To recap and clarity on the search warrant of 8 Hale:
FBI Special Agent Michael Lever swore to an affidavit to secure the search. The Judge limited its scope based on SA Lever’s affidavit.
Magistrate Judge Daniel J. Stewart authorized the FBI to look for DOS-related crimes. The warrant’s time scope was on or after January 1, 2015. The warrant authorized a search for evidence of four crimes. They were forced labor, sex trafficking, extortion, and racketeering.
The FBI searched 8 Hale. As reported in Part #4, the first item the FBI seized was a bag with a Canon Camera EOS 20D inside it.
They took it from under the desk in the study at 8 Hale.
SA Mills testified, “So the there’s a note there with the number one. So number one represents evidence item number one. So, in this case, this photo was taken underneath the desk or table and was assigned number one based on being the first evidence item that was found.”
There were other items under the desk the FBI would seize. That included two computer towers and a hard drive. But the FBI did not take them immediately.
The FBI secured an item on a bookshelf next. That item was evidence #2. According to the FBI’s FD 597 receipt of the property seized, it was a black Western Digital hard drive.
FBI SA Christopher Mills seems to have taken the wrong photo. He seems to have placed evidence number card #2 on a silver LaCie hard drive.
Above is Mills’ actual photograph presented as an exhibit at trial. It is dark, and the Western Digital hard drive is hard to see.
Applying a filter to Mills’ darker photo to brighten it, it is possible to see the black Western Digital hard drive. It is between the silver LaCie hard drive and the Sony DVD player.
During the trial, the government led the jury to believe the photo for evidence item #2 was a silver hard drive.
Mills and the jury were shown Mills’ darker photo [above] on a screen.
AUSA Hajjar: Can you describe what this photograph shows?
SA Mills: Yes. So this is the still of the same office space as seen before, and item number two, which is on top of the bookshelf here, is a gray or silver hard drive.
Mills did not correct his mistake before the jury.
He did not say, “I meant to take a photo of the black Western Digital hard drive. Unfortunately, I photographed the silver one by mistake.”
Mills did not say, “the real evidence item #2 – the one where the FBI found the child porn – is the black hard drive right next to it.”
He did not say, “on our receipt of items seized, we listed the Western Digital hard drive as evidence item #2.”
The FBI made a mistake?
Mills should know the FBI found evidence of child porn on a black Western Digital hard drive. And it was evidence item #2.
The government led the jury to believe that evidence item #2 was silver. It was not the hard drive with child porn. But another device, a silver LaCie hard drive.
After showing Mills the photograph of evidence item #2, AUSA Hajjar brings out a physical hard drive.
Hajjar:: Your Honor, may I approach the witness?
THE COURT: Yes, you may.
Hajjar: I show you what’s been marked for identification as Government Exhibit 502 [the photos]. Showing you what’s marked for identification as Government Exhibit 503. Do you recognize this exhibit?
Hajjar showed Mills a black hard drive.
Hajjar: What is it?
Mills: This is a hard drive. The brand is, I believe, Western Digital.
During the search of 8 Hale, Mills photographed the silver LaCie twice. He took a second photo and placed card #37 in front of it.
The FBI appears to have moved the black Western Digital hard drive out of the way.
Mills may not have known he photographed the LaCie before as evidence item #2. He should know that the same device cannot be two different evidence item numbers. He might have realized he did not photograph the black Western Digital hard drive. Maybe he did not. The FBI appears to have moved the LaCie.
When Mills photographed the silver LaCie as evidence item #2, it was near the end of the bookshelf. Observe the location of a computer monitor below the shelf in the photo above.
Dr. J. Richard Kiper
Chakravorty retained retired FBI special agent and FBI trainer of forensic examiners, Dr. J. Richard Kiper. Chakravorty asked Kiper to examine the possibility of FBI tampering.
Kiper was paid for his work.
Kiper made a report. Within it, he addresses his view of the FBI search.
Dr. Kiper writes:
The FBI search team traversed several areas of the residence, went upstairs and straight to the office area, and then crawled under a desk to find the first piece of evidence – a camera bag containing a camera and camera card.
