Bangkok wrote an impressive story. Raniere’s Rule 33 Motion Has Decent Chance; If It Succeeds, Raniere Goes Free
The story discusses how FBI Forensic Examiner Brian Booth seems to have falsely testified about the reliability of EXIF data, the sole evidence used to date Camila photos, and convict Raniere of predicate RICO acts of possession of child porn and sexual exploitation of a minor.
The EXIF data dates were the evidence that the photos were taken in 2005, when Camila was 15.
Bangkok made a point, strengthening a story I broke in the FR months ago.
FBI Forensic Examiner Stephen Flatley was taken off the case mid-trial because, the DOJ prosecutor told Judge Garaufis he had to go to Ghana.
FBI FA Flatley had testified at another trial, three years earlier, that EXIF data is not reliable.
In the case against Keith Raniere, with Flatley, purportedly sent to Ghana, the DOJ called Forensic Examiner Brian Booth, who testified that EXIF data is reliable.
According to FBI records, Flatley was in NYC until June 2019, one month after the Raniere trial began. When did Flatley get assigned to Ghana? Did he go?
Just prior to his testifying, Booth ma
de a second forensic FTK report of the camera card removed from Raniere’s camera.
Flatley had made an FTK report months before. Both FTK reports were made from the original camera card.
The second FTK report had 33 digital photograph files that were not on the first report. The camera card, which before, with Flatley’s report, had little to tie it to the hard drive, with Booth’s FTK report, now had more than thirty digital files also found on the hard drive. All the new files had EXIF dates of 2005.
This helped make the case of child porn. Camila was 15 in 2005.
The newer FTK camera card report had some hard to explain files.
For instance, the file names and metadata, including EXIF, of four digital files on the new report of the camera card matched the file names, and metadata [including EXIF data] on the hard drive where the Camila photos were found.
The problem, and it never came out at trial, because it was not known by the defense at the time, is that the files matched in meta data, including EXIF data, but the actual digital photos did not match. On the hard drive, the files were of Daniela. The same files on the camera card with their matching EXIF data, were photos of Angel.
Whether Raniere sexually abused Camila when she was underage is not under discussion. We are looking at evidence the FBI used to convict Raniere of abusing Camila.
The following is Dr. Kiper position, mostly from an white paper he wrote, and from my interview with him on testimony of FBI Forensic Examiner Brian Booth on the reliability of EXIF data.
EXIF Data and U.S. vs Raniere
By J. Richard Kiper, PhD, PMP
FBI Special Agent (Retired) and Forensic Examiner.
The US DOJ for the EDNY alleged Keith Raniere used a Canon digital camera to take 22 explicit photographs of a female, Camila, when she was 15, saved them to a compact flash camera
card, transferred them to a Dell computer, which was never found.
Then he backed up those photographs to an external hard drive, which was seized by the FBI.
Figure 1: The Government’s narrative regarding alleged contraband found on a “backup” drive.
To DOJ needed to prove two things to demonstrate that Raniere, using the Canon camera created the alleged contraband.
1. The contraband photographs were taken with the camera used by Raniere.
2. The contraband photographs were taken when Camila was legally underage. In 2005, she was 15.
The prosecution relied on information embedded inside the digital photographs, called Exchangeable Image Format (EXIF) data.
A Canon digital camera automatically records how a photo was taken, on what date, and with which camera settings.
This is called EXIF data and is saved into the content portion of a digital photograph file. The EXIF data does not automatically change when the digital photograph is transferred to another device, such as a computer or a hard drive.
The prosecution used the Camila photos’ EXIF data’s creation date, [November 2005] to argue that she was underage in the pictures.
They also showed that the EXIF data of the photos showed the make and model of the camera allegedly used by Raniere and seized from his library.
Canon Camera
EOS 20D
How reliable is EXIF data?
According to the FBI’s expert witness, Senior Forensic Examiner William Booth, a photo’s EXIF data is reliable because it is “very hard” to change.
Consider a few of his sworn statements from his testimony. The emphasis is mine:
Question: Is there a particular reason why EXIF data is more
difficult to alter?
Booth: They purposely designed it that way.
Question: Do you know —
Booth: It’s mainly to be able to store information. And they
don’t want data to be moved around and changed, especially time and date information. Those things are very hard for the
consumer to be able to modify, unless you wind up getting
software that’s just developed to do that (p.4820).
Booth: Well, the best reference is the EXIF data because that
gets put into the JPEG file and it’s not easily modifiable and
it moves with the file the same way from device to device, no
matter where you place it. It has nothing to do with the bearing
of a file system at all or the dates and times associated with
it. So it’s on its own, but are created at the same time that
you take the picture (p.4830).
Booth:… But when it comes to photos, they still keep you from
changing dates and times. It’s not easy to change those. You
have to go through special processes to change those things.
(p.4977)
The above are just a few of Booth’s statements about the reliability of EXIF data and how hard it is to modify.
