Stephen Flatley has an entirely different view than Brian Booth. And Brooklyn looks different than Ghana too.
In the USA v Hirst, Stephen Flatley, an FBI computer forensics professional, testified, over defense objection, that the FBI does not rely on metadata alone in determining a document’s date because metadata can be manipulated.
This was different from what forensic Examiner Brian Booth testified in USA v Raniere — that EXIF data [which is metadata] is hard to change and very reliable.
Here is Rick Kiper’s take on the matter of conflicting views of metadata reliability.
By J. Richard Kiper, PhD, PMP
FBI Special Agent (Retired) and Forensic Examiner
Professional Background
I served as an FBI Special Agent for 20 years, from 1999 to 2019, with more than half of that career in cybersecurity and digital forensics. In the FBI, I served as a case agent, a supervisor, a unit chief, a forensic examiner, a trainer of forensic examiners, and a trainer of other trainers of forensic examiners.
I have personally sworn out affidavits for dozens of search warrants and collected, preserved, and analyzed hundreds of pieces of digital evidence. Therefore, I have in-depth knowledge of FBI evidence handling procedures and digital evidence examination procedures and policies.
Introduction
In the case U.S. vs. KEITH RANIERE et al., the government contended Raniere used a digital camera to take explicit photographs of women, saved them to a camera card, transferred them to an unidentified computer, and then backed them up to an external hard drive.
The camera card and the “backup” hard drive comprised the only digital evidence used at trial. According to the government’s narrative, all the backed-up photographs were taken in the year 2005, at a time when one of the women was 15 years old. The government argued that if the pictures were taken in 2005, then 22 photos of the backed-up photos would constitute child pornography.
In order to date these photographs, the government relied on two pieces of digital information – the names of the folders containing the photos and the “Create Date,” saved inside the content portion of the photo called EXIF data.
The problem is that both pieces of data are forensically unreliable. Any computer user who has created a folder realizes how easy it is to modify a folder name. And while fewer people know how to modify the embedded “Create Date” in a photo’s EXIF data, I have conclusively demonstrated the ease of modifying this data using Windows functionality with no special skills or tools.
Nevertheless, the government insisted that EXIF data is “hard to change” and “is extremely reliable.’
Senior Forensic Examiner (SFE) Brian Booth was the FBI’s expert witness who testified under oath about the reliability of EXIF data. He did so after being requested to conduct a second forensic examination of the camera card, which he had received in an unsealed package during the final days of the trial.’
SFE Booth produced a “replacement” forensic report of the camera card on 06/11/2019, and it contained 37 additional files not included in the first FBI forensic report.
Although 31 of the 37 new files had namesake counterparts on the alleged backup hard drive, the new files had several metadata issues and showed dispositive evidence of manual alterations.
SFE Stephen Flatley was the first forensic examiner to examine that camera card and had produced a report two months earlier, on 04/11/2019.
However, the government declined to put SFE Flatley on the stand to explain his report. Instead, during the fifth and final week of trial, the government abruptly gave SFE Flatley an overseas assignment and, through the hands of several people, transferred the camera card to SFE Booth in an unsealed package.
Until recently, the government’s refusal to use SFE Flatley and his report during the first four weeks of the trial was an inexplicable decision. However, I believe SFE Flatley’s testimony on a previous case could shed some light on this mystery.
As I will explain in the following pages, SFE Flatley’s previous testimony directly contradicted SFE Booth’s testimony regarding the reliability of metadata dates, and to be consistent [with his previous testimony], SFE Flatley likely would not have supported the government’s claims in the U.S. vs. KEITH RANIERE.
The 2016 Trial Testimony of SFE Stephen Flatley
On 09/20/2016, SFE Flatley was called to testify as the government’s expert witness in the U.S. vs. GARY HIRST case.
After qualifying SFE Flatley as an expert witness, prosecutor Brian Blais immediately began questioning SFE Flatley on metadata and dates:
Q. Where is metadata stored?
A. There is two different places overall where it could be stored. It could be stored in the computer’s file system in the computer itself. So the overall creation date of the file could be stored there. Certain files also have metadata stored inside them. Things like Word documents, PDF documents, some photographs, like JPEGs, and a certain type called JPEG Exif will have certain other aspects of metadata inside of it.
Q. How is metadata generated?
A. It’s generated at the time the file is created, and then it can be modified at later dates.
During this exchange, it was appropriate for SFE Flatley to mention the similarity of metadata stored inside PDF documents with that [metadata] stored inside JPEG (photo) files as EXIF data.
Indeed, PDF files and JPEG files store “Create date” information in essentially the same way – by inserting the date and time into the file’s content.