At this point, the case agent, SA Lever, had not yet “discovered” alleged child pornography taken with this camera, so it seems more than a strange coincidence that it was the first evidence item identified.
Another anomaly is the fact that an item number was assigned to the camera immediately upon
discovery. All the items documented in the photo log (GX 502) and represented in the
photographs (GX 502A) have item numbers, written on sticky notes photographed next to the
Generally, FBI search personnel do not assign item numbers to evidence at the moment of
discovery/photography/collection, because there are multiple people working in different rooms
and it would be impossible to coordinate the numbering among them.
If any items are assigned item numbers, then it is done near the end of the search when the seizing agent collects all the evidence together and fills out the FD-597 receipt for items seized.
Therefore, in practice the item numbers rarely correspond to the order in which they were collected.
The very next item to be identified in the entire residence was an external hard drive,
located away from the desk on a shelf, and which happened to be the second of two key
pieces of digital evidence used to convict Raniere of child exploitation….
Once again, it is extremely convenient that from all the potential evidence in the residence, it was
the Western Digital hard drive – where the alleged child pornography was stored – that was the
second piece of evidence identified by the FBI on scene.
It is also important to note that the camera card (Item #1) and the hard drive (Item #2), comprised the entirety of the child exploitation digital evidence against Raniere – which supposedly was not “discovered” by the FBI for nearly a year later.
It is a coincidence.
There was only one evidence item of which the FBI did not take a clear and obvious photograph. It was the Western Digital hard drive.
This may be an innocent mistake.
How could the FBI know that 11 months later, they would find child porn on it?
It is a coincidence.
FBI SA Mills testified under oath that the photo with evidence card #2 was evidence item #2. He says, “it is a gray or silver hard drive.”
It is a coincidence.
The agent who seized it swore under oath that evidence item #2 was silver or gray. Yet it was a black hard drive that allegedly contained the child porn.
It is a coincidence.
The only other evidence item used at trial from 8 Hale is the Canon camera, which was evidence item #1.
The camera was the evidence that Raniere took the child porn pictures.
It is a coincidence.
Evidence items #1 and #2 were the first two items seized at 8 Hale and the only two used at the trial.
It is a coincidence.
The FBI accidentally discovered the child porn 11 months after they seized items #1 and #2.
They found child porn – 10 years before the time boundary of the search warrant while searching for 2015 and later crimes.
It is a coincidence.
FBI agents took the camera from under the desk, then bypassed other devices under the desk. Then they went to a bookshelf where they took the Western Digital hard drive. Then photographed it wrong.
Any number of coincidences can happen. We must not be quick to judge.
There is an adage. It shows that there is a mathematical possibility in any coincidence.
One million monkeys with one million typewriters type at random. They’ll eventually type the entire works of William Shakespeare in one million years.
There is also an FBI adage – enough coincidences equal a fact.
Now let’s move away from the search and onto what happened to the hard drive and the Canon camera, and as importantly – a Lexar camera card the FBI said was inside the camera card.
The FBI office in New York City has a centralized Evidence Control Unit (ECU). After FBI agents collect evidence at a search site, they write a description of the items. Then, they enter it into the FBI’s case management system.
All evidence items have a chain of custody report. FBI SA Elliot McGinnis had custody first. He kept the items for six days, then turned them over to the lead case agent, FBI SA Michael Lever.
Lever kept the devices for two days, and then delivered the camera and hard drive to ECU.
This was within the 10-day protocol.
FBI protocol requires the Computer Analysis and Response Team (CART) to make a forensic copy of the contents of all digital devices.
After it’s copied, the original device returns to ECU.
The FBI agents do not examine original devices. They review the forensic copy made by CART.
The agent can view the copy, but can’t change, alter, export, or import files on the copy.
Raniere was in custody. On April 19, Allison Mack and Raniere were charged with Conspiracy to Commit Sex Trafficking, Sex Trafficking and Conspiracy to Commit Forced Labor.
Judge Nicholas G. Garaufis set a trial date of October 1, 2018.
Raniere’s lawyer, Marc Agnifilo, spoke to the media outside the court.
