In a joint letter to FBI Director Kash Patel, former FBI and DOJ officials wrote about a single federal case:
“This case is a perfect vehicle to expose the weaponization of the DOJ and FBI.
The FBI expert used to cover up evidence fabrication here was not a forensic examiner routinely assigned to prosecutions. In fact, over a four-year span, he was brought into only one other case: Special Counsel Jack Smith’s prosecution of President Trump.
We are writing to notify you of clear evidence of indictable government crime, which your predecessor, Director Christopher Wray refused to act upon.”
August 19, 2025 letter to FBI Director Kash Patel (PDF)
The case? U.S. v. Keith Raniere (EDNY, 18-cr-204).
Many of the FBI and DOJ personnel implicated in knowing misconduct in this case — proven by the government's own records — have since been deployed onto other major federal prosecutions, as listed in the table further down this page.
This includes Jack Smith's Mar-a-Lago prosecution of President Trump, the OneTaste case, and the Douglass Mackey "meme" case — as well as providing key testimony for the House Select Committee's criminal referral of President Trump relating to the 2020 election.
The longer the conduct documented here goes unaddressed, the more additional cases they will touch whose integrity may later be called into question.
Seven forensic experts — including four former FBI experts — concluded that nude photos of women had been planted onto a hard drive, and embedded within them were the nude photos the prosecution claimed were of a 15-year-old from 2005.
An independent expert retained by Newsweek agreed with their findings.
Those planted photos formed the basis of the only underage charges in the case.
Digital evidence can be altered invisibly with a single keystroke.
That's why the FBI's rules are strict: the original device must first be copied by the forensics lab using a write-blocker (a tool that prevents changes). After that, everyone works from the copy — not the original device itself. And every person who handles the device must sign the chain of custody.
Here, the lead FBI agent (Michael Lever) delivered the other seized devices to the forensics lab — except for the camera and memory card later claimed to have taken the contraband photos.
Instead, he gave the original, unpreserved memory card directly to an unidentified FBI "photograph technician."
Neither one signed the chain of custody for the transfer.
The FBI technician then accessed the original memory card without a write-blocker.
Overwritten file-access dates showed the card's data had been altered on that date.
The government refuses to identify the FBI technician.
Seven post-conviction forensic experts (including four former FBI experts), along with an independent expert retained by Newsweek, later concluded the memory card evidence had been falsified, including planted files and manipulated timestamps.
The FBI forensics examiner (Stephen Flatley) who first copied the memory card — after it had already been altered in FBI custody — was never questioned.
The government said he was unavailable because he had been sent to Ghana during the trial.
Ghana's own immigration records show that wasn't true.
Search-scene photographs are supposed to document evidence as it was actually found — not use objects to create more persuasive or incriminating scenes after the fact.
But comparing the FBI's own search photos shows agents created scenes using uncollected items never photographed in place, meaning there is no documented proof where those objects came from or where they were originally found — including a second camera and books about sex trafficking, the central allegation in the case.
Photographs of those scenes were then presented to the jury as authentic "found as is" photographs.
This happened before any indictment — from the very start, investigators were creating a narrative.
The prosecution's story about the most serious charges should not change after trial.
At trial, the government told the court there were "18 or so" alleged CP photos tied to two production dates: Nov. 2 and Nov. 24, 2005.
The government then asked for — and received — a sentencing enhancement based on those two production dates.
Years later, prosecutor Tanya Hajjar claimed it was only "at least nine" photos tied to a single production date — Nov. 2, 2005.
Then, on appeal, she claimed "at least nine" photos had been the government's position all along.
That is not what the prosecution told the trial court.
The courts foreclosed scrutiny of the evidence planting and related misconduct — denying even a hearing by relying on a rebuttal report from an FBI expert who never testified and didn't even date his report. That expert's only other testimonial role in four years? Jack Smith's Mar-a-Lago case. (Details →)
The evidence above — and additional evidence linked below — implicates the following FBI and DOJ personnel in knowing misconduct documented in the government's own records. Each "Proof" link contains a step-by-step walkthrough of the underlying records and source documents.
| # | Name & role | What they did in this case |
|---|---|---|
| 1 | Michael Lever — FBI Special Agent (case agent) |
|
| 2 | Maegan Rees — FBI Special AgentAlso involved in:Douglass Mackey prosecution (Twitter meme case) |
|
| 3 | Unidentified FBI photograph technician |
|
| 4 | Brian Booth — FBI Senior Forensic Examiner |
|
| 5 | Trenton Schmatz — FBI Supervisory Special Agent |
|
| 6 | David Loveall II — FBI Senior Computer Scientist (post-conviction expert)Also involved in:Jack Smith's Mar-a-Lago prosecution of President Trump |
|
| 7 | Christopher Mills — FBI Special Agent |
|
| 8 | Tracee Mergen — FBI Special Agent |
|
| 9 | Brett Hochron — Task Force Officer (NY State Police) |
|
| 10 | Elliot McGinnis — FBI Special Agent (evidence logger)Also involved in:OneTaste prosecution |
|
| 11 | Michael Weniger — FBI Special Agent |
|
| 12 | Moira Kim Penza — AUSA, lead trial prosecutor (EDNY)Also involved in:Zervos v. Trump — Celebrity Apprentice contestant defamation case |
|
| 13 | Tanya Hajjar — AUSA, co-counsel (EDNY) |
|
| 14 | Richard Donoghue — U.S. Attorney (EDNY)Also involved in:January 6 Committee witness against President Trump |
|
Here's the full charge list. There are no charges for the body mark the media called "branding." The sex-themed charges are highlighted in red — and not one of them is him having sex with anyone.
