United States v. Keith Raniere et al.EDNY · 18-cr-204
Implicated FBI/DOJ Personnel
The findings on Verifiable Misconduct implicate the following FBI and DOJ personnel in knowing misconduct — documented in the government’s own records. Each Proof → link opens a step-by-step walkthrough of the underlying records and source documents. Several of these personnel have since been deployed onto other major federal prosecutions.
Implicated FBI/DOJ Personnel
The evidence above — and additional evidence linked below — implicates the following FBI and DOJ personnel in knowing misconduct documented in the government's own records. Each "Proof" link contains a step-by-step walkthrough of the underlying records and source documents.
#
Name & role
What they did in this case
1
Michael Lever — FBI Special Agent (case agent)
Circumvented the chain of custody in giving the original, unpreserved memory card to an unidentified FBI "photograph technician" before it was ever forensically preserved. The card's data was altered during that undocumented access. Proof →
Checked the hard drive containing the alleged contraband out of evidence control before trial. Trial chain-of-custody records don't show Lever (or anyone) ever returning it.Proof →
Directed a prohibited second forensic imaging of the memory card during the final days of trial. Proof →
Held the camera and memory card for 17 daysbefore FBI forensic preservation. Four former FBI CART examiners called this a "knowing violation" of FBI policy. This was two months before the undocumented FBI technician access that altered the data. Proof →
3
Unidentified FBI photograph technician
Accessed the original, unpreserved memory card on September 19, 2018 — without signing the chain of custody, without a write-blocker, and without authorization. Overwritten access dates later showed the data had been altered during the access. Proof →
4
Brian Booth — FBI Senior Forensic Examiner
Created a secret, prohibited second forensic image of the memory card during the final days of trial. The resulting report contained 37 additional photo files absent from the first forensic image report — seven post-conviction experts (four former FBI) concluded at least 28 were intentionally manipulated and at least 20 were planted. Proof →
Documented that his exam (which was actually a prohibited re-examination) was "authorized" by supervisor Trenton Schmatz even though Booth knew Schmatz lacked authority under FBI policy to approve it.Proof →
Falsely testified at trial that CART analyst Stephen Flatley was "out on assignment in Ghana" and therefore unavailable to testify — the justification for Booth substituting in. Ghana's own immigration records show that was not true. Proof →
5
Trenton Schmatz — FBI Supervisory Special Agent
Issued authorization for Booth's prohibited second forensic imaging of the memory card during the final days of trial — even though he knew FBI policy required approval from an FBI Assistant Director, not him.Proof →
6
David Loveall II — FBI Senior Computer Scientist (post-conviction expert)Also involved in:Jack Smith's Mar-a-Lago prosecution of President Trump
Produced the DOJ's sole forensic rebuttal to the seven-expert finding of evidence falsification — yet the report was undated, contained no supporting proof, misidentified key evidence (camera vs. memory card), and claimed testing had been performed on a computer model that does not exist. Proof →
7
Christopher Mills — FBI Special Agent
Falsely testified that the camera (which contained the memory card) was always handled with the assistance of CART, even though its unpreserved memory card had already been accessed outside CART by an unidentified FBI "photograph technician" — and altered during that access. Proof →
Implicated in the creation of an agent-built bookshelf vignette during the search — using items of unknown origin that were never collected as evidence. Proof →
8
Tracee Mergen — FBI Special Agent
Implicated in the creation of an agent-built bookshelf vignette during the search — using items of unknown origin that were never collected as evidence. Proof →
9
Brett Hochron — Task Force Officer (NY State Police)
Implicated in the creation of an agent-built bookshelf vignette during the search — using items of unknown origin that were never collected as evidence. Proof →
Pre-filled the search documentation, pre-scripted the sequence of key evidence items before the search began, and signed for Mills on 80% of the evidence log entries — all constituting multiple knowing violations of FBI search protocol. Proof →