He told reporters there was no crime: “It was adults making decisions on their own… adult, strong-minded, free-willed women made decisions for their own lives.”
Marc Agnifilo [l] and Paul DerOhanessian [r], lawyers for Keith Raniere.
Raniere applied for bail.
Agnifilo continued his consenting adults theme. He called the DOS women “independent, smart, curious adults.”
The government seeks to “transform… successful adult women into a helpless band of victims.”
The FBI had obtained a search warrant for Raniere’s Yahoo email account months ago. Attached to one of Raniere’s emails was a document of what appeared to be WhatsApp chats between him and Camila.
The DOJ published some of these chat exchanges with Camila when she was in her mid-20s.
Among them were these:
Raniere: I think it would be good for you to own a fuck toy slave for me, that you could groom, and use as a tool, to pleasure me…
Raniere: I feel badly each time you have to work hard for me to [orgasm]… I thought slaves could remove the burden… and I could get you fresh and not worn.
Camila: Are these slaves for you or for us?
Raniere: There are two types. Both types are for us. One type is in the [DOS] program: you are their Master, I am their Grand Master… The other type are very select ones you use to heal us: likely being also of the first type…
[H]aving one or two young slaves devoted to revving my body sexual to produce more energy would help. It would be there [sic] 24/7 job.
Agnifilo said the DOJ “cherry-picked” the chats. They were “out of context.” Raniere had a “long-term relationship” with Camila.
Agnifilo: “These communications are not evidence of sex trafficking or any other crime.”
Judge Garaufis denied Raniere’s bail motion. He determined that Raniere was a flight risk and a danger to society.
FBI SA Meagan Rees joined the investigative team in May.
SA Rees took the camera out of FBI Evidence Control. CART had not copied it yet.
Rees listed her reason as “evidence review.”
Inside the camera was a Lexar camera card.
Rees had custody of the camera and camera card for 17 days. It is unclear why Rees checked the camera and camera card from ECU. She was not authorized to review the contents of unexamined digital evidence.
FBI Digital Evidence Policy: “Undocumented, ‘off the record’ searches or reviews of [digital evidence] are not permitted.”
The FBI arrested Clare Bronfman, Lauren Salzman, Nancy Salzman, and Kathy Russell. The Government added racketeering and conspiracy charges against Raniere.
The DOJ wanted an adjournment of the trial to January 2019.
Raniere pressed the judge to keep the October 1, 2018, trial date. The defense pushed for discovery.
The DOJ said they had produced some copies of some devices to the defense. The DOJ had not copied the camera or the black Western Digital hard drive.
The judge adjourned the trial to January 7, 2019.
SA Rees returned the camera and card to evidence control, after having custody of them for 17 days.
Dr. Kiper observed: “Based on my own experience, a case agent would leave digital evidence in the ECU until a CART examiner is requested to check out and examine the evidence. For digital evidence, there is no good reason to check it out of Evidence Control, because the case agent cannot possibly gain any investigative benefit from retaining evidence that he or she cannot examine.”
Agnifilo appeared on the Today Show with Megan Kelly.
Agnifilo: DOS is a sorority, a group of women, and it’s only women. The women of DOS… decided – we’re going to have this group of women, and we’re going to have some extreme protocols… We are going to… brand ourselves. Absolutely, 100% voluntarily…
Kelly: We’ve spoken with women who say that they were threatened, that their personal collateral was used against them.
Agnifilo: I look forward to cross-examining them.
Four months had passed since the 8 Hale search and seizure.
SA Lever and SA Delise Jeffries took the Western Digital hard drive out of ECU and delivered it to CART to copy. They did not bring the camera or camera card to CART.
Five months after the search at 8 Hale, the DOJ had not produced copies of most digital devices.
The DOJ asked the judge to delay the trial from January to March 2019. Agnifilo tied the DOJ’s desire for the delay to their slow discovery release.
He wrote in a filing, “the government cannot now use its neglect… to delay the trial date and keep Mr. Raniere in jail. Mr. Raniere… desires a trial immediately. Failing that, he asks only that the January 7, 2019 trial date be kept.”