Count 2 (Racketeering) is built on a set of predicate "racketeering acts." Count 1 (Racketeering Conspiracy) covers the same acts. Counts 3 through 7 are stand-alone.
1. NY State Police investigated the conduct — including the body mark — and called it consensual.
The New York State Police investigated the same underlying conduct that would later anchor the federal case — including the body mark the media would call "branding" — and deemed the activities "consensual," as reported by the New York Times on October 17, 2017.
2. The local federal district was approached and didn't prosecute.
In May 2017, the Northern District of New York — the federal district covering Albany, where the alleged conduct occurred — was approached with these core allegations and declined to prosecute. Mark Vicente confirmed this on the trial record.
3. Days after a New York Times article, EDNY — 160 miles away — started one anyway.
Years post-trial, the lead prosecutor Moira Kim Penza said it on camera, on Starz's Seduced:
"When I read the New York Times article, it immediately felt apparent to me that there was criminal conduct going on and that there must be a lot more to what I was reading about. And so I started digging in. My office very quickly got an amazing team of FBI agents on board and within days really, we were interviewing witnesses and victims."
What this means. The October 17, 2017 New York Times article reported that NYS Police had deemed these Albany-based activities consensual. An AUSA in EDNY, 160 miles away, read that same article, and within days had FBI agents interviewing witnesses — starting a federal prosecution out of Brooklyn on conduct that the Albany authorities had already rejected.
From the pretrial transcript, March 18, 2019, on the trial record: the prosecution itself described the alleged child-pornography charges as "at the heart" of the case.
Nude photographs of a single person — no sex act depicted — found on a hard drive and traced to a camera (containing a memory card), both seized in March 2018. The photos were not themselves illegal. What made them illegal, according to the government, was a 2005 timestamp on the files, because in 2005 the person in the photos would have been 15.
The alleged 2005 dating came entirely from easily modified digital timestamps — not witness testimony. No witness ever placed the photos in 2005.
If the photos are excluded as planted and falsified, all three predicate acts have no basis. Nothing else in the case is underage-related.
Seven independent forensic examiners — four of them former FBI — with a combined 150+ years of digital forensics experience conducted a comprehensive analysis. In their joint report, they jointly concluded: hundreds of timestamps were manipulated, files were planted, and that manipulation was done "apparently to simulate a 2005 timeframe" (the 2005 timeframe being what made the images illegal).
"The involvement of government personnel in this evidentiary fraud is inescapable — an unprecedented finding in our combined 150+ years of forensic experience."
Newsweek retained its own independent forensic expert, who reviewed the evidence separately and agreed with the seven experts' findings. Not a defense-hired expert — independent journalistic verification.
FBI Senior Computer Scientist David Loveall II — the same expert Jack Smith later selected for the Mar-a-Lago prosecution of President Trump — produced the DOJ's sole forensic rebuttal. It was undated, contained no proof, misidentified the evidence, and claimed testing on a computer model that does not exist.
Full breakdown of the Loveall report →
The FBI collected the camera (containing the memory card) on March 27, 2018. No date field on the card should reflect activity after that point. But it does: the access dates of dozens of photos were overwritten to September 19, 2018.
This was five months before the device was ever sent to the FBI's Digital Forensics lab (CART). Under FBI DEPG 3.3.4.5, CART must first forensically copy the original device to preserve it; from then on, everyone works from the copy, not the original. No one — least of all someone outside CART — should have been touching this card on September 19.
On the stand, Booth confirmed the metadata was changed on the memory card while in FBI possession.
Booth testimony — altered dates (PDF)
The chain of custody for that day shows SA Michael Lever checked the memory card out of evidence storage on September 19, 2018 — and held it for 7 days.
In an opposition motion (Doc. 1213), the prosecution acknowledged the September 19 alteration. Their explanation, in a footnote: an FBI "photograph technician" had been brought in that day — supposedly just to "copy the photographs from the camera card" for discovery production.
Three problems with that:
August 8, 2018: Lever delivered all the other seized devices from the property to CART for forensic preservation — keeping only the camera and memory card back. CART notes (DX 961) →
September 19, 2018: Lever checked the camera and memory card out of evidence and gave them to the FBI photograph technician. All FBI personnel are trained that signing the chain of custody is required when transferring evidence. Yet:
Four former FBI CART examiners called this kind of conduct a "knowing violation" of FBI protocol. Joint Process Report by four former FBI experts, Doc. 1273-8 (PDF) →
Seven post-conviction forensic experts (four former FBI) later concluded dozens of files on the memory card were planted with manipulated timestamps. Joint Forensic Report, Doc. 1253-1, ¶15 (PDF) →
Lead prosecutor Moira Kim Penza, addressing the court at trial: "CART Analyst Flatley is in Africa right now."
Trial transcript, June 13, 2019. PDF →
Brian Booth, on the stand: "Stephen Flatley is out on assignment in Ghana. So he's not able to be here because he's on operation."
