By Frank Parlato and Suneel Chakravorty
Frank Parlato
Suneel Chakravorty
Part 7 of our analysis of alleged FBI tampering.
Some of this is a recap and then some brand new information.
The FBI searched 8 Hale on March 27, one day after Raniere’s arrest.
In their 8 Hale warrant application, the FBI asked to seize computers and hard drives.
They asked to search for evidence of DOS-related crimes committed on or after January 1, 2015.
Among 37 items seized, the FBI took a bag with a Canon camera and a hard drive, first and second.
The camera bag – with camera – was the first item seized.
When the FBI seized the hard drive, they took the wrong photo. Instead, they took a picture of a silver LaCie hard drive.
Evidence Item #2 – a hard drive..
They called the photo of the LaCie hard drive evidence item #2.
On their written list of seized devices, the FBI listed a Western Digitial hard drive as evidence item #2.
The receipt of items seized at 8 Hale Drive shows the second item correctly identified by serial number as the Western Digital hard drive that later accidentally was discovered to contain child porn.
The Western Digital hard drive was black.
The FBI later moved it, took a second photo of the LaCie hard drive, and called it evidence item #37.
Evidence Item #37 was the same one photographed as #2.
There was a Western Digital hard drive next to the LaCie hard drive in the photo of evidence item #2.
When the FBI agent testified about the photo of evidence item #2, he said it was a silver or gray hard drive.
Did he forget about his photo of more than a year earlier?
But prosecutors prepare FBI agents for testifying at trial. The FBI agent would have had to be unaware that the FBI found child porn on a black Western Digital Hard Drive.
He would have to be unaware that the FBI called it evidence item #2.
The device the FBI alleged they found child porn on was a black Western Digital hard drive, not a silver LaCie.
FBI Forensic Examiner Trainee Virginia Donnelly’s photograph of the hard drive shows it was black, not silver.
The FBI used a black Western Digital hard drive as evidence item #2.
But when FBI SA Mills, who took the photos, testified, he said evidence item #2 was a silver or gray hard drive.
SA Mills identified the photograph of the silver LaCie hard drive as evidence item #2.
Then the prosecution brought out the black Western Digital hard drive – the actual evidence item #2.
SA Mills said it was a Western Digital hard drive that the FBI forensic examiner processed.
The black Western Digital hard drive became evidence item #2 minutes after Mills testified it was silver.
This was the most critical piece of digital evidence in the trial.
Following the Western Digital hard drive through custody reports, we find a puzzling history.
After the FBI seized it, they failed to make a forensic copy for more than six months.
Excerpt of the FBI Examination Notes of Virginia Donnelly and Brian Booth, showing that the hard drive was imaged on 9/19/18, almost six months after it was originally seized on 3/27/18.
FBI agents are only allowed to examine copies of digital evidence. They are not authorized to inspect the original device. The reason for that is evidence integrity.
If anyone alleges the FBI tampered with a copy, the FBI has the original to compare. [By the way, the black Western Digital hard drive seems to have disappeared at the FBI. According to the FBI custody report, the FBI has no record of where it is after February 2019.]
The FBI digital evidence manual prohibits inspection of original devices.
The warrant for 8 Hale stated there was probable cause to believe that collateral was on that device. But the FBI waited six months to have it copied.
They were in no hurry to look for the evidence they expected to find on the search warrant.
Then we come to the camera card.
The FBI listed the Canon camera and accessories as evidence item #1.
Inside the camera was a Lexar camera card.
A photo of a Lexar camera card similar to the one found inside the camera.
The FBI did not disclose that fact until almost a year after they seized it.
A Canon digital camera requires a camera card. They are not part of the camera. A photographer can use any number of camera cards and replace or reuse them.
The Lexar camera card is a separate digital device.
The FBI digital evidence handbook points out camera cards specifically as digital evidence.
Oddly, the FBI lost custody of the camera and camera card on the same day the FBI made a forensic copy of the hard drive.
They lost custody of the second and third most critical digital devices – the camera and the camera card.
The FBI violated digital evidence handling protocol with the camera card. They copied photos from the camera card before making a forensic copy.