AUSA Moira Kim Penza responded. She referenced the search at 8 Hale Drive.
“Within days of the execution of the warrants… the Federal Bureau of Investigation’s Computer Analysis and Response Team (CART) began the time-consuming process of imaging, indexing, processing, and searching the data that was seized.”
When she said this, CART had not imaged, indexed, or processed the Western digital hard drive. CART had not received the camera card.
Penza said the DOJ retained an outside company to copy some electronic data.
The Government has engaged a third-party vendor to manage searches… to facilitate production of electronic data in accessible, searchable formats to allow defense counsel the same ability to review the data….
Accordingly, the government intends to make available full discovery copies of devices seized from the Library [8 Hale] to all defendants over the next several weeks or as soon as practicable.
When she said this, the FBI had not given the camera card or hard drive to an outside vendor.
The FBI had given the hard drive to in-house CART. The CART examiner had not made a copy.
The FBI had not turned the camera or card to a CART examiner or outside vendor to copy. The existence of the camera card remained undisclosed to the defense.
The prosecution was preparing for a case with six well-funded defendants. Sixteen attorneys made notices of appearance for the defense.
At trial, six attorneys – one for each defendant – could cross-examine every witness. It would be grueling for the DOS victims.
Agnifilo said the prosecution had problems. They presented novel theories of sex trafficking, forced labor, and racketeering, he said.
The DOJ asked Judge Garaufis for an adjournment. They could not be ready for trial by January.
They asked for a delay to March 18, 2019.
Agnifilo argued Raniere had been in custody for five months. He did not want the prosecution to use the delay in copying digital devices as an excuse to delay the trial. He asked the judge to keep the January 7 date.
The battle over discovery continued
Magistrate Judge Vera M. Scanlon held a status conference. Two attorneys appeared for the Government: Moira Kim Penza and Tanya Hajjar.
There were 10 attorneys for the defendants. This prompted Judge Scanlon to say to the crowded defense table, “There are a lot of people in the room. It’s a little hard to see everybody.”
The defense proposed a November 1 deadline for discovery.
AUSA Penza said the DOJ could have copied digital devices quicker without the metadata. But the defense wanted the metadata for the digital files.
Penza spoke about the volume of electronic evidence – some 10 to 12 terabytes. She estimated she could complete the discovery by mid-December.
Bronfman’s attorney Susan Necheles objected.
Necheles said to Penza:
Have you done the search as you were required to do by the warrant?… We’re just saying, follow the search warrant; follow the law and produce to us and tell us a schedule for this. And that’s all we’ve been asking for.
Necheles told the judge:
We’re asking them to comply with the guidelines that have been set forth by the Department of Justice and adopted by the judges and the courts [for] production for electronic devices.
THE COURT: What’s the government’s issue?
Your Honor, I want to be crystal clear. The government has never suggested that it has not begun searches or that it has not been following through with the proper execution of the warrant. … I want to make crystal clear that the government understands its obligations and is complying with them. This is electronic discovery. It takes a long time…
When we initially produced certain material in a way that did not have metadata… because that was the way we were able to do it in-house, we received objections…
So the government cannot… get it out the door [fast] plus trying to do it in a way with metadata.
Penza said producing copies of digital evidence without metadata was how the government did it in-house.
Later, the metadata of two devices – a hard drive and camera card – became crucial evidence. The FBI produced the metadata for those devices in-house.
Judge Scanlon asked Penza, “Why is there no… high-level conversation with all counsel…?”
Penza turned to Necheles.
Judge Scanlon said:
Wait, wait. Stop with the… don’t interrupt. You don’t need to turn around and face her. You can talk to me. And let’s just — this is going to be a long relationship here, so everybody be calm.
PENZA: Your Honor —
THE COURT: Go ahead.
I just want to make clear…. The government listed out for defense counsel the items… we are willing to disclose… The search warrant returns from [8 Hale] list out each device. We also provided pictures from the searches of the individual devices…
Readers have seen the photos for 8 Hale – including the wrong photograph of the hard drive.
Remember, no one has mentioned anything about child porn. The DOJ alleged crimes against adult women.