Trial transcript, June 13, 2019. PDF →
A notarized letter from the Comptroller-General of Ghana's Immigration Service shows Flatley's complete travel history. His last recorded departure from Ghana: September 28, 2018 — more than eight months before the prosecution and Booth told the court he was there. No entries during the trial (May 7–June 19, 2019). And no entries since.
Ghana Immigration Service letter, notarized (PDF)
Did the FBI and prosecution lie to keep Flatley off the stand?
The prosecution charged Raniere with two predicate acts of child exploitation — one for the alleged taking of nude photos on November 2, 2005 and one for the alleged taking on November 24, 2005.
What was actually on the device matched that two-date structure. The FBI's own file listing (Government Exhibit 550) shows two folders — one for each charged production date:
Government Exhibit 550 — FBI file listing.
AUSA Penza stated "18 or so images of child pornography." When Judge Garaufis asked, "And you're going to ask the jurors to look at all 18 images," she confirmed, "Briefly, your honor."
On direct examination, Hajjar walked Examiner Booth through the EXIF data and had him confirm the photos reflected both charged dates — November 2, 2005 and November 24, 2005.
The government argued that the two-date framing supported a "pattern" sentencing enhancement — and the court applied it. The two-date position wasn't just argued; the prosecution litigated on it and benefited from it.
In a post-trial filing (Doc. 1213, p. 6), AUSA Hajjar now states only "at least nine … were child pornography" — all on a single date: November 2, 2005. The November 24 date — and an entire charged predicate act of exploitation — drops entirely.
On appeal, AUSA Hajjar defends that it was always "at least nine [that] constituted child pornography" — implying that the rest of the "18 or so" were merely nude photos, not CP.
But that's not what Penza told the trial court. Penza said the binder had "each of the photographs that's been charged" and "so it has 18 or so images of child pornography in it." When Judge Garaufis asked, "And you're going to ask the jurors to look at all 18 images?" Penza confirmed: "Briefly, your honor." All 18 were called CP, on the record.
The 2nd Circuit panel affirmed Judge Garaufis's denial of an evidentiary hearing into the documented evidence fabrication and, unprompted, commended his conduct of the case as "skill, patience, and restraint."
At a restitution hearing in this case, Garaufis mocked defense attorney Marc Fernich, whose mentor had just died of pancreatic cancer — motioned to a tissue box, told the clerk "give him this to go cry on," threatened to arrest him, and sat through a silent 30-minute staring contest.
Reported by Vanity Fair, July 2021.
Noah Goldberg — whose coverage was openly hostile to Raniere — tweeted in real time: "one of the most bizarre moments in court I've ever seen." The tweet has since been deleted; archived below.
Garaufis denied an evidentiary hearing into the planting and falsification by relying on an undated, proofless report from FBI Senior Computer Scientist David Loveall II — the same expert Jack Smith later selected for the Mar-a-Lago prosecution of President Trump. Loveall never testified, was never cross-examined, and his report misidentified the evidence.
Full breakdown of the Loveall report →
Search-scene photographs are supposed to document evidence exactly as it was found. That's why investigators first photograph items "in place" — before touching or moving them. Otherwise, there is no way to prove where an object actually came from.
Without that safeguard, investigators could rearrange scenes or introduce new objects after the fact and present the result as authentic.
Click any photograph to enlarge.
On March 27, 2018, FBI agents searched a townhouse at 8 Hale Drive, Halfmoon, NY. The search sought nude photos of adult women allegedly used as blackmail material.
Cameras were important.
They documented two cameras at the scene. They only took one.
The first camera — Item 1 — was photographed in place. Then moved for a clearer ID photo. Collected as evidence.
The second camera — Item 5:
What the jury saw: this camera with its cord draped over it on a cluttered countertop, as if just found there:
But it wasn't actually there:
No "in place" photograph. No record of where it came from.
And in the evidence log, written as "NOT TAKEN."
The jury saw the evidence photos. Looked like they found cameras, as expected.
And the camera they did collect — the one handled by protocol? That's the one whose memory card was later altered in FBI custody. Its files have since been proven falsified — by seven experts (four former FBI) and an independent expert retained by Newsweek.
The warrant sought "sex trafficking" paraphernalia.
Agents collected a book on The History of Torture as Item 3.
Later they placed two books about the central alleged crime — sex trafficking — on the desk.
No item label. No photograph recording where they were found.
The books weren't on that desk:
The photo log says they came from the bookshelf — and the prior photo was of a bookshelf. But in that bookshelf shot, you can't see these books:
The jury saw the search photos. A defendant accused of sex trafficking — with two books on sex trafficking sitting at the townhouse.
If those books were authentically at the property, that would be damning evidence. So why wouldn't agents photograph them in place? Why wouldn't they take them as evidence?
There are three search photos of devices on the bookshelf above the desk in the upstairs office. Two of them are demonstrably an agent-created vignette:
Agent-created vignette
Agent-created vignette
All three photos show the same exact spot on the same bookshelf.
You can confirm this by comparing the wall brackets, the monitor edge, the shelf line, and the wires:
In the Item 2 shot — just three devices on the shelf. In the Item 37 shot — the same shelf, but now: a Rubik's Cube (unopened), a Stem Cell DVD, two CDs, and two books on sex trafficking.
