FBI Tampered for Child Porn Charge

If egregious and irrefutable evidence were exposed that America’s most hated defendant was framed, would people care? If you agree with Dr. Martin Luther King Jr. that “injustice anywhere is a threat to justice everywhere,” then a corruption of massive proportions of the justice system should be of grave concern, regardless of who is the target.

Overt acts of possession and production of child pornography and sexual exploitation of a minor were used to support a conviction of racketeering of Keith Raniere on June 19, 2019, among other charges. The prosecution alleged he had 22 nude images on a device of an underage girl (identified in the trial as a woman named Camila, now age 30) who, according to the government, was 15 at the time they were taken.

Dr. Keshava Munegowda reviewed file system data of Raniere’s two devices. Dr. Munegowda holds a PhD in Computer Science, 5 related patents, has been published and cited in peer reviewed journals, and wrote a book on analyzing computer file systems. Dr. Munegowda issued a comprehensive report, which includes certifications from 2 other forensic experts, with the smmary analysis dated October 23, 2020. To date,  3 additional digital forensics experts reviewed statements from the report and corroborated its conclusions. One of those corroborators, Steven Abrams, J.D., M.S. of Abrams Cyber Law & Forensics, is an award-winning forensics expert and a litigation attorney licensed to practice in South Carolina, District of Columbia, and New York.

The report contains detailed technical analyses that clearly show: 

• There was “extensive and calculated fabrication” on the hard drive, which contained the 22 images of alleged child pornography.

• The prosecution’s FBI computer expert witness made a false statement to the jury about how difficult it is to tamper with a specific data type in question.

These facts are now also coupled with the following irregularities of the trial:

• The prosecution’s FBI witness testified that an unknown person accessed Raniere’s device while it was in FBI custody.

• After being asked, the government did not provide the defense a forensic clone of the devices. Forensic clones make tampering much easier to reveal.

The devices and files that the report deems as “manually altered” were used as evidence of overt acts (possession and production of child pornography and sexual exploitation of a minor) to support a conviction of racketeering. Twenty-two images on those devices were key evidence that the prosecution used to argue that the photos were taken in 2005, when the subject would have been underage.

Dr. Munegowda summarizes his report by saying, “It is my expert opinion that the government, or someone in concert with the government, likely tampered with the hard drive and media card .” In a summary corroboration statement, Mr. Abrams issues an even further statement saying that the evidence had an “invalidated chain of custody,” that “the dates and times associated with those digital photos cannot be . . . assumed to be accurate,” that the FBI “either purposely misled the fact finders or is not sufficiently knowledgeable about the facts to which he testified,” that the prosecution “purposefully misled the jury about the reliability of the digital photo evidence,” and that the government was “intentionally dishonest…in its closing statement to the jury.”

A summary of the report’s key findings are below, and the full technical report is available for the public to review here.  Corroborations of the technical statements are here.

Summary

• The camera’s media card was modified while in FBI custody by an unknown person before it was sent to the lab for analysis.

  • FBI Examiner Brian Booth testified at the trial that Raniere’s media card was accessed by an unknown person on September 19, 2018, which was after it was seized by the government on March 27, 2018.

  • The FBI witness also confirmed that an unknown person changed the media card’s file system data while it was in FBI custody, and there is no record of who changed it. This shows a break in the chain of custody.

  • A forensics tool to prevent changes to the device files and metadata is called a write blocker. It allows for viewing of a device without modifying files or file system data. The FBI witness’s testimony shows that a write blocker must not have been used at least once when the device was accessed while in FBI custody. This must be true because he testified above that the file system data was altered.

  • The dates in the testimony reveal that tampering happened after the device was seized on March 27, 2018, but before it reached the FBI’s forensics lab on February 22, 2019.

  • The above facts show that the media card was accessed and changed 6 months after the FBI took possession, and the FBI has no official record or explanation of who accessed the card and how that happened.

 

• In a “breach of proper handling of electronic data“, the camera and media card arrived at the FBI forensics lab in an open, unsealed box and bag; this was after an unknown person had accessed the media card months prior.

