Brooklyn, New York— Attorneys representing Keith Raniere, the founder of NXIVM, filed a motion to compel the US Attorney for the Eastern District of NY to release forensic copies of a camera card they claim is pivotal to Raniere’s Rule 33 motion for a new trial.
A forensic copy, a bit-stream image, is an exact copy of an original digital device, including allocated and unallocated space.
Based on the analysis of seven independent digital forensic experts retained by Raniere, including four former FBI examiners, Raniere’s defense alleges the FBI altered the camera card as part of a criminal conspiracy to commit evidentiary fraud.
The motion argued before US District Judge Nicholas Garaufis, centers around a Canon camera and a Lexar camera card seized by the FBI during a raid on Raniere’s library after his arrest in March 2018.
Canon Camera
EOS 20D
This evidence was critical in the Department of Justice prosecuting Raniere in his 2019 trial. Prosecutors used the camera and camera cards to support charges of sexual exploitation of a minor involving explicit photos dated November 2005.
The FBI testified that the metadata of the contraband photos showed the images were created in 2005 – when the child was 15.
The DOJ alleged Raniere used the Canon camera, downloaded the photos to the camera card, and later stored them on a hard drive, which the FBI also seized.
In papers opposing Raniere’s motion for a new trial, the DOJ offered an affidavit from FBI Senior Computer Scientist David Loveall II, who examined the forensic copies of the camera card and then asserted their authenticity.
Raniere’s attorneys, Joseph Tully of California and Arthur Aidala of New York argue that while Loveall analyzed both forensic copies of the camera card, the DOJ withheld these same forensic copies from the defense, limiting Raniere’s experts’ ability to verify or refute claims made by Loveall.
Joseph Tully
The defense also pointed out the unfairness of the DOJ’s rebuttal affidavit, which relied on and referenced withheld forensic copies of the camera card.
“In order to competently reply to the government’s opposition, our experts must now forensically examine these same items, which the government possesses and refuses to disclose,” Aidala and Tully stated.
Arthur Aidala, attorney for Keith RaniereBased on the evidence the DOJ previously disclosed, Dr. Richard Kiper, a former FBI Special Agent and Forensic Examiner who leads the defense’s forensic team, said, “I concluded that digital evidence – a camera card (1B15a) and hard drive (1B16) – had been falsified, and government actors must have been involved in evidentiary fraud.”
The DOJ clearly violates the Federal Rules of Criminal Procedure by withholding forensic copies of the camera card – due before the trial.
Instead, the DOJ provided Forensic Toolkit (FTK) reports. An FTK report is different than a forensic copy. The FTK is a report generated by FTK software that analyzes and presents findings from its analysis of the forensic copy.
The forensic copies are exact bit-by-bit duplications of the original storage medium, including all files, folders, and free spaces, and serve as precise replicas of the original evidence without any interpretation or analysis of the data.
The DOJ has persistently refused to release the camera card’s two forensic reports for unclear reasons.
Kiper pointed out that it may point to the exact nature of the FBI fraud.
Dr. J. Richard KiperKiper showed discrepancies in the FBI-made FTK reports – the only camera card evidence the DOJ has been willing to release.
Kiper explained that the first FTK report contained only four images matching those on the hard drive. A second FTK report, created during the trial, had 37 additional image files not present in the earlier report. All the new images matched file names on the hard drive, creating stronger evidence that Raniere took the contraband photos on the Canon camera and stored them on the camera card than on the hard drive.
The Western digital hard drive the FBI seized from Raniere’s libraryWhile the defense only has the FTK reports, Loveall had access to the forensic copies of the camera card and the FTK reports.
With a deadline of November 30, 2023, for Raniere’s reply to the government’s opposition to his Rule 33 motion for a new trial, Aidala asked the court to compel the DOJ to release the two forensic images of the camera card.
In new information, Aidala alleges the DOJ confirmed the camera card was altered while in FBI custody by a so-called “photo technician,” who was unauthorized and unidentified, broke the chain of custody, and altered the camera card before the FBI made a forensic copy.
Aidala and Tully criticized Loveall, who claimed the two forensic images of the camera card were identical but failed to provide the defense with hash values, a digital fingerprint used to confirm data integrity. If the hash values match, the copy replicates the original. If they don’t, it suggests alteration or corruption of the data.
The attorneys said the lack of “hash values” presented by Loveall to substantiate his claim that the two forensic copies of the camera card were identical is a glaring omission.
Aidala and Tully argued, “An experienced examiner and scientist like Loveall making such a critical claim without also including basic, easy-to-obtain, and required hash values appears to be intentional, rather than an oversight.”
Keith Raniere’s mugshot at the Brooklyn Metropolitan Detention Center, April 2018.The defense requested the court to compel the DOJ to disclose the forensic copies of the camera card so they can analyze every bit and byte on the original storage device, including files, fragments of files, and empty space.
Kiper outlined a Forensic Disclosure Process to prevent potential further tampering. This protocol includes copying image files, providing backup versions, sharing derivative evidence, providing image logs, documenting the tools and methods used, and presenting a complete chain of custody for these items.
The defense argued that following protocol would not create an undue burden for the government, as it primarily involves copying existing materials.
“The time spent by the government opposing this justified disclosure is far more time than that required to simply comply,” Aidala and Tully noted.