5 objects used to create the vignette. None photographed in place. None collected as evidence.
And the two books? The exact same two books that "appeared" earlier on the desk.
Earlier in the search, the bookshelf held Item 2 in this spot. Then it changed — first to Item 36, then to Item 37.
Here's the same sequence brought to life — with the intermediate steps in between, so you can see the multistep construction of the vignette:
Here's what had to have happened, step by step, between these shots — based on the FBI's own evidence log actions:
By steps 7 and 8, Mills, Mergen, and Hochron all knew they were using a manufactured vignette as if documenting an authentic scene. All three are implicated in scene creation that became search-scene photographs shown to the jury at trial as authentic.
And once you've established this with one of the scenes — how can you be sure any of the scenes the jury saw were authentic? That anything was truly found where the agents said it was?
Requires causing a person to engage in a commercial sex act by force, fraud, or coercion (or with a minor). "Commercial sex act" requires "anything of value" given to or received by any person.
Jay — a 27-year-old Los Angeles actress, a member of the women's group, and an acquaintance of Raniere — was told by Allison Mack to ask Raniere to take a nude photo of her.
The government's theory of coercion rested on "collateral" the women had previously provided when joining the group.
Jay never did it. Under the government's own direct examination, Jay confirmed she did not do the assignment. (Trial June 11, 2019, p. 4424.) The last time she saw Allison, she told her to back off — and that was it. Nothing else ensued. (p. 4440.)
The prosecution's closing argument reiterated to the jury that the attempted-sex-trafficking count is exactly this assignment — the one Jay never did.
Government's closing on Count 10 (PDF)
40-year sentence. For a photograph that was never taken.
Another woman, Sylvie, got the identical assignment under the identical coercion theory — and complied.
At sentencing, the same judge ruled what actually happened with Sylvie wasn't sex trafficking — not even under the lower civil preponderance standard.
Nicole — a 29-year-old actress living in Brooklyn who was taking classes in the acting program created by Allison Mack and Keith Raniere — was told by Mack to go on a walk with Raniere and do whatever he wanted.
The encounter ended with Nicole — blindfolded and tied to a table — receiving oral sex from another person (a woman). Raniere did not participate in the sex act.
Nicole testified Raniere told her afterward that the other person was a woman.
No money changed hands. The "commercial benefit" element required for federal sex trafficking: the prosecutor argued Mack received a "thing of value" by making Raniere happy and gaining social standing in his inner circle.
Government closing on Counts 8/9 (PDF)
Two concurrent 40-year sentences for a single incident where a woman received oral sex from another woman, and the "commercial benefit" was making someone happy.
When you hear "sex trafficking," do you picture a woman being told to take a nude photo and refusing — nothing happening? Do you picture a woman receiving oral sex from another woman, once, with no money involved? That is the entirety of the "sex trafficking" conduct.
EDNY leaked sealed, extraditable "sex trafficking" charges to mobilize the Mexican government into an armed takedown under a false "fugitive in hiding" pretext — while the US itself had already handed Mexican authorities a dossier with his address, workplace, and walking route. Then they wrote it up for the court as a routine Mexican deportation.
EDNY represented to the court that Raniere was a "fugitive in hiding" and that they had coordinated with Mexican authorities for six weeks to locate him. (EDNY March 26, 2018 detention letter.)
EDNY March 26, 2018 detention letter (PDF)
EDNY's own dossier — the one they handed to the Mexican government — listed Raniere's home address, workplace, partner, the restaurant he frequented (Taller Veganico, a Tripadvisor-listed Monterrey vegan restaurant), and a note that he was "known to walk several miles each day at odd times," with street photographs. You cannot be in hiding and be that findable.
Per Lauren Salzman's trial testimony, Mexican authorities presented Raniere with the EDNY charges on March 25, 2018 — one day before the unsealing order was signed (March 26, 2018, by Magistrate Judge Steven Gold). EDNY leaked sealed charges to a foreign government — a direct violation of the court's sealing order.
Salzman testimony (PDF) · Unsealing order (PDF)
The same day Mexican authorities presented the sealed charges, the FBI purchased Raniere's commercial flight back to the US for the next morning — before any Mexican deportation order had been issued. Receipt is in the FBI's name: PVR → DFW, 7:06am March 26. A routine Mexican deportation does not involve the FBI booking the commercial seat.
FBI plane ticket purchase (PDF)
Mexican paperwork lists the apprehension as a domestic "visa check." The visa check was performed by armed balaclava men who presented the sealed EDNY charges to Raniere.
To the court: EDNY framed the arrest as Mexican immigration officials encountering an "uncooperative" subject who had "purposely concealed his location" — covering up the EDNY orchestration that actually drove it.
To the public: Media coverage (CBS News and others) portrayed a dramatic international apprehension of a fugitive sex-cult leader — exactly the narrative EDNY needed to seed the rest of the case.
Computer trespass confirmed by law enforcement, IP-traced and verified by New York State Police to three media conglomerates and a Vanity Fair writer.
IP addresses from the Dow Jones–Telerate corporate network (New York, NY) were logged accessing NXIVM's password-protected database without authorization, on specific dates and times captured in the server logs, and forensically confirmed by NYSP. (Case 1:14-cv-01375, Doc. 86-6.)