  • FBI Examiner Booth testified multiple times that Raniere’s camera arrived in an unsealed box and bag, and the media card arrived in an unsealed bag. 

• According to the report’s Statement 1A, “at least 94 pictures on the hard drive” were “altered.” These pictures are on the same hard drive and under the same folder that contained the 22 allegedly contraband photos.

  • The report shows that the person who altered the photos made several errors with respect to calculating and accounting for Daylight Savings Time:

    • First, the report shows that the camera, a Canon EOS 20D, is “not time zone aware.” This means the camera “does not store any information on the compact flash card that would allow the time to be adjusted from one time zone to another.” The specific file systems on the media card (FAT-16) and hard drive (FAT-32) are also not time-zone aware.

    • File modified times were shifted back 1 hour before Daylight Savings Time ended, 2 hours for some pictures on the very day that Day Light Savings ended, 0 hours for others on that day, and then 0 hours after that day.

    • All of the pictures were copied to the hard drive in a 2 minute period, which means someone could not have crossed time zones multiple times when the files were backed up to the hard drive.  

    • As noted in Statement 1B, an addendum to Statement 1A, the only rational explanation for the time shifts is that someone tried to make it look like Daylight Savings Time adjusted the times naturally, but the tamperer made human errors.

• According to the report’s Statement 5 and Statement 10, someone made one picture look like it had originated from Raniere’s camera. This alteration suggests it may have come from another source from what the government report indicates.

  • A photo on the hard drive was edited after it was downloaded from the media card. This is known because the file’s metadata (EXIF data) showed that Photoshop had been used on the photo.

  • When a photo gets taken, the file creation and last file modified date are typically very close, within seconds.

  • In a highly technical explanation, the report explains how, for this particular photo, the file’s last modified date must have been “altered manually.”

  • The report further explains that this manual alteration was likely done to give the appearance that the photo came from the camera. That the alteration was done suggests it may not have.

• According to the report’s Statement 7, the FBI’s computer expert witness made four false statements to the jury, incorrectly stating that tampering with photo metadata (which includes photo creation dates) is difficult.

  • Dr. Munegowda’s report states that FBI Examiner Booth “knowingly lied” under oath about the difficulty of changing metadata on photos (EXIF data, like dates/times) when he said: “it’s not easy to change.”

  • The report further states that the exact opposite is true by saying, “EXIF data being easily modifiable is a well-known fact that anyone familiar with technology, especially a forensic examiner, would know.” The report goes on to say a “simple Google or YouTube search” proves how easy it is for even a “lay person” to change EXIF data (see: sample Google search here).

  • The report includes an additional opinion from another forensics examiner, Steven Burgess of Burgess Forensics, who corroborates the claim that EXIF data is, in fact, easy to alter.

• The government did not provide the defense with a “forensic image” of Raniere’s devices. According to the report, by not providing “forensic images” of the devices in question, the defense was given “forensically unreliable” evidence.

  • According to the report, forensic images are “the gold standard” to make a “bit-by-bit copy” of all the contents of the device.

  • A forensic image is a frozen-in-time copy and it allows both the prosecution and the defense to have access to the same data-rich evidence to examine.

  • The defense requested a forensic image of Raniere’s devices (in a confidential email on April 18, 2019), with specific instructions on how to redact the 22 allegedly contraband images.

  • The prosecution never gave the defense forensic images of the devices (evidence of this exists in a confidential email sent on October 5, 2020). Instead, the defense only received PDF reports of the file system of the media card and a simple copy of the hard drive.

  • This letter in the report states that having only a copy of the hard drive is “not a forensically reliable way to preserve the contents of a hard drive or storage device and is of little value when there is a dispute about the reliability of the data or questions about metadata such as date and time stamps.”

  • In addition to not having a forensic copy of the devices, according to a motion filed by Raniere’s attorneys 15 days before the start of the trial, the defense still had not provided “reports concerning the search of the backup hard drive from which the child pornography was allegedly recovered,” even though the defense had repeatedly asked.

• The devices in question were critical elements of the arguments the prosecution used to convict Raniere of Racketeering Counts 2, 3, and 4.

