to believe that EXIF data could not be easily modified, because it was the only digital evidence that supported they were photos of an underage subject.
FBI Forensic Examiner Booth testified because Flatley had to go to Ghana. FBI records show Flatley was in New York in June, more than a month into the trial.
It has been supposed that Flatley was not allowed to testify because his view of EXIF data is not the same as Booth’s.
We know this because Flatley testified at another trial.
Flatley
It was US v John Galanis, Jared Galanis, Derek Galanis, Gavin Hamels, Ymer Shahinin, Jason Galanis, Gary Hirst.
Without getting into details of that case, I will quote from the 2nd Circuit about Flatley’s role.
“The government qualified one expert, Stephen Flatley, an FBI computer forensics professional, solely to rebut (in advance) testimony Hirst offered concerning the Warrant Agreement metadata, which showed it was not backdated.
Flatley testified, over objection, that nothing about the Warrant Agreement metadata indicated alteration, and that the FBI does not rely on metadata alone in determining a document’s date because metadata can be manipulated.
The defense took the same position in Hirsh’s case that the prosecution took in Raniere’s case — that metadata – including EXIF data – was reliable and pointed to the defendant’s innocence, just like it pointed three years later to Raniere’s guilt.
Either that or truth is not important to the government, only winning is important. EXIF data is either reliable or not.
You can read Flatley’s complete testimony here.
Here are some excerpts
On September 20, 2016 Flatley testified.
Q. Now, Mr. Flatley, does the FBI rely on creation dates alone in PDF files in determining the date on which that PDF file was, in fact, created?
A. No, we do not do that. …
***
Q. In your experience, Mr. Flatley, what sorts of things does
the FBI rely on in determining the create date of a particular
computer file?
A. We would require that we have some kind of corroborating
evidence [besides EXIF data]. For instance, if the file had been emailed, we would want to see that email and be able to open up what we call the long header on that email. For instance, when you email something to somebody, it goes from your computer, through a number of servers, to their computer. You can change your time
and date on your computer, but you will not be able to change
the time and date on, for instance, AT&T’s computer when the
file passed through there.
When the file passes through there, that server will give it a timestamp, and that timestamp is unalterable from the user standpoint, and most users don’t even know it exists. That would be a date that we would rely on.
So something that was not just from the standalone system that would require some kind of corroboration or something outside of the user’s control.
Q. In your experience, does the FBI rely on create dates in metadata of a PDF file alone in determining the date on which a document was created?
A. No, we do not.
Q. Now, what are some reasons that the create date in a PDF
file that’s reflected in the file’s metadata may not match the
actual creation date?
A. A computer’s clock is too easily changed. It’s very easy
to go down and change your time and date on the machine. It’s
also a standalone system. It could just flat be wrong….
***
Q. Are there software products available that would allow a
user to change the create date reflected in the metadata on the
PDF file?
A. There are a number of programs that will allow you to change metadata on a PDF file or a Word file.
Q. How can a computer user access such software?
A. You just download it from the web.
***
Q. Mr. Flatley, what is the create date reflected in this particular document’s metadata?
A. It is April 9th, 2010, 11:05:03 p.m.
***
Q…. Based on your training and experience, would the FBI rely on the create dates alone in the metadata of Government’s Exhibits 509A through D in determining the dates on which these documents were created?
A. No, we would not.
Q. What other information would you need to make that
determination?
A. Some other kind of corroborating evidence.
Q. So Mr. Flatley, in your opinion, can you conclude that
Government’s Exhibits 509A through D were created on the dates
reflected in the metadata in those documents?
A. I cannot.
So metadata such as EXIF data is not reliable to Flatley but it is to Booth.
Booth said:
“[EXIF data] stays into that photo and it’s very hard to remove.”
“Most commercial software will not touch EXIF data.”
“They purposely designed it that way…”
“They don’t want data to be moved around and changed, especially time and date information.”
“When it comes to photos, they still keep you from changing dates and times.”
“It’s not easy to change those.”
AUSA Moira Kim Penza told the jury:
Now you also know that the photographs were taken in 2005 because that’s what the data shows. The forensic examiner, Brian Booth testified that the most reliable metadata that the FBI could obtain from the images on the Western digital hard drive, said that they were taken exactly when the folders stated they were taken.
AUSA Mark Lesko told the jury:
I’m no expert, don’t get me wrong, but I heard Examiner Booth, just like you did. EXIF data is extremely reliable. It’s embedded in the jpeg, in the image itself. And the EXIF data shows that the data was created on the camera, in this instance, this particular instance, the 150 jpeg [one of the Camila photos] on November 2, 2005…
But with EXIF data, once it’s embedded in a picture, it doesn’t matter how many times you move it around. It stays into that photo and it’s very hard to remove. In fact, most commercial software will not touch EXIF data. It will allow you maybe to add data to it, but even in that sense, it’s in this instance, this particular instance, the 150 jpeg [one of the Camila photos] on November 2, 2005.
It’s a good thing they sent Flatley to Ghana, or even if they didn’t, it’s a good thing the prosecutors told the judge he went to Ghana.
Where in Ghana did Flatley go? Was it nearer Kumasi or Bobo-Dioulasso? Did he run into Nancy?
Booth testified because Flatley was in Ghana.
But if Flatley had testified, and Booth too, both of them, they might have confused the jury.
Flatley said the FBI would never rely on EXIF creation date metadata.
Booth said it was reliable, because they make it hard to change.
It’s harder to change EXIF data than not to take a trip to Ghana, but have someone say you did.
The two men disagree on things, or see things a different way.
When Flatley did his FTK report on the camera card found inside Raniere’s Canon camera, he found only four photos that matched the hard drive where Camila photos were found.
When Flatley had to go to Ghana, Booth had to make a brand new FTK report on the same camera card. And guess what?
Booth found 37 photos that matched the hard drive, making it almost 10 times better for showing Raniere’s camera took Cami’s photos in 2005.
A photo of a Lexar camera card similar to the one seized at the executive library of Keith Raniere.
Booth found 34 new photo files, but some were mixed up, and a brunette named Daniela and a blonde named Angel traded places on the hard drive and the camera card.
Somehow, other than the mixed up brunette and blonde, all the new photo files could not be opened, but the EXIF data bore out everything Booth said — all matched to a tee.
But even though the files cannot be opened, we have Booth’s good word for it, and if Flatley wasn’t in Ghana, we might have asked him too.