Trump connection: President Trump is currently in a $10 billion defamation suit against Dow Jones over the "Epstein letter" story.
IP tracing forensic declaration (PDF)
IP 69.2.120.11 (Advance Publications, NY) was confirmed on NXIVM servers by NYSP. Vanity Fair writer Suzanne Andrews, whose IP (207.237.232.82) was matched via email header to the intrusion log, went on to author "The Heiress and the Cult" hit piece (November 2010) — one of the foundational media narratives that drove public perception of the case before charges were ever filed.
Criminal referral — Vanity Fair (PDF)
IP address 167.166.23.253, belonging to the Times Union network (Saratoga Springs, NY), was logged accessing NXIVM's password-protected database and confirmed by NYSP.
What makes this one especially devastating: at a pre-trial conference on June 12, 2018, Judge Garaufis — the judge who would preside over the entire trial — said on the record that all he knew about the case was what he had read in the New York Times Magazine and the Albany Times Union. The federal trial judge openly told the parties, in open court, that his entire prior knowledge of the case came from one of the same outlets whose corporate IP address sits inside the criminal hacking logs. The laundering pipeline confessed on the record, on the way into the trial.
A grand jury indictment was returned on February 27, 2015 in Albany County — 7 counts of Computer Trespass under NY Penal Law §156.10(2), a Class E Felony. Three non-media civilians indicted: Toni F. Natalie (4 counts), Barbara J. Bouchey (1 count), Joseph J. O'Hara (2 counts). Earlier in the same investigative line, Times Union blogger John Tighe pleaded guilty to a related computer-hacking charge. (Times Union, Nov. 5, 2014.)
Albany County indictments (PDF)
Two of these three indicted individuals — Toni Natalie and Barbara Bouchey — did not disappear after the 2015 indictment. They became star "victims" in the EDNY prosecution: delivered impact statements at Raniere's sentencing, appeared in HBO's The Vow and Starz's Seduced, and served as the media's go-to "former NXIVM" voices. The same people indicted for criminally hacking the defendant's database were retrofitted into "victims" in the federal sex-crime case built off the narrative those hacks helped seed.
On direct examination, AUSA Tanya Hajjar showed SA Christopher Mills the camera (Government Exhibit 520) and the memory card (Government Exhibit 524) and asked: "What happens when you recover a piece of digital evidence like Government Exhibit 520 and 524?"
Mills described the standard FBI process — submit the device to CART (the Computer Analysis Response Team) for review by computer evidence specialists.
Hajjar then asked the question that turned a description of the standard process into testimony about the specific case:
Q: "And is that what happened in this case with Government Exhibit 520?"
A: "Yes."
The jury was told, by an FBI Special Agent under oath, that the camera and memory card had been handled with CART's involvement — the way every FBI agent is trained.
Mills testimony excerpt, Tr. 4306–4307 (PDF)
The actual handling of the camera and its memory card — documented in the FBI's own chain of custody and admitted by the government on appeal — was the opposite of the standard CART process Mills described:
None of that was disclosed to the jury. The government did not concede the existence of the off-CART access until four years after trial, and only in opposition to a Rule 33 motion.
Open the full Secret Alteration by Technician walkthrough in a new tab →
The government's own filing — Doc. 1213, footnote 6 — concedes that "law enforcement agents directed that a photograph technician copy the photographs from the camera card in order to provide the photographs more expeditiously to defense counsel." Production of discovery is a prosecutorial function, not a forensic one. By the government's own description, the off-books access existed to serve the prosecution's discovery obligation.
Doc. 1213, government opposition to Rule 33 motion (PDF)
The metadata of the resulting discovery PDF confirms it. The PDF produced from that off-CART access has its author metadata set to "TCarby" — Teri Carby, the U.S. Attorney's Office paralegal specialist on this case. Created September 21, 2018, two days after the photograph technician's September 19 access. Not an FBI examiner. Not a CART analyst. The prosecution's own paralegal authored the file.
Two pieces of independent proof — the government's own filing and the metadata of the file the access produced — converge on the same conclusion: the prosecution directed the off-CART access and received its output. AUSA Hajjar was lead co-counsel. The questioner had at minimum the means to know what actually happened to that camera — and elicited a false affirmative from her own FBI witness that it had been handled always with CART's assistance.
The "accidental discovery" of the alleged child pornography on the hard drive was supposedly made by Special Agent Michael Weniger. According to former FBI Senior Forensic Examiner Stacy Eldridge (10 years FBI, CART), if the FBI's standard protocol had been followed, no agent would have been able to see any file on that hard drive at all — because every file's timestamp fell outside the warrant's authorized date range.
Eldridge ¶5: there is a standard FBI process called Case Agent Investigative Review (CAIR). CART personnel filter the data — commonly by file type and by date — "to exclude and filter out anything not within the scope authorized by the search warrant."
Eldridge ¶6: "The search warrant only permitted the search of items occurring in or after January 1, 2015, and as such, everything before this date should have been filtered out from the reviewer's view."
Eldridge ¶8: based on her review of the hard drive contents, the file listing, and Booth's forensic report, the date range of all files on the hard drive was 2010 or earlier — entirely outside the warrant's date scope.
"Therefore, there should have been no discovery of the alleged child pornography, as all files would have been filtered out by CAIR, based on the date range."