This is strictly prohibited. First, the FBI is supposed to make a forensic copy of the camera card and then make copies of pictures from the forensic copy.
FBI agents are strictly prohibited from making copies from or inspecting the original device.
Then after making copies of photos from the original camera card, they deceived the defense. The FBI did not disclose the existence of the camera card.
They did not tell the defense they got the photos from the camera card.
The DOJ told the defense that the FBI got the photos from the Canon camera, which was untrue.
The prosecution gave the defense copies of photos taken from the camera card. They consisted of nude pictures of several adult women and some photos of Raniere. There was no metadata included.
These were not digital files, but photographs only – as if they just came from a camera.
In September, the prosecution said they expected further charges. They did not say what those were. In October, the prosecution gave the defense a copy of the hard drive.
There was no mention of child porn or that the hard drive had evidence of value.
By November, they said they had evidence suggesting Raniere may have started a sexual relationship with Camila when she was 15.
This evidence came from a search of Raniere’s emails. His emails and a document of purported texts with Camila suggested they started a relationship in 2005 or 2006.
Fast forward three months. The date –February 21, 2019.
The trial was less than a month away. It was eleven months after they seized the hard drive.
FBI agents claim they accidentally found child porn on the hard drive.
It was an accident, they said. The search warrant allowed the FBI to look for crimes that occurred on or after January 1, 2015. If it was not an accident, the FBI violated the search warrant.
The judge authorized a search for crimes of 2015 and later.
They found a crime they alleged occurred in 2005.
The judge could throw the evidence out if the FBI deliberately searched for evidence outside the search warrant.
But if the FBI accidentally found it, and if it was in “plain view,” it is admissible.
The only way they could use this child porn evidence was if they found it by accident.
To reiterate: Accident – can use. If the FBI searched for it on purpose, the evidence is inadmissible.
Some 332 days after they seized the hard drive, the FBI said they accidentally found child porn. They were not looking for it.
When the FBI found it, they already knew about purported texts of Raniere’s underage relations with Camila. On the day the FBI found the child porn, the DOJ told the defense to destroy their copies of the hard drive and not inspect them. The hard drive had child porn on it.
The FBI took several weeks to scrub the child porn photos off a forensic copy of the hard drive.
They failed to scrub all Camila’s photos. The defense got the forensic copy and found thumbnails of Camila scattered all over the hard drive.
The hard drive had to be returned, and the FBI again took several more weeks to scrub the files.
These delays prevented the defense from examining the metadata of the forensic copy of the hard drive before the trial.
Possession of child porn is one charge. It is not as severe as producing child porn.
The FBI needed the camera and camera card to prove Raniere took the photos.
Without the camera card and the camera, the FBI only had possession of child porn charges.
The prosecution brought new charges of child porn and exploitation against Raniere in March 2019.
The prosecution disclosed the existence of the camera card about a year after the FBI seized it. This violates the federal discovery rules and can only be called obstruction of justice or hiding evidence.
The DOJ is required to disclose evidence they seize, and they are supposed to make a forensic copy of all devices. The DOJ did neither.
The day after they discovered the child porn, the FBI brought the camera card to FBI CART to make a forensic copy. The prosecution never gave the defense a forensic copy of the camera card, violating DOJ rules.
FBI CART also made an FTK report that provided a list of the files and some images. This was shared with the defense after the trial began.
Based on the FBI’s first FTK report, four photos on the camera card matched photos on the hard drive. These were not Camila’s photos, but four nude photos of Angel, an adult woman Raniere knew.
During the trial, the FBI violated digital evidence handling.
In April – a month before trial -the FBI made a forensic copy of the camera card. From the forensic copy, they made an FTK report.
Near the end of the trial – on June 10, [the trial ended June 19] the FBI made a second forensic copy of the camera card.
From the second copy of the forensic report, the FBI made a second FTK report.
This is wrong on many levels.
The FBI made a second, unauthorized forensic copy of the camera card. This is strictly prohibited.
The FBI should have made the second FTK report off the original authorized forensic copy of the camera card.