Prosecutor Mark Lesko emphasized Booth’s testimony in his closing argument to the jury:
LESKO: … I’m no expert, don’t get me wrong, but I heard Examiner Booth, just like you did. Exif data is extremely reliable . It’s embedded in the jpeg, in the image itself. And the exif data shows that the data was created on the camera, in this instance, this particular instance, the 150 jpeg on November 2, 2005… (p.5572).
The FBI’s expert witness and the DOJ prosecutor told the jury they could rely on the photo EXIF data to determine Raniere created the alleged contraband with the Canon camera in 2005, because the EXIF data is “extremely reliable” and “very hard” to modify.
Is it true that digital photograph EXIF data is “very hard” to change?
Modifying Photograph EXIF Data
A Google search will enable anyone to find freely-available, simple-to-use tools for editing EXIF data.
One of my favorites, ExifTool, was featured in an article titled, “7 Free Tools to Change Photo’s Exif Data, Remove Metadata and hide dates.
For purposes of the following demonstration on how easy it is to modify EXIF data, I will use a digital photograph from U.S. vs KEITH RANIERE case.
The photograph, with the file name “IMG_0043.JPG,” is a picture of a maple tree. It was found on the “backup” hard drive, in the same studies folder that the alleged contraband photos of Camila were found.
The EXIF data shows it was taken with the same Canon camera around the same time.
In Figure 2 below, the Microsoft Windows details pane (invoked by selecting the “View” tab of any Windows folder) is interpreting the EXIF data of Figure 2.
Windows display of EXIF data for IMG_0043.JPG.
According to the Windows display of EXIF data, this photo was taken on 10/17/2005 with a Canon EOS 20D digital camera.
I verified this information by using the industry standard
ExifTool I mentioned earlier.
Here is how ExifTool interprets the EXIF data:
Figure 3. ExifTool display of EXIF data for IMG_0043.JPG.
How hard is it to change the camera model?
In the Windows folder with the Details Pane enabled, I click the “Camera model” field and type whatever I want.
I changed the camera model to an iPhone XR.
Figure 4. Changing the “Camera model” field in the EXIF data of a photo.
I also changed the Camera maker to Apple.
Then I clicked on the “Date taken” field and set it to the United States Independence Day, July 4, 1776 –246 years ago.
Figure 5. Changing the “Date taken” field in the EXIF data of a photo.
Therefore, a person viewing the file in Windows would now see a photo that was taken by an Apple iPhone XR, in 1776.
Figure 6. Windows display of saved changes in the EXIF data of photo IMG_0043.JPG.
Despite the government’s contention in court, the EXIF data was very easy to change.
At this point, you might be thinking, “That’s fine for the Windows interpretation, but was the EXIF data really modified? or just changed in the Windows on that computer?”
To verify that I changes I made in the Windows folder changed the EXIF data in the file, I opened the file again in ExifTool:
Figure 7. ExifTool display of saved changes in the EXIF data of photo IMG_0043.JPG, showed the EXIF data was changed to an Apple I phone and July 4, 1776.
The next question one might ask is: “What about a forensic tool?
Would a digital forensic tool verify these changes in the EXIF portion of the file?”
ExifTool is a forensic tool, although it is in the public domain.
But to put to rest any doubts about whether the EXIF data was changed and would not be detected as changed, I viewed the photo in the FBI-approved digital forensic tool, AccessData’s FTK Imager.
In Figure 8 below, I imported IMG_0043.JPG and used the Hex viewer to read the raw EXIF data.
All the EXIF changes I made were readily visible, and there were no traces to indicate that I or anyone else had ever made those changes.
Figure 8. FTK Imager display of saved changes in the EXIF data of photo IMG_0043.JPG.
Conclusion
What does this mean?
It means the government misled the jury about EXIF data. They used that misleading information to to convict Keith Raniere.
I could have used many other freely available tools to modify the EXIF data that the government claimed was “extremely reliable” and “very hard” to modify.
Instead, I did not even have to use software. I simply used the built-in features of Windows on my computer to modify the EXIF data of an actual digital photographs produced by the government at trial.
I verified those changes in three different ways.
Anyone can reproduce what I demonstrated in this article, using any digital photograph.
Modifying EXIF data requires none of the “software” or “special
processes” claimed by FBI examiner Booth, nor is it “very hard” to modify, as he claimed in sworn testimony.
It is unclear to me why a Senior Forensic Examiner of his caliber would have made those false statements under oath.
Implications
Why would the FBI’s star witness, the digital forensic examiner, swear under oath that EXIF data cannot be easily modified? And why would he make such false statements multiple times during
his testimony?
The prosecution needed the jury to believe that EXIF data could not be easily modified because it was the only piece of digital information that supported the narrative that the photos on the
hard drive allegedly belonging to Raniere were of an underage subject.
If the prosecution told the truth – that EXIF data can be easily modified with no special skills or tools – the jury may have reasonably doubted the reliability of the dates as evidence of a crime.
It is a miscarriage of justice for the prosecution (and the jury) to have relied on the authenticity of EXIF data to prove creation dates and the origin of digital photographs.
If the government could blatantly mislead a jury about something so easy to disprove, it leaves me to ponder: What else were they lying about?