Stacy R. Eldridge declaration, Doc. 1273-5 (PDF)
On direct examination by AUSA Penza (Tr. 5157):
Q: "And from your work — did you actually discover these files yourself personally?"
A: "Yes, I did."
If CAIR had filtered the data per the warrant's date scope — the protocol Eldridge says was "always followed" in her FBI experience — Weniger could not have been looking at the files at all. They would have been excluded from his reviewer view before any "discovery." His own sworn testimony that he did personally discover them establishes that the protocol was bypassed.
Lead AUSA Moira Kim Penza later admitted on HBO's The Vow that the discovery was a targeted search ("a matter of finding those" photos), not an accident. Even setting that admission aside, Weniger's own trial testimony — that he personally discovered the files — establishes a date-protocol violation on the agent side.
Two independent angles, same conclusion: the "accidental discovery" was not accidental.
Open the Penza HBO-admission drawer in a new tab →
On the verge of trial, a hard drive that had been in FBI custody for eleven months suddenly produced alleged underage nude photos — outside the warrant's timeframe and charges, justified to the court as "plain view because accidental," later admitted on camera by the lead prosecutor to have been targeted, and forensically determined to have been planted.
The hard drive was seized at 8 Hale Drive (Halfmoon, NY). The warrant (Attachment B) was scoped to sex trafficking, forced labor, extortion, and racketeering. Child pornography is not on the list.
8 Hale search warrant, Attachment B (PDF)
On February 21, 2019, the FBI claimed to have accidentally discovered nude photos of a female (no sex act depicted) on the drive, dated to 2005. The 2005 date is the entire basis for charging the images as illegal — it would have made the subject 15. The discovery was logged "pursuant to 8 Hale Warrant" and justified to the court as "plain view." It produced new child-exploitation charges, possession charges, and all five codefendants pleading guilty within a week, on the eve of trial.
Dkt. 618 — "accidental discovery" excerpt (PDF)
"Once we knew about the picture taking, picture keeping, it was a matter of finding those. And when I mean, that is game-changing evidence."
— AUSA Moira Kim Penza, The Vow, S2, Ep. 6, 15:20–15:38 (HBO 2022).
The language of a targeted search — not an accident.
Seven post-conviction forensic experts (four former FBI), with a combined 150+ years of digital forensics experience, concluded under penalty of perjury that the photos had been planted on the drive and that timestamps on both the drive and the Canon memory card had been falsified to simulate the 2005 timeframe.
"The involvement of government personnel in this evidentiary fraud is inescapable — an unprecedented finding in our combined 150+ years of forensic experience."
Joint Forensic Report, Doc. 1253-1 (PDF)
In FBI digital forensics, the original device is supposed to be copied once through a process called "forensic imaging," which creates a complete replica of the data. After that, investigators work from the forensic copy (also called a "forensic image") — not the original device itself. That safeguard exists because repeatedly accessing the original device risks altering or contaminating the data itself.
On June 11, 2019 — in the fifth week of a six-week trial — a secret, prohibited second forensic image of the camera's memory card was created and used by a substitute FBI examiner, Brian Booth. The report from this second image contained 37 additional files that did not appear in the report from the first authorized image, made months earlier — after the card had already been altered once in FBI custody (see Secret Alteration by Technician). Seven post-conviction forensic experts (four former FBI) concluded at least 28 of those 37 files were demonstrably manipulated and at least 20 were planted. The episode implicates SFE Brian Booth and SSA Trenton Schmatz in knowing violations of FBI policy.
Booth substituted in for CART analyst Stephen Flatley on the basis of one claim: that Flatley was unavailable because he had been sent to Ghana. Lead prosecutor Penza told the court Flatley was "in Africa right now"; Booth testified Flatley was "out on assignment in Ghana". Ghana's own immigration records show that wasn't true. Full Ghana drawer →
Booth created a second forensic image of the memory card directly from the original device. Under FBI DEPG 3.3.11.2, a forensic re-examination requires written approval from the Assistant Director of the FBI's Operational Technology Division. That approval was never obtained.
Booth's own CART notes describe his "processing" as "SSA Trenton Schmatz concurred and authorized to process the item" — but a CART supervisor cannot authorize what only an Assistant Director can.
DX 961, Booth CART notes (PDF)
Four former FBI forensic examiners (combined 55 years of FBI experience) reviewed the misconduct and named both Booth and Schmatz as responsible for the unauthorized second image. Their conclusion: "this was a knowing violation of protocol by SFE Booth" and Schmatz's approval "was also a knowing violation of FBI protocol."
Joint Process Report by four former FBI experts, Doc. 1273-8 (PDF)
At trial, AUSA Hajjar framed Booth's work as creating just "another report", with no mention of a second forensic image:
And in a sidebar with the judge, Hajjar represented that Booth "never said I was the one who imaged the devices" — concealing the prohibited second forensic imaging from the court.
On January 27, 2025, AUSA Hajjar acknowledged for the first time that "The Canon Camera was forensically imaged a second time." Her citation? (T:4986–87) — the very transcript excerpt where Hajjar herself had concealed it.
Appeal government opposition, Dkt. Entry 61.1 (PDF)
And to this day, the prosecution still refuses to disclose the actual second forensic image to the defense.
