The story of NXIVM, DOS and the demise of their founder and leader, Keith Raniere, is the subject of the true crime documentary series The promise on HBO Max.
On October 27, 2020, Raniere was found guilty of racketeering, sex trafficking, forced labor conspiracy, and wire fraud conspiracy and was sentenced to 120 years in prison. He was also fined $1.75 million.
Raniere has always denied all allegations against him.
Since his incarceration, Raniere has had a large number of supporters campaigning for his release and in recent months has attracted the attention of a new legal team and experts who have raised concerns about key evidence presented at his trial in 2019.
Now Raniere’s legal team, led by attorney Joseph Tully, is accusing the FBI of tampering with the photographic evidence to fit the “government narrative” that was then used to “secure convictions for racketeering acts of possession.” of child pornography and sexual exploitation of a minor. according to the “Motion to Hold Appeal” documents, viewed by news week, submitted by Tully on October 6, 2022.
The allegations of tampering and falsification of evidence were supported by experts including former FBI special agent and forensic computer examiner and instructor Dr. J. Richard Kiper, and former senior FBI forensic investigator Stacy Eldridge. They were joined by Harvard Law School professors Ron Sullivan and Alan Dershowitz, Bud Cummins, the former U.S. Attorney for the Eastern District of Arkansas, and Tully of California.
The panel of six believes there is new evidence of substantial due process violations at Raniere’s original trial.
Speak against News WeekCummins, who is one of the attorneys advising on the case, said: “We have a number of digital forensics experts, someone who has experience within the FBI and is very familiar with their procedures, who are willing to go on the record and testify that they think there has been tampering.”
The manipulation of photo and folder dates
Raniere was found guilty of racketeering and one of these charges related to possession of child pornography on a hard drive seized from Raniere’s mansion on March 27, 2018 in Halfmoon, New York, and two charges of sexual exploitation of a child because of allegedly the images.
The charges concern Camila (not her real name), who was 15 years old when she allegedly began a sexual relationship with Raniere. She did not testify at trial, but in a victim impact statement read in court, Camila confirmed that she had been a victim of sexual abuse at the hands of Raniere.
Prosecutors successfully argued at trial that Raniere sexually groomed three daughters from one family, “Marianna,” the eldest, “Daniela,” the middle child, and “Camila,” the youngest. They used a series of WhatsApp messages exchanged between Camila and Raniere, in which Raniere called her his “slave” and asked her to recruit more “sex slaves”, in addition to testimonials from her sister Daniela. They also presented 22 nude photos of Camila, allegedly taken in 2005 by Raniere when she was 15.
Raniere’s defense team argues primarily that Camila’s images were not blatantly child pornography and were only considered pornographic based on the dating of the photos to 2005, when Camila would have been underage.
Six experts, including Kiper, claim that the photo data on the hard drive has been manipulated and the folder names spoofed to look like they were created automatically in 2005.
Kiper said News Week: “The external hard drive is said to contain the backup copies of photos that come from the camera card. You can take photos with the camera, then they are saved to the camera card and then transferred to another computer, an intermediate computer that was never found , never produced, never seen. But then all these pictures were backed up from that mysterious computer to an external hard drive and on that hard drive the alleged child pornography was found. No child pornography was found on that camera card. I just want to be very clear about that. Of course, there was nothing linking the alleged child pornography to that camera card, other than something we call excess data or metadata that can be very easily modified.”
To show that Camila was under the age of 18 in the photos, the government used metadata, primarily the Exchangeable Image File Format (EXIF) creation dates of the 22 images. Brian Booth, the FBI’s senior forensic investigator, testified under oath that EXIF data cannot be easily altered, which the six experts say is false. They also allege that Booth committed perjury by making that statement per the motion filed by Raniere’s attorney Tully in October 2022.
A photo’s EXIF date won’t change without manually changing the data, explains Kiper News Week.
He added: “The government is relying entirely on timestamps to mean that those pictures on the external hard drive they considered child pornography because according to that timestamp the subject of those pictures would have been 15 years old. That is their whole allegations of child pornography based on those timestamps and timestamps are extremely easy to change.”
Senior FBI forensic investigator Booth also testified at trial that it was not uncommon for agents to receive unsealed evidence with no mention of the unsealing.
In court documents, Raniere’s team alleges that this also amounts to perjury, as FBI policy clearly states that there is a chain of custody to determine that the evidence has not been altered in any way.
Kiper said: “It was the government’s intention to create a strong relationship between the camera card and the backup hard drive that is said to be [child pornography] backups, but the first FBI forensic report made contained only four files that were common to both the camera card and external hard drive. That was in the first FBI report and that FBI forensic investigator was not allowed to testify.”
He continued: “In the last week of the trial, he was on assignment abroad and this camera card was transferred to another forensic investigator, incidentally in an unsealed package, and that second investigator found 37 additional files and additional photographs on the camera card, and 31 of them had an external hard drive in common.
“So in other words, a second investigation was conducted into that camera card which itself violates FBI policy, what we call the Digital Evidence Policy Guide, and so a second forensic investigation conveniently resulted in more photos that are in common. had with the external hard drives.”
Kiper, who also trained the FBI’s Computer Analysis Response Team, explained how serious dealing with unsealed evidence is.
He told News Week: “Whenever we turn evidence over to the FBI, not only do we have the custody chain that the person signs, accepting custody of the evidence at a certain date and time, but they also sign if the evidence appears to be sealed and it needs to be be sealed with proof scotch tape with the person’s initials and date over the seal.
“If that seal is broken and it’s opened, it’s used, photographed, and examined. Then if it’s transferred to another person, it has to be resealed and reinitialized and everything. But when this camera card went to the second examiner, it was received by the second examiner unsealed, which is crazy.”
Tampering with images on camera card
According to court documents, experts believe the camera card was likely altered between April 11, 2019 and June 11, 2019, while he was in FBI custody.
According to FBI practice, no investigation of electronic evidence can take place until a forensic image (exact copy) of the device has been taken by the CART [Computer Analysis Response Team] laboratory. However, on Sept. 19, 2019, an FBI investigator removed the camera card from evidence review for “review” before CART processed the evidence, according to court documents.
On the same day, the camera card was accessed without a write lock, Raniere’s lawyer argued, which he says means that the dates of last accessed data were overwritten, inevitably removing all traces of when the evidence was last accessed.
What worries experts and Raniere’s lawyer Tully is that the review of the evidence took place before the 22 photos of alleged child pornography were officially discovered and later presented at trial.
In addition, the experts found that files 93, 94, 96, and 97, used by the prosecution to allege that the footage of Camila was shot with Raniere’s camera when she was a minor, contained thumbnails of a blonde woman on the camera card. However, on the hard drive, the thumbnails for photo files 93, 94, 96, and 97 showed a completely different woman, with brown hair.
Kiper described the miniature discovery as the “smoking gun.”
He explained: “That would mean that a camera could take two pictures of two different women at the same time. It doesn’t happen, so the new files that came out in the second FBI report placed in there will very likely show that stronger relationship. between the camera card and the external hard drive.”
In a normal backup, the camera card images, including their thumbnails, would match identically with their hard drive counterparts.
Tully argued in the motion to appeal that “this anomaly” is only due to “manual tampering.”
After filing the appeal, the court of first instance refused to grant the request to hear the evidence. News week has contacted the FBI for comment.
Raniere remains incarcerated in Tucson US prison and continues his fight for freedom.
The promise now streaming on HBO Max.