To illustrate this, I opened the PDF document Government’s Exhibit “GX 505A.pdf,” representing the FBI’s forensic report of the external hard drive in this case.
By clicking File> Properties> Additional Metadata, I could view the document’s imbedded “Create Date” as 04/11/2019.
.
Using a forensic tool, FTK Imager, I verified that the date is indeed part of the content of the file, rather than stored elsewhere in the file system, by opening the same GX 505A.pdf document and viewing the hexadecimal representation of the data:
Using these two screenshots, one can observe the imbedded date/time of “04/11/2019 11:32:44” is saved as the “Create Date” value inside the content of the “GX 505A.pdf’ file.
This is exactly what SFE Flatley described during his testimony. As SFE Flatley mentioned during his testimony, JPEG photo files also contain metadata, stored essentially in the same way inside the file’s content as EXIF data.
In the following screenshot, I viewed the properties of “IMG_0043.JPG,” a JPEG photo file in this case. The EXIF create date is displayed as “10/17/2005 12:30AM,” which Windows interprets as “Date taken.”
Loading this file into another program, Exiftool, one observes the name of metadata create date of the JPEG is identical to that of the PDF, which is “Create Date”:
Using the same procedure used for the PDF document, I opened the JPEG file using FTK Imager and verified the date in the content of the photo file:
Although the majority of SFE Flatley’s testimony addressed metadata embedded inside PDF documents, he immediately drew a similarity to metadata inside JPEG photo files.
Indeed, as the above exercise demonstrates, they are essentially created and stored in the same way.
More importantly, SFE Flatley stated another aspect of metadata in the transcript excerpt cited above.
Immediately after mentioning JPEG EXIF data, SFE Flatley revealed that metadata stored inside files “can be modified at later dates.”
How?
SFE Flatley testified that Exiftool and Xpdf, two freely available software tools, may be used to modify metadata in JPEG and PDF files. In fact, with respect to these publicly available metadata authoring tools, SFE Flatley testified, “[T]here’s a bunch of them.”!
How would a person obtain such a tool?
SFE Flatley testified, “You just download it from the web.”?
The Unreliability of Embedded Metadata Dates
Because their determination of child pornography solely depended on the created dates of the photographs, the FBI’s expert witness SFE Brian Booth and DOJ’s prosecutor Tanya Hajjar went to great lengths to convince the jury of the reliability of EXIF data.
What follows are just a few statements from their exchanges during trial:
Q. Is there a particular reason why EXIF data is more difficult to alter?
A. They purposely designed it that way.
Q. Do you know —
A. It’s mainly to be able to store information. And they don’t want data to be moved around and changed, especially time and date information. Those things are very hard for the consumer to be able to modify, unless you wind up getting software that’s just developed
to do that.
Later in his testimony, SFE Booth admitted that the file system Created date for all the “backed up” photos, including the alleged contraband, was in 2003.
Canon Camera EOS 20D. The create dates of the Camila photos are 2003, one year before the camera was manufactured.
This would mean the photos were copied to the external hard drive two years before the government claimed they were taken – a physical impossibility.
Therefore, after recognizing they could not rely on the file system create dates for the backup files, SFE Booth and prosecutor Hajjar turned their attention back to the easily modifiable EXIF data to support the create date they needed the jury to believe.
Q. You testified that the EXIF data shows the date and time associated with this is October 18, 2005?
A. Yes.
Q. And so between the dates here and the EXIF data, what’s the best evidence of when this photograph was taken?
A. Well, the best reference is the EXIF data because that gets put into the JPEG file and it’s not easily modifiable and it moves with the file the same way from device to device, no matter where you place it. It has nothing to do with the bearing of a file system at all or the dates and times associated with it. So, it’s on its own, but are created at the same time that you take the picture.
These are just a few of SFE Booth’s statements regarding the reliability of EXIF data and how difficult it is to modify. The court transcript records I 5 pages of SFE Booth and prosecutor Hajjar mischaracterizing the reliably of EXIF metadata.
Again, to support their narrative that the alleged contraband photos were taken in 2005, the government needed the jury to believe the reliability of the metadata.
The reliability of the EXIF data was so crucial to the government’s charge of child pornography, prosecutor Mark Lesko emphasized Booth’s testimony during his closing argument to the jury:
Mark Lesko
LESKO: … I’m no expert, don’t get me wrong, but I heard Examiner Booth, just like you did. Exif data is extremely reliable. It’s embedded in the jpeg, in the image itself. And the exif data shows that the data was created on the camera, in this instance, this particular instance, the 150 jpeg on November 2, 2005.”