THE COURT: What’s the government’s objection to… an all-counsel conversation and then coming back to me with…
PENZA: Well, I can —
THE COURT: Hang on. A somewhat more agreed-upon list of disputes?
PENZA: Well, I can tell you right now that dispute is one that we are unwilling to engage, and so right now —
THE COURT: What does that mean, you’re “unwilling to engage”?
So what I’m telling you, Your Honor, is that we have already disclosed those things that are products of searches that we are willing to disclose…. This is an ongoing investigation, Your Honor. …. We expect there to be additional charges… We are not… willing to disclose everything based on… charges that have not been brought.
Penza was right. There would be new charges. They would come six months later from an accidental discovery. That discovery was outside the warrant. It would be found on the hard drive.
But the FBI had not yet officially searched the hard drive. She could not possibly know.
Judge Garaufis ruled on the date of the trial. He sided with the DOJ. He pushed the trial date from January 7 to March 18, 2019.
Status Conference Hearing:
AUSA Tanya Hajjar said they were trying to provide the discovery from FBI searches of 8 Hale
AUSA Hajjar said,
The [FBI forensic] searches [of the devices] began within days of the search being executed… That is a very time-consuming process…. There is a special unit within the FBI [CART] that needs to process every single one of those pieces.
FBI records show AUSA Hajjar was not accurate when she spoke. FBI agents had not turned in the camera card – which would later be used at the trial – but not for the charged offenses.
The FBI’s CART had also not made a copy of the hard drive.
The search warrant for 8 Hale was to locate DOS photos. The hard drive and camera were the first two items seized. These devices had limited files. Most files were irrelevant. Most were not photos.
Yet CART had not copied the hard drive or other devices.
The March 2018 warrant implied an urgent need to seize. The FBI applied on the day of Raniere’s arrest. SA Lever swore in his affidavit that the FBI would likely find DOS collateral on devices at 8 Hale. This would be evidence of sex trafficking and forced labor, of crimes committed by Raniere after January 1, 2015.
Six months passed. The FBI CART had not copied the devices. The agents could not examine until CART made a copy.
And the failure to produce copies – with metadata – was the excuse to delay the trial.
The day after the hearing, CART made a forensic copy of the black Western Digital hard drive.
A senior forensic examiner did not make the copy. Instead, an FBI trainee, Virginia Donnelly, imaged the hard drive. She used write-blocking software to copy the hard drive. A write-blocker prevents altering data when copying digital devices.
Using a write blocker is a “critical procedure,” according to CART SOP 4.3.
Trainee Donnelly completed the forensic copy by 8:09 pm.
On the day Donnelly copied the hard drive, FBI SA Lever checked the camera and card out of Evidence Control.
The FBI handbook says agents are “strictly prohibited” from examining original digital devices. Agents can examine copies only after CART makes copies from the device.
On that day, someone made an unauthorized search of the camera card. Whoever accessed it didn’t use a write-blocker.
Viewing files without a write-blocker changes the access date. It allows other changes to be made undisguised. The accessed dates for all active files on the camera card changed to September 19, 2018.
Senior Forensic Examiner Brian Booth could not say who searched the camera card when questioned at Raniere’s trial.
Booth agreed it must have occurred on September 19. But admitted the FBI lost custody of the camera card – for a day.
On September 19, 2018, the examination of the first two items seized at 8 Hale occurred. They were a black Western Digital hard drive and a Lexar camera card taken from the Canon camera.
The FBI used a write blocker on one, but not on the other. They did an authorized search on the hard drive and an unauthorized search on the camera card.
The FBI chain of custody report shows SA Lever had custody of the camera and card that day and for seven days after. On none of those days was he authorized to examine them.
The prosecutors told the defense the day before that they had disclosed a list of all the devices from 8 Hale. That was not true. The defense was not told about the camera card. Or that the FBI accessed it without authorization.
Later, the DOJ would use the camera card and hard drive to prove charges that the DOJ had not alleged at this time. That would come five months later – from an accidental discovery Lever made on the hard drive. Even then, he did not disclose the camera card.