Two forensic copies of the same memory card should contain exactly the same files. They didn't. Booth's report contained 37 additional photo files not in Flatley's first authorized image:
Seven post-conviction forensic experts (four former FBI) concluded at least 28 of those 37 files were intentionally manipulated and at least 20 were planted onto the memory card.
Seven Experts' Joint Forensic Report (PDF) · Flatley index (PDF) · Booth index (PDF)
Item 1B16 — a Western Digital external hard drive (serial WCAS81365334), seized on March 27, 2018 at 8 Hale Drive (Halfmoon, NY). This is the same hard drive on which the alleged child-pornography photos were later "discovered" — the device at the heart of the planting case (see Hook 1).
The FBI's chain-of-custody form is the official, signed record of every person who has handled the evidence: who took it, when, who they returned it to, and when. It is the only document a court has to verify that the device admitted at trial is the same device that was seized — unaltered, untampered, untouched outside the documented transfers. Gaps in the form mean gaps in that verification.
The official chain-of-custody form for Item 1B16 shows SA Michael Lever signing the device out — and then no further entries. No signature recording the device being returned to evidence storage. No subsequent transfers. The form runs blank from Lever's checkout all the way to the bottom of the page.
Hard drive chain of custody, last page — "No Entries Post-February 2019 in the Hard Drive's Chain of Custody."
Full hard-drive chain of custody (PDF)
February 22, 2019 was months before trial began on May 7, 2019. And the chain-of-custody record still shows no entry for its return.
From July 10, 2018 to July 27, 2018, SA Maeghan Rees held the camera's memory card — seventeen days — with no legitimate investigative reason on the record.
Under FBI DEPG 3.3.4.5, only authorized CART personnel may access original digital evidence. CART forensic preservation is a required first step before any access by anyone. Rees was not CART personnel, and the memory card had not yet been forensically preserved.
None of the devices seized from the property had been forensically preserved at the time. The camera and memory card were not transferred to CART (the FBI Digital Forensics Unit) until February 22, 2019 — roughly seven months after Rees's checkout.
Four former FBI forensic examiners — with a combined 55 years of FBI experience — reviewed the misconduct in this case and explicitly named SA Maegan Rees, along with lead investigator SA Michael Lever and an unidentified FBI "photo technician," as the personnel responsible for accesses to the camera and memory card "prior to forensic preservation, in direct violation of FBI protocol." Their conclusion: "These were knowing violations of FBI protocol."
Joint Process Report by four former FBI experts, Doc. 1273-8 (PDF)
Any record of whether she accessed the card may have been overwritten by the later September 19, 2018 alteration in FBI custody. See Secret Alteration by Technician →
FBI Senior Computer Scientist out of Quantico. Recipient of the Presidential Early Career Award for Scientists and Engineers for his contributions to digital forensics, the FBI Director's Award for Outstanding Technical Advancement, and the Intelligence Community Seal Medallion.
He is not a forensic examiner routinely assigned to prosecutions. Over a four-year span, the only other case in which Loveall was brought in for testimonial evidence was Jack Smith's Mar-a-Lago prosecution of President Trump.
Jack Smith expert notice, Doc. 257-6 (PDF)
On July 21, 2023, the DOJ brought Loveall in to respond to the findings of seven post-conviction experts (four former FBI examiners) that the camera's memory card and an external hard drive had been falsified. Loveall produced a report denying the findings.
Under Federal Rule of Evidence 702, expert testimony must be based on sufficient facts or data. Loveall's rebuttals contain technical language but no proof — only hypotheticals presented as findings. His own diagrams are illustrations he created, not proof.
A forensic report without underlying proof is not admissible expert opinion — it is assertion.
The seven experts found that 37 files appeared on a second, undisclosed forensic copy of the memory card — indicating either planting in FBI custody between the first and second copy, or omission from the first copy's report. They concluded at least 28 of those files had been tampered with and at least 20 had been planted.
Loveall's full rebuttal:
Loveall report, Doc. 1213-3, pp. 4–5.
What's missing:
The government's own examiner, Brian Booth, testified that the FBI uses hash verification on every case: "Message Digest 5, called the MD5 verification" — if "anything gets changed on a hard drive… this whole function… would be different and we know something has been changed."
Not on the cover. Not in the body. Not anywhere. 28 U.S.C. § 1746 requires a date to legally bind a declarant to the penalty of perjury. Without a date, the declaration has no legal force — the expert is not bound by his own findings.
Loveall report, Doc. 1213-3 (PDF)
Loveall's only claimed independent testing was on "a Dell Dimension 8300-20090330" — a computer he says he procured to test the opposing expert's claim. No such Dell model exists. The "20090330" suffix is a date code (March 30, 2009) lifted from a folder name in the case evidence — not part of any real Dell hardware identifier. Either the testing never happened, or the report's most basic factual claim about its own methodology cannot be verified.
Did FBI Senior Computer Scientist David Loveall — recipient of the Presidential Early Career Award for Scientists and Engineers, the FBI Director's Award for Outstanding Technical Advancement, and the same expert Jack Smith selected to explain hash values to a jury in the prosecution of President Trump — not know that his report contained no proof, no date, and a claim of testing on a Dell model that does not exist?
The search findings below were independently verified by Kenneth DeNardo (23-year FBI Evidence Response Team photographer) and Mark Bowling (retired FBI Assistant Special Agent in Charge). Their reports are linked at the bottom of this drawer.
