The Case for Weaponization Indictments

On the verge of trial, a hard drive that had been in FBI custody for eleven months suddenly produced alleged nude photos of an underage subject — outside the warrant’s timeframe and charges, justified as “plain view because accidental,” later admitted on camera by the lead prosecutor to have been targeted, and forensically determined to have been planted.

#	Fact	Proof click to enlarge ⤢
1	The hard drive was seized at 8 Hale Drive. The warrant (Attachment B) was scoped to sex trafficking, forced labor, extortion, and racketeering. Child pornography is not on the list.
2	February 21, 2019 — FBI claimed an “accidental discovery” on that drive: nude photos of a female, no sex act, dated to 2005. The 2005 date is the entire basis for charging the images as illegal — it would have made the subject 15. Produced child-exploitation charges and all 5 codefendants pleading guilty within a week, on the eve of trial.
3	Former lead prosecutor Moira Penza admitted on HBO the discovery was not accidental. On The Vow (S2 E6) she called it “a matter of finding those” photos — the language of a targeted search.
4	Seven experts (four former FBI) concluded under penalty of perjury that the photos had been planted and that timestamps on both the hard drive and the Canon memory card had been falsified to simulate the 2005 timeframe.

Joint Forensic Report by 7 experts (PDF)

On September 19, 2018, an unidentified FBI photograph technician — who like all FBI personnel is trained that signing chain of custody is required — took possession of the camera’s memory card and did not sign the chain of custody. FBI Special Agent Michael Lever gave the device to them without having them sign it. This occurred before the memory card had been forensically preserved by the CART digital forensics lab, which is forbidden by FBI policy. The photograph technician then connected the unpreserved memory card to a computer without a forensic protective tool called a “write blocker” — which would have prevented any changes — and left it altered, as proven by the access date being overwritten to that date: 09/19/18.

Chain of custody records; Joint Forensic Report, Doc. 1253-1

A forensic image is a bit-for-bit copy of all data on a device, used to examine evidence without touching the original. Booth created a second forensic image from the physical memory card months after the first authorized imaging (by examiner Stephen Flatley). This is prohibited by FBI policy — a second extraction of the device. Booth documented that his CART supervisor Trenton Schmatz authorized the work, which both knew was prohibited. The prosecution told the court Booth did not image the devices, making this a secret forensic image. His report showed 37 additional photo files appearing in the same folders as Flatley’s report — and the seven experts concluded at least 28 were manipulated and at least 20 were planted by a computer onto the memory card.

#	Fact	Proof click to enlarge ⤢
1	Two forensic copies of the same memory card — made at different times — should contain exactly the same files. They didn’t. 37 additional photo files appeared in the second copy that were not in the first. The red entries in the diagram show files present only in the second copy.

Joint Forensic Report (PDF) · Flatley Report File Index · Booth Report File Index

In the Trump Mar-a-Lago case, Jack Smith told the court that Loveall has worked for the FBI in digital forensics since 2000, has conducted hundreds of examinations, is the recipient of the FBI Director’s Award and the Presidential Early Career Award for Scientists and Engineers. Jack Smith stated Loveall would “testify about how … hash values are generated … the purpose behind hash-matching, including explaining how these steps ensure that the data … was not damaged, modified, or altered.”

Here is what this same expert actually produced in the Raniere case. The following walks through his most important finding — step by step.

#	Finding 2 — Step by Step	Proof click to enlarge ⤢
1	The problem Loveall was responding to: the 37-file discrepancy between the two forensic copies (see point above). Two copies of the same device should be identical. They weren’t.
2	Loveall’s response has three parts. First, he claims the discrepancy is due to “different settings” in the processing software — doesn’t say which settings, doesn’t demonstrate how any setting could create 37 new photo files, doesn’t test it. Second, he repeats the assertion. Third: “I have examined the disk images created of 1B15 and 1B15a and determined that they are identical.”
3	That claim is incoherent on its face. 1B15 and 1B15a are FBI evidence item identifiers. 1B15 is the Canon camera. 1B15a is the CompactFlash memory card inside it. These are different physical devices. Saying they are “identical” is like saying a DVD player is identical to the DVD inside it.
4	But set that aside. Even if he meant to compare the two forensic copies, “determined that they are identical” has no proof. In digital forensics, you prove identity using a hash value: a mathematical equation that converts all data on a device into one unique number. Change a single character and the number changes completely. It is the DNA test of digital evidence. At this trial, the government’s own examiner Brian Booth explained this to the jury:
5	Booth named his algorithm: “Message Digest 5, called the MD5 verification.” If “anything gets changed on a hard drive … this whole function … would be different and we know something has been changed.” That is what proof looks like.
6	What Loveall’s statement should have looked like: “I performed a SHA-256 hash comparison on forensic images at [path] and [path] and confirmed both returned hash value [value].” Algorithm. File paths. Hash output. The standard Loveall teaches at George Mason. The standard Jack Smith told the court Loveall would explain to a jury. He provided none of it.
7	The question: Did FBI Senior Computer Scientist David Loveall — recipient of the Presidential Early Career Award for Scientists and Engineers, the FBI Director’s Award for Outstanding Technical Advancement, and the same expert Jack Smith selected to explain hash values to a jury in the prosecution of President Trump — not know that his report contained no proof?

Retired FBI ASAC Mark Daniel Bowling — nearly 20 years as a federal agent — walked through the Loveall report under penalty of perjury and concluded it was “structured to be intentionally deceptive.”

Read the full analyses:
Bowling’s takedown of the Loveall report (PDF)
Joint report by the seven experts — point-by-point debunking of Loveall (PDF)

FBI search photos show items appearing, disappearing, and being rearranged between photographs. Two books on sex trafficking were documented by agents but never photographed in their original location and never collected as evidence. A less relevant book, A History of Torture, was collected.

If sex trafficking books were genuinely found at a location described as a sex trafficking site, they would be the single most relevant physical evidence. Agents would have seized them.

FBI search photographs, 8 Hale Drive, March 27, 2018