SFE Flatley, the FBI’s expert witness in a previous trial, would disagree:
Q. Now, Mr. Flatley, does the FBI rely on creation dates alone in PDF files in determining the date on which that PDF file was, in fact, created?
A. No, we do not do that.
Earlier, I demonstrated that PDF and JPEG files use the same method for storing metadata for creation dates.
In fact, PDF files and JPEG files even use the same metadata tag, “Create Date,” to record this information. Since SFE Flatley discussed the composition of JPEG files alongside PDF files in his testimony, he would similarly testify that the FBI does NOT rely on creation dates alone to determine the date on which a JPEG file was created.
Why not?
According to SFE Flatley, the FBI “would require that we have some kind of corroborating evidence.’?”
To rely upon the metadata “Create Date” in either a PDF or JPEG file, the FBI would require corroborating data from other devices and mechanisms that possibly stored or transmitted the file, but these devices must be “outside the user’s control.”
A. So something that was not just from the standalone system that would require some kind of corroboration or something outside the user’s control.
Despite SFE Flatley’s claim to the contrary, in the case U.S. vs KEITH RANIERE, the FBI used no other devices, systems, or mechanisms to corroborate the easily modifiable EXIF metadata dates in the JPEG files.
Instead, the FBI consistently claimed EXIF metadata was reliable by itself and difficult to change, as SFE Booth testified on cross examination:
A [Booth]. But when it comes to photos, they still keep you from changing dates and times. It’s not easy to change those. You have to go through special processes to change those things.
By contrast, SFE Flatley gave a very different answer when asked for reasons why a create date “reflected in the file’s metadata may not match the actual creation date.”
SFE Flatley testified to several reasons why file metadata dates are unreliable:
Flatley A. A computer’s clock is too easily changed. It’s very easy to go down and change your time and date on the machine. It’s also a standalone system. It could just flat be wrong. The clock could be off, it could have been changed either inadvertently or by, what’s the word I’m thinking of, just, you know, just out of habit or something of that nature that they just change the time, date. Also, your machine, when it’s off, relies on a battery to keep the clock up. It’s called the cmos battery. If that battery dies, the clock will revert to its beginning.
Just as SFE Booth repeatedly testified that the FBI considered metadata create dates reliable, SFE Flatley repeatedly testified that the FBI considered metadata create dates unreliable:
Q. Based on your training and experience, would the FBI rely on the create dates alone in the metadata of Government’s Exhibits 509A through D in determining the dates on which these documents were created?
A. No, we would not.
SFE Flatley’s position regarding the unreliability of metadata create dates was not an ancillary opinion – it was the entire purpose for his testimony.
As the prosecutor concluded his direct examination:
Q. So Mr. Flatley, in your opinion, can you conclude that Government’s Exhibits 509A through D were created on the dates reflected in the metadata in those documents?
A. I cannot.
Conclusion
In the case U.S. vs KEITH RANIERE it is notable that SFE Flatley, an FBI expert witness who
previously testified to the unreliability of metadata create dates, was replaced in the last week of trial by SFE Booth, who testified to the reliability of metadata create dates.
And although the government did not allow SFE Flatley to testify in the RANIERE case, much of his prior testimony directly supports the findings in my Summary of Technical Findings report.
SFE Flatley testified about the impossibility of a file content being changed without its file
system Modified date being updated. When asked about the Modified date, SFE Flatley said, “It reflects the last time that a change was made to that file and then that file was saved again. So if you were to change something in a file and then not save it, that date would not be touched. But if you change anything on the file and then save it again, the modified
dated will be altered.”
This statement alone supports nearly all the findings of manual alterations in my Summary of Technical Findings report.
In addition to demonstrating elsewhere how easy it is to change metadata create dates, in this paper I forensically demonstrated that PDF files and JPEG files name and store the “Create Date” value in same way- inside the content of the file.
In his 2016 testimony SFE Flatley not only argued strongly that metadata create dates are unreliable, but he also did not waver from this opinion or draw any distinction between metadata create dates in PDF files versus those in JPEG files.
Consider SFE Flatley’s expert opinions made under oath:
SFE Flatley highlighted the similarity between metadata stored inside PDF files and metadata stored inside JPEG files.
SFE Flatley described two different free tools anyone could use to modify metadata such as EXIF data.
SFE Flatley declared such tools are easy to obtain from the Web.
SFE Flatley declared on at least four occasions that metadata create dates are unreliable.
SFE Flatley described several ways metadata create dates could be altered.
SFE Flatley declared that the FBI in particular does not rely on metadata creation dates alone to determine when a file was, in fact, created.