During the trial, the prosecution substituted the first FTK report with the second FTK report. They actually removed the first camera card FTK report and replaced it with the second report.
Still, if everything was just a series of dumb but innocent FBI mistakes, despite the rule violations, both FTK reports should be the same.
On the first FTK report of the camera card, which included deleted photos, as mentioned above, there were only four files that matched the hard drive – four of Angel.
On the second FTK report, 31 new photo files appeared on the camera card that matched the hard drive.
The two FTK reports were done by different examiners.
Either someone at the FBI added those 31 new digital files, or the first examiner who made the first FTK report excluded those files on the first report.
Which was it and why?
That is a question that remains unanswered.
The prosecution withheld forensic copies of the hard drive until after jury selection. The prosecution never gave the defense a forensic copy of the camera card.
During the trial, the prosecution came up with a new FTK report on the camera card, and the camera card had 31 new photos that tied Raniere’s camera to the hard drive.
During the trial, the FBI testified that EXIF data is the only reliable way to date these photos, and that it is hard to change.
Here is Suneel’s demonstration of how easuy it is to change EXIF data:
Dr. Kiper’s analysis of how easy it is to change EXIF data can be found in this excerpt of his report.
After another FBI agent identified the hard drive as silver, a senior FBI forensic examiner testified about the black hard drive.
He said the EXIF data on the black Western Digital hard drive files showed the Canon camera created the photos of child porn in 2005.
The EXIF data time dates of the Camila photos proved it was child porn because the photos were taken in 2005 and Camila was 15 then.
How to prove Raniere took the photos?
The FBI found 35 files of Raniere’s adult partners on the camera card that matched the files on the hard drive. The 35 was up from four files from the first FTK report.
Because the prosecution substituted FTK reports during the trial, the discrepancy was not detected.
The EXIF Datetime of the newly appearing photos on the camera card showed the Canon camera created them in 2005.
It was lucky for the prosecution that they gave the hard drive forensic copy and camera card FTK report after the trial had begun. Otherwise, the defense might have had the time to give them to a forensic expert.
At trial, the FBI downplayed conflicting creation dates.
The actual creation dates showed that the Camila photos were backed up to the hard drive in 2003. Yet, the EXIF data said the photos were taken two years later, in 2005.
FBI Senior Forensic Examiner Brian Booth testified that EXIF data is hard to change.
But Booth did not tell the truth.
EXIF data is not difficult to change. There are free programs that change EXIF dates. With some versions of]Windows, you can change EXIF data without extraneous software.
After the trial, analysis of the hard drive digital files showed manual metadata alterations.
Someone created folder names to look computer-generated and made other adjustments to dates.
They forgot to remove the metadata showing Adobe Photoshop was used on one file.
Yet this file had the exact same EXIF and Modified Date times. That is impossible without manual alteration of metadata. Adobe Photoshop changes the modified date time unless someone alters it to look the same.
There are other impossible dates.
One discrepancy seems to be caused by an attempt to mimic daylight savings time.
Whoever altered the metadata erred and adjusted the time two hours backward instead of one hour forward.
All the photos have a creation date of 2003, which is before Canon manufactured the camera.
Thumbnails of Daniela appear in Kathy Russell’s folder, and vice versa. This shows the files were not original and untouched.
This is not insignificant. It means Kathy and Daniela were once in the same folder. But someone altered the files and folders to separate them into separate folders. These alterations are as easy as changing EXIF data.
But the prosecution told the jury none of this occurred.
That the jury should trust the EXIF data alone.
But the many alterations tht could only have been done manually invalidate the reliability of all the metadata.
The metadata showed the files were original and never modified. But they were modified.
Returning to the camera card and its newfound photos, we have more suspicious files.
One of the most suspicious is that four of Daniela’s files were newly found on the camera card.
We know they are Daniela because the metadata and the file names are exactly the same on the hard drive. On the hard drive, you can see Daniela’s thumbnails and photos.
The metadata on the camera card is the same as the hard drive.