  • In the prosecution’s closing statements for Counts 2 and 3 (Sexual Exploitation of a Child), the prosecution established Camila’s age using the lack of an appearance of a scar on her body (which she did not have when she was a minor) and the creation dates of the files.

    • Regarding the creation dates of the files, the prosecution told the jury that the FBI expert witness said the photos “were taken exactly when the folders stated they were taken.” This expert witness actually said the exact opposite of this statement in his earlier testimony when he stated, “the file system metadata for those dates and times are not accurate.”

    • Regarding the absence of the scar to prove Camila was underage, the tampering of the photo with the Photoshop tag outlined in the report, along with other tampering on the hard drive, raises real questions of the authenticity of the 22 photos’ contents.

  • In the prosecution’s closing statements for Count 4 (Possession of Child Pornography), the prosecution argued that Raniere had “control over the images . . . [and] you know the defendant did, because again, the defendant took those photos.”

    • Given the extensive tampering uncovered in the report, the validity of this argument is also affected by the questionable data integrity of the devices.

Expert Conclusions

Dr. Munegowda concludes that:

“Considering the above points and that the only beneficiary of the tampering is the party that brings the charge – the government – it is my opinion that the     government, or someone in concert with the government, likely tampered with the hard drive and media card.”

“The only purpose that such an extensive and calculated fabrication would serve is to support the allegation that 22 contraband pictures were found on the hard drive as presented. That such a fabrication was necessary implies that the contraband pictures were not found as presented [by the government].”

He also explains the likely motivation the tamperer had to alter files on both devices:

“It is my opinion that these alterations were done to make it seem that the dates of the pictures on the hard drive were authentic and the pictures came from the media card. “

In his conclusion, Steven Abrams J.D., M.S., writes the following:

“In conclusion, it is my expert opinion that the digital photo evidence, based on the abovementioned materials I reviewed, was tampered with and should have been excluded as unreliable, and should not have been used to support any charges.  Further, based on my reviews of the above mentioned materials it appears that the government … was intentionally dishonest about the reliability of said digital photo evidence in its closing statement to the jury.”

The irregularities of the evidence handling by the FBI and Dr. Munegowda’s analysis of tampering raise serious questions about the validity of the evidence used to convict Raniere of three counts of racketeering on the basis of production and possession of child pornography. Notably, this child pornography “evidence” had a major impact on the case, not just for Raniere but for his co-defendants. All of Raniere’s co-defendants but one plead guilty AFTER the child pornography charge was publicly announced. If the defense had been provided forensic images of Raniere’s devices before the trial, perhaps their team would have been able to expose the likely tampering of evidence that a world-class expert was only able to figure out after the trial had ended.

Had a hard drive and media card been taken from Raniere upon arrest, sealed and kept in a secure chain of custody, and taken to a crime lab where they found child pornography on it (using photo dates to show the woman’s age) . . . those clean facts, if true, would likely have meant Raniere committed a serious crime. However, the reality was far from that scenario: The devices were seized from Raniere, were left by the FBI in an open box and an unsealed evidence bag, were accessed by an unknown person before being analyzed, and then months later, child pornography was found on the hard drive when it was analyzed for the first time. In addition, Dr. Munegowda’s corroborated report shows the devices the FBI analyzed had manually altered photos, had tampering with a file that had been edited in Photoshop, and had manually altered photo dates. The prosecution later argued that the photo dates showed the woman’s age based on the creation dates shown in the devices, which is the opposite of what the prosecution’s witness testified. In addition, that same FBI computer expert witness gave false statements on the stand with regards to the difficulty of tampering.

Based on Dr. Munegowda’s report showing proof of tampering, with corroborations by Steven Abrams J.D., M.S. and other experts, and the irregularities in the handling of Raniere’s devices, including a break in their chain of custody, the reliability of the devices that held the alleged contraband photos is now called into question. The contents on these devices were used to establish that the subject in the photos was underage, and as outlined above, technical findings now show that the evidence presented to the Court to convict Keith Raniere was certifiably compromised.