11
Christine Doyle — FBI Special Agent (search team leader)
As the search team leader, signed her name on the personnel sheet directly next to an entry for an agent (Kevin McGee) who was not present at the search at all — supporting that key real-time search records had been pre-filled before the search even began. A knowing violation of FBI protocol on contemporaneous documentation. Proof →
12
Michael Weniger — FBI Special Agent
Personally "discovered" the alleged underage photos on the hard drive even though FBI protocol should have filtered the entire drive out before any agent saw a single file. Every file on the drive predated the warrant parameters by at least five years. Proof →
13
Moira Kim Penza — AUSA, lead trial prosecutor (EDNY)Also involved in:Zervos v. Trump — Celebrity Apprentice contestant defamation case
Falsely told the court CART analyst Stephen Flatley was "in Africa" to explain why he was not available to testify. Ghana's immigration records show Flatley was not there. Proof →
Falsely represented to the court that discovery of the alleged CP was "accidental" — a critical legal fact — before later admitting on HBO's The Vow: "Once we knew about the picture taking, picture keeping, it was a matter of finding those." Those "found" photos were later concluded to have been planted by seven forensic experts, including four former FBI experts. Proof →
14
Tanya Hajjar — AUSA, co-counsel (EDNY)
Elicited false testimony from Mills that the camera (which contained the memory card) was handled always with CART's assistance though the prosecution knew that was false: it had directed an unidentified FBI "photograph technician" to access the unpreserved memory card months before it ever reached CART. Proof →
At sidebar during trial, falsely told the court that FBI examiner Brian Booth had not forensically imaged the devices — concealing the secret second forensic image Booth had just created. Five years later, on appeal, Hajjar admitted the opposite: "The Canon Camera was forensically imaged a second time." Proof →
15
Richard Donoghue — U.S. Attorney (EDNY)Also involved in:January 6 Committee witness against President Trump
At the post-verdict press conference, then-U.S. Attorney Donoghue publicly and falsely accused Raniere of "compelled abortions" as though it had been proven at the six-week trial that had just concluded — even though no witness had even alleged it, it was never charged, and it was not an allegation in the case at all.Proof →
Walking through the proof
Secret evidence alteration — September 19, 2018.
1. The card's data was altered on September 19, 2018 — in FBI custody.
The FBI collected the camera (containing the memory card) on March 27, 2018. No date field on the card should reflect activity after that point. But it does: the access dates of dozens of photos were overwritten to September 19, 2018.
This was five months before the device was ever sent to the FBI's Digital Forensics lab (CART). Under FBI DEPG 3.3.4.5, CART must first forensically copy the original device to preserve it; from then on, everyone works from the copy, not the original. No one — least of all someone outside CART — should have been touching this card on September 19.
2. FBI Examiner Brian Booth admitted the alteration at trial.
On the stand, Booth confirmed the metadata was changed on the memory card while in FBI possession.
3. Who had possession on September 19, 2018? Lead case agent SA Michael Lever.
The chain of custody for that day shows SA Michael Lever checked the memory card out of evidence storage on September 19, 2018 — and held it for 7 days.
4. Four-plus years post-trial, the prosecution acknowledged the alteration — but blamed a "photograph technician."
In an opposition motion (Doc. 1213), the prosecution acknowledged the September 19 alteration. Their explanation, in a footnote: an FBI "photograph technician" had been brought in that day — supposedly just to "copy the photographs from the camera card" for discovery production.
Three problems with that:
Not just copying. The resulting PDF included deleted files — meaning forensic recovery software had been used, not simple copying.
Shouldn't have touched it at all. The card had not yet been sent to the FBI Digital Forensics lab (CART). Outside-CART access to unpreserved digital evidence is prohibited (DEPG 3.3.4.5, above).
The technician didn't sign the chain of custody (see next point).