Before we get into the search documentation itself, three things to keep in mind:
Eleven months after this search, the government claimed that two of the devices collected here — a camera (with its memory card) and a hard drive — were evidence of alleged CP, after photos were "accidentally discovered" on the hard drive. That alleged discovery became the basis for new charges on the verge of trial.
After the trial, lead AUSA Moira Kim Penza said on HBO that the discovery was actually a targeted search, not accidental:
"Once we knew about the picture taking, picture keeping, it was a matter of finding those."
— AUSA Moira Kim Penza, The Vow, S2, Ep. 6, 15:20–15:38 (HBO 2022).
In the search itself, those exact two devices were claimed in the evidence log as Item 1 and Item 2 — the first items "found" — even though they were physically not the first you would come across. Plenty of other devices on the way to them were skipped over.
Taken together, this raises serious questions about whether these devices were being specifically targeted from the very beginning — despite the government 11 months later claiming the alleged CP evidence on them had been "accidentally discovered."
These are also the exact two devices that seven forensic experts (including four former FBI experts), along with an independent expert retained by Newsweek, later concluded contained falsified evidence, including planted files.
Now let's get into the search itself — which shows even more staging:
The evidence recovery log was supposed to be a real-time record of the search — agents on-site write and initial their own names on the personnel sheet, then document evidence in the order it's actually found.
SA Elliot McGinnis was the evidence logger. The sign-in log shows he arrived roughly 45 minutes into the search; everyone else was already there.
Small townhouse. 10 members of the search team.
Yet on the personnel sheet, Christopher T*** (illegible) — who appears to have been physically present at the property for roughly 3 hours — is missing entirely.
Meanwhile, Kevin McGee is listed even though he was not at this search at all. McGee's entry appears written by McGinnis and is not initialed. And multiple other agents' entries on the sheet also appear written by McGinnis rather than by the agents themselves.
And then you have team leader SA Christine Doyle signing directly next to Kevin McGee's line — the line for an agent who wasn't even at the search.
So either: McGinnis and Doyle somehow overlooked that an agent who wasn't even there had been included on the official search personnel record — or, more logically, this portion of the search documentation had already been pre-filled by McGinnis before he even arrived at the property.
That is a knowing violation of protocol. And it destroys the integrity of the personnel sheet as a contemporaneous real-time record of the search.
And the same pre-filling pattern appears in the evidence log itself.
The item numbers are supposed to reflect the actual order evidence is discovered during the search. But on Page 3 of McGinnis's log: crossed-out entries appear for items already logged on Page 1 (as Items 1 and 9).
Here are those same items as Items 1 and 9 on Page 1 of the log:
But here's the critical point: those crossed-out entries existed before the current Page 1 became Page 1.
How do we know?
If the log were actually being completed sequentially in real time, why would McGinnis:
when that same CD, "Heaven in Exile," had already been logged in by McGinnis as Item 9 on Page 1 — collected by none other than himself?
The only logical explanation is that these crossed-out entries were not created during the live progression of the search. They are remnants of a pre-filled template, crossed out when the actual sequence was substituted in.
And the current Page 1 contains the personnel sheet, marking it as Page 1. The personnel sheet itself appears to have been pre-filled before McGinnis even arrived at the property (as established above).
Meaning: those crossed-out Item 1 and Item 3 entries were also written before McGinnis arrived at the search.
That's an extraordinary result. Before the search team was even on-site, McGinnis was already prescribing (and pre-filling in the search record) what Item 1 and Item 3 would be, what rooms they'd supposedly be found in, and the order they'd supposedly be discovered — as if the log were documenting a real-time search before the search had unfolded.
And then the pre-choreographed sequence was changed.
Originally: the CD "Heaven in Exile" was pre-scripted as Item 1.
Later: the Canon camera becomes Item 1 instead — the sole camera collected, the camera tied to the memory card later alleged to contain the falsified images, and the centerpiece of the government's later "accidental discovery" narrative.
Meanwhile, the CD "Heaven in Exile" gets pushed down to Item 9.
They are not documenting the search. They are staging key parts of the presentation of the search, in advance, and simulating it as if it were real-time.
Here's a forensic reconstruction of how the pages had to have been modified — bringing the re-sequencing to life:
The evidence log was also supposed to preserve accountability — one agent collects, another observes, and each agent documents their own participation.
Instead: for 32 out of 40 entries, McGinnis writes Christopher Mills's name himself — in McGinnis's own handwriting.
Eighty percent of the evidence log.
Mills was physically present and signed the other 8 entries himself. Here's Mills's actual signature alongside McGinnis's own handwriting — the handwriting that appears on the 32 entries claiming to be Mills:
This wasn't unavailability. It was one agent repeatedly filling out another agent's authentication fields, while that agent stood right there.
The result is not a record that reads like multiple agents documenting a live search.
SA Elliot McGinnis's actions during this search constituted multiple knowing violations of FBI evidence-handling and personnel-documentation protocol, including:
The cumulative effect: the official record of this search is not a contemporaneous, authenticated document of what was found and by whom.
These findings were independently verified by retired FBI Evidence Response Team photographer Kenneth DeNardo and retired FBI Assistant Special Agent in Charge Mark Bowling. Their reports are linked below.