But Daniela is not on the thumbnails. No, it is Angel. The same four photos of Angel are on the original FTK report. So Angel appears twice. In her own photos and again in Daniela’s photos on the camera card.
Yet the metadata is identical on the camera card and hard drive for Daniela’s photos.
If no one altered the files, they would be the same. They would not have Angel’s thumbnails on Daniela’s file.
The rest of the new files have other suspicious issues.
At trial, Camila never testified.
The prosecution had the camera and the photos. They never showed Daniela or Lauren their photos or the camera. Yet both described their photos and the camera.
Why?
The prosecution presented evidence to corroborate that the photos of Camila were authentic and /or Raniere had an underage relationship with her.
The document of purported texts. The medical records of Camila’s appendectomy.
The testimony of an FBI agent who said there were no scars on Camila’s photos.
Daniela’s testimony that Raniere told her he had sex with Camila when she was underage.
But the primary evidence was the hard drive and the camera and card. The metadata – and specifically the EXIF date that an FBI senior forensic agent lied about as hard to change.
For the sake of argument, let’s say Raniere had sex with Camila when she was 15. And he took her photos.
Were the photos presented at trial found on a hard drive seized from his library? Were they untouched? Was the EXIF data correct?
Things happened within a few weeks of the accidental discovery of child porn in February 2019.
Raniere’s codefendants tried to sever their trials. When Judge Garaufis did not rule in their favor, they all took plea deals.
Before the child porn, an aggressive Marc Agnifilo supported by 16 Bronfman-paid attorneys for the six defendants had one mantra: all alleged victims were consenting adults.
The six defendants, Upper Row: Kathy Russell, Keith Raniere, Nancy Salzman, LowerAllison Mack, Lauren Salzman, Clare Bronfman
Child porn knocked the wind out of that sail.
The child victim Camila ended that argument.
The prosecution did not call Camila. They could have had Camila testify if they wanted. They knew where she lived in Mexico. They came to her house and spoke with her, according to their own report.
The prosecutors said she could have been charged. They had at least three felony charges against her:
Her role in the document servitude of her sister Daniela.
Her role as a first-line master, the alleged fraudulent and coercive recruitment and commanding of collateralized slaves.
Her role in the sex trafficking of Nicole.
The prosecution had ample evidence to take her like they took Raniere.
They could have negotiated with her to testify and give her immunity.
The narrative that she chose not to testify is only partly true. If the prosecution wanted her as a witness, she would have testified.
The prosecution did not want her to testify. There must be some reason why they did not.
After all, Judge Garaufis remarked that had she testified and identified the photos, it would not have taken the jury 10 minutes to convict him.
Camila came to the sentencing of Raniere. She said he took photos of her when she was 15. Everyone thought that was enough. But it is not enough. Forget that Camila was not under oath or that she was not cross-examined.
Camila had the chance, but she did not do it. She did not say the photos used at trial were the ones Raniere took when she was 15.
Like Daniela and Lauren, she did not identify her photos.
She could have said, “I have seen the photos used at trial, and they are of me and were taken in 2005 by Keith Raniere.”
Then all the defense would have left to dispute was to examine the metadata and confirm they were on the hard drive.
The fact that Camila did not do this is much like how Daniela did not identify her own nude photos or the camera. And how Lauren did not identify the camera or her own nude photos.
The jury was asked to believe the EXIF data was sufficient because that is hard to change.
Nobody was asked to identify the camera or their own nude photos and say it’s true. Nobody who knew Camila was asked at trial to identify the photos as Camila.
They don’t have to. Why?
Because EXIF data is hard to change. EXIF data proves the date and the camera.
But EXIF data is easy to change, and the FBI lied about that. Did they lie about anything else?
Part #1: Analysis of Allegations of FBI Tampering in USA v Raniere
Part #2 Analysis of FBI Tampering Daniela and Her Relationship With Raniere and Computers
Part 3: Analysis of Alleged FBI Tampering — Camila
Part #5 Alleged FBI Tampering: Delay, Delay, and Hide the Camera Card
Part #6: Alleged FBI Tampering: Accidental Discovery of Child Porn on Hard Drive