5. SA Lever singled out this item — and the chain-of-custody signing was deliberately skipped.
August 8, 2018: Lever delivered all the other seized devices from the property to CART for forensic preservation — keeping only the camera and memory card back.CART notes (DX 961) →
September 19, 2018: Lever checked the camera and memory card out of evidence and gave them to the FBI photograph technician. All FBI personnel are trained that signing the chain of custody is required when transferring evidence. Yet:
Lever DIDN'T SIGN THE CHAIN OF CUSTODY when handing the card to the FBI technician;
The FBI technician DIDN'T SIGN THE CHAIN OF CUSTODY when receiving it;
The FBI technician accessed the memory card and left behind proof it had been ALTERED;
The FBI technician DIDN'T SIGN THE CHAIN OF CUSTODY when returning the memory card to Lever;
Lever DIDN'T SIGN THE CHAIN OF CUSTODY when receiving it back from the FBI technician.
Seven post-conviction forensic experts (four former FBI) later concluded dozens of files on the memory card were planted with manipulated timestamps. Joint Forensic Report, Doc. 1253-1, ¶15 (PDF) →
6. The government's appeal defense: "no evidentiary value."
Five years later, on appeal, the government defended bringing in the off-books technician. Their argument: they had "no reason to believe that the metadata associated with the photographs … had any evidentiary value."
How did they know what was on the memory card before bringing in the FBI technician? Someone must have already accessed the unpreserved card — itself another knowing violation of FBI protocol.
The case at the time was all about nude photos of adult women. This was the sole camera seized from the property the prosecution called the defendant's "lair" — and the memory card contained only photos of adult women. The government's defense is that the metadata (used to establish authenticity) of those nude photos had "no evidentiary value"?
7. Seven experts later found dozens of files on the memory card were planted, with timestamps manipulated.
In their joint forensic report (Doc. 1253-1, ¶15), seven post-conviction forensic experts — including four former FBI examiners — identified four specific findings on this memory card:
3. Ghana's records show that wasn't true — Flatley's last visit to Ghana ended September 28, 2018.
A notarized letter from the Comptroller-General of Ghana's Immigration Service shows Flatley's complete travel history. His last recorded departure from Ghana: September 28, 2018 — more than eight months before the prosecution and Booth told the court he was there. No entries during the trial (May 7–June 19, 2019). And no entries since.
Did the FBI and prosecution lie to keep Flatley off the stand?
Walking through the proof
FBI agents used items of unknown origin to create scenes during the search — and presented them to the jury as authentic.
Search-scene photographs are supposed to document evidence exactly as it was found. That's why investigators first photograph items "in place" — before touching or moving them. Otherwise, there is no way to prove where an object actually came from.
Without that safeguard, investigators could rearrange scenes or introduce new objects after the fact and present the result as authentic.
Click any photograph to enlarge.
1) Documented two cameras, only collected one.
On March 27, 2018, FBI agents searched a townhouse at 8 Hale Drive, Halfmoon, NY. The search sought nude photos of adult women allegedly used as blackmail material.
Cameras were important.
They documented two cameras at the scene. They only took one.
The first camera — Item 1 — was photographed in place. Then moved for a clearer ID photo. Collected as evidence.
Photographed in place.Then moved for a clearer ID photo.
The second camera — Item 5:
What the jury saw: this camera with its cord draped over it on a cluttered countertop, as if just found there:
But it wasn't actually there:
Earlier — no camera on the countertop.Later — camera appears.
No "in place" photograph. No record of where it came from.
And in the evidence log, written as "NOT TAKEN."
The jury saw the evidence photos. Looked like they found cameras, as expected.
Kenneth DeNardo — 23-year FBI Evidence Response Team photographer with hundreds of FBI searches in his career — reviewed the Item 5 scene:
"Leaving this camera behind defies logic. It is akin to searching for guns in a homicide case, finding 2 guns, and intentionally leaving the second gun behind."