To defend SFE Booth’s testimony against SFE Flatley’s testimony, one may argue that a PDF
document is not the same as a JPEG photo. However, to discount SFE Flatley’s damning testimony about the unreliability of metadata create dates, one would need to prove that metadata stored inside the content of a JPEG photo file is somehow more reliable than the metadata stored inside the content of a PDF file.
It is not. In fact, quite the opposite – It is much easier to modify the EXIF create date of
a JPEG file.
Thus, in U.S. vs KEITH RANIERE, there is no doubt that the government mischaracterized the
reliability of EXIF metadata during trial testimony. No doubt SFE Flatley would agree with that assessment, based on his past testimony, if he were given the opportunity to testify in this case.
Joseph Tully, Raniere’s attorney, sums up:
SFE Booth testified while under oath that metadata, such as EXIF data and “creation dates,” was difficult to change and, in fact, was designed to be difficult to change.
This testimony regarding the reliability of the 2005 dates bolstered the government’s narrative that the 22 photos of Camila were contraband.
However, in actuality, EXIF data is quite easy to change, and anyone can do so on a home computer with no special skills or software needed. Moreover, simply performing an internet search for “change EXIF data on photo” yields a multitude of free tools appearing in the search results that can all easily change EXIF data.
In fact, changing Metadata such as EXIF data and creation dates, is as easy as changing words or sentences in a Microsoft Word document.
SFE Booth, as a senior forensic examiner for the FBI, had to have known this, but chose to lie about it on the stand.
Additionally… In 2016, three years before [the Raniere] trial, SFE Flatley, who was a material witness in this case before being abruptly reassigned to Ghana, Africa at the last moment,
testified as a qualified expert in United States v. Hirst that the FBI does not rely on metadata alone in determining a document’s date because metadata can be “manipulated.”
Flatley’s testimony in Hirst is the exact opposite of the testimony that the government solicited from SFE Booth in this case. It is no wonder that SFE Flatley was assigned to Ghana mere days before he would have otherwise testified.
Someone in the government, or some group of people, wanted to, and needed to, substitute SFE Booth’s testimony for SFE’s Flatley’s testimony.
As the government itself said, “the child pornography is also at the heart of our racketeering conspiracy.”
Without the racketeering charges, the government would have faced substantial venue, jurisdiction, and statute of limitations issues.
I do not think it is at all complicated, knowing as I do know, a little about human nature. I know people in position of power are not exempt from the nature that afflicts us all.
They do not get more angelic because they wear a badge or prosecute for the government. In fact, they do not get more perfect and purer just because they work for the government despite their telling us so.
So based on the simple knowledge that power corrupts, I can quickly solve this dilemma.
When the FBI needs an expert to say metadata is easy to change, they call on Flatley. When they need to get the jury to believe it is hard to change, they call on Booth and send Flatley to Ghana.
Did someone change the metadata – whether easy or hard to change – and was that someone lodged within the FBI?
Why did Flatley’s camera card FTK report have four matches to the hard drive and Booth’s FTK have 33?
Why did the FBI access the camera card improperly on September 18, 2018, hide its existence from the defense for 11 months and never turn over the forensic copy to the defense at any time?
This is not about whether Raniere is guilty. This is about whether the FBI cheated to convict him.
We have all decided that Raniere is corrupt – except for the few we call the dead-enders. But how about the FBI? Are they corrupt, too?
Ghana is a great country for FBI and non-FBI people to visit.
From Brooklyn it is a mere 5000 miles – a short puddle jump across the Atlantic.
Did Flatley really go to Ghana or did – once Booth testified – the need become obviated.
If Flatley did go, he might have seen some pretty women, for the country is known for that..
The EXIF data debate does not prove much one way or another. But strangely, they sent Flatley off to Ghana. He was in Brooklyn until the last three days of the trial. Why didn’t they call him during the first six weeks of the trial?
They called Booth, and he said, as you can read for 15 pages of transcripts, how hard it was to change EXIF data.
This testimony seems to qualify him for the Pinocchio award for 2019.
Brian Booth told a little white one when he said EXIF data is hard to change.
Maybe the EXIF data was never changed, but why lie and say it is hard to change? The answer may lie in Brooklyn, or Ghana, or down Mexico way.
The dude in Tucson knows the truth about what he did with Camila. And nobody condones abuse. But did the FBI cheat to get the varmint?
Enquiring minds want to know.
An evidentiary hearing ought to tell us. What is the possible objection to that? If the FBI is innocent, then that will become apparent. The burden of proof is on Raniere. Let’s see what he can prove.
Let’s give him the fullest measure of due process. And if this is all bullshit, then that will become evident and everyone, the dead enders included, will know it.
We will all be satisfied that justice was done.