Agnifilo continued to press the “intelligent consenting adults” argument. A story appeared on CBC. Agnifilo said,
I think the government’s position is a tricky one. You know, because everyone here is not only an adult, they’re well-to-do adults. They’re adults that… are educated. They’re smart. They have financial opportunity. These are actresses and models, successful people and business people, people who… have aspirations.
And these are choices — eye-open, adult-knowing, voluntary choices that these people are making. And for the government to… say, “Well, you know, they’re brainwashed. You know, they’re effectively brainwashed. I don’t think there’s such thing as brainwashing. It went out with the Cold War. It’s like a relic of the ’70s. I mean, it just doesn’t exist.
SA Lever returned the camera and card to evidence control.
Pretrial discovery hearing.
Agnifilo continued to press for discovery. AUSA Hajjar explained that discovery took longer than expected.
Hajjar pointed to one success. She said, “an 8 Hale camera… [w]e just pulled out the pictures and gave them everything. That search is done.”
It was not true.
The DOJ provided the defense with actual photographs – no metadata. There were photos of Angel, Ivy, some of Raniere, and others. There were no photos of Camila or Daniela.
The truth is they were not pulled out of the camera. The FBI downloaded the digital images from a camera card. They did not give the defense the digital files. They gave them printed pictures, but did not tell the defense the photos came from a camera card.
The digital files with the metadata were not provided. They said they pulled them out of the camera.
But the Canon camera EOS 20D cannot print photos. One cannot pull pictures out of it. The camera can only transfer digital files to a camera card.
A camera card is a separate digital device. A user can install different camera cards – though only one at a time – into the Canon EOS 20D.
An FBI agent is not authorized to pull or print photographs from a digital camera card. CART must examine and copy the camera card first.
The DOJ misled the defense. They did not tell the defense about the existence of a camera card. The camera card stored digital photos separate from the camera. The DOJ did not say to the defense that it was a Lexar camera card that stored the images they printed.
The DOJ did not inform the defense they had a camera card.
“We just pulled out the pictures and gave them everything. That search is done,” said AUSA Hajjar.
What she told the defense was inaccurate. She might not have known. The FBI took photos from a camera card, digital device – but did not turn over the digital files.
Did they pull the photos out on September 19, when someone at the FBI accessed the camera card without a write blocker? Was this the work of incompetent amateurs? Akin to FBI SA Mills taking the wrong photograph of the hard drive?
A week later, the DOJ produced a forensic copy of the hard drive to defense counsel for Raniere. They gave identical copies to the defense counsel of the other five defendants.
The government did not say to the defense that the hard drive had evidence relevant to the charges. There was no need to. Nothing on the hard drive was relevant to any charge at that time.
The indictment consisted of charges against alleged adult victims. The ones Agnifilo kept saying were intelligent adults.
In October, AUSA Penza told the judge they were contemplating more charges. Those charges would come four months later. They would come from evidence found on a copy of the hard drive and from a camera card as yet undisclosed.
The alleged victim would not be an intelligent, successful adult this time. Not at the time the crimes allegedly occurred. But a child of 15. A child who could not consent.
The defense had no clue what was to come. And if the FBI told the truth, the FBI had no knowledge.
FBI SA Lever would make an accidental discovery in four months. A stupendous find by random luck. By happenstance. Based on his sworn affidavit, it was an accidental discovery of crimes.
It was stunning and game-changing luck. Lever was looking for sex trafficking and forced labor crimes on the black Western Digital hard drive committed on or after January 1, 2015.
Lever discovered child porn and exploitation of a minor in 2005.
If the metadata was not altered, the last access date on the hard drive was February 12, 2010. Daniela was around then. She handled backups to Raniere’s hard drives from his computers, as she testified.
Lever’s accidental discovery was on February 21, 2019.
Back in October 2018, ASUA Penza said to look out. Something’s coming.
If Penza was tentative in October, she was definite by November.
AUSA Penza told Judge Garaufis, “we expect a superseding indictment.”
She did not state what the new charges would be. How could she? It would be three more months before SA Lever accidentally discovered what they were.
Part #6 will be published shortly.