And the camera they did collect — the one handled by protocol? That's the one whose memory card was later altered in FBI custody. Its files have since been proven falsified — by seven experts (four former FBI) and an independent expert retained by Newsweek.
2) Photographed books on sex trafficking. Never collected them. No photograph showing where they came from.
The warrant sought "sex trafficking" paraphernalia.
Agents collected a book on The History of Torture as Item 3.
Later they placed two books about the central alleged crime — sex trafficking — on the desk.
No item label. No photograph recording where they were found.
The books weren't on that desk:
The photo log says they came from the bookshelf — and the prior photo was of a bookshelf. But in that bookshelf shot, you can't see these books:
The jury saw the search photos. A defendant accused of sex trafficking — with two books on sex trafficking sitting at the townhouse.
If those books were authentically at the property, that would be damning evidence. So why wouldn't agents photograph them in place? Why wouldn't they take them as evidence?
Kenneth DeNardo — 23-year FBI Evidence Response Team photographer with hundreds of FBI searches in his career — reviewed the search photographs and concluded:
"Based on my experience conducting hundreds of searches, I conclude that the only plausible explanation is that these 2 books on sex trafficking were planted to create an incriminating and prejudicial narrative."
3) FBI agents created bookshelf vignettes using items of unknown origin that they did not collect.
There are three search photos of devices on the bookshelf above the desk in the upstairs office. Two of them are demonstrably an agent-created vignette:
Item 2Item 36
Agent-created vignette
Item 37
Agent-created vignette
All three photos show the same exact spot on the same bookshelf.
You can confirm this by comparing the wall brackets, the monitor edge, the shelf line, and the wires:
In the Item 2 shot — just three devices on the shelf. In the Item 37 shot — the same shelf, but now: a Rubik's Cube (unopened), a Stem Cell DVD, two CDs, and two books on sex trafficking.
5 objects used to create the vignette. None photographed in place. None collected as evidence.
And the two books? The exact same two books that "appeared" earlier on the desk.
Earlier in the search, the bookshelf held Item 2 in this spot. Then it changed — first to Item 36, then to Item 37.
Item 2→Item 36→Item 37
Here's the same sequence brought to life — with the intermediate steps in between, so you can see the multistep construction of the vignette:
Between the photosStep 1 of 10
Here's what had to have happened, step by step, between these shots — based on the FBI's own evidence log actions:
Agent Mills photographs Item 2. Agent Mergen documents it in the photo log. TFO Brett Hochron removes the device from the shelf and collects it as Item 2.
Some time later, an agent removes the remaining devices from the shelf.
An agent adds the Stem Cell DVD.
An agent adds the two sex-trafficking books, placing them on top of the DVD.
An agent adds the Rubik's Cube, placing it in the center of the area.
An agent adds the two CDs to the left.
An agent adds back the Sony DVD Drive that was photographed in the Item 2 shot, labels it as Item 36. Mills photographs it. Mergen documents it. Hochron removes and collects it.
An agent adds back the device that previously bore the Item 2 label (a LaCie silvergray hard drive), labels it as Item 37. Mills photographs it. Mergen documents it. Hochron removes and collects it.
By steps 7 and 8, Mills, Mergen, and Hochron all knew they were using a manufactured vignette as if documenting an authentic scene. All three are implicated in scene creation that became search-scene photographs shown to the jury at trial as authentic.
And once you've established this with one of the scenes — how can you be sure any of the scenes the jury saw were authentic? That anything was truly found where the agents said it was?
4. The same expert on the camera.
DeNardo also reviewed the Item 5 camera scene. His verdict:
"Leaving this camera behind defies logic. It is akin to searching for guns in a homicide case, finding 2 guns, and intentionally leaving the second gun behind."
"Based on my professional experience, the only plausible explanation for these actions is that this camera was planted to create a staged and false narrative."
This was a sex-trafficking prosecution. The "sex trafficking" physical evidence at the search site was staged. Weeks before Raniere was charged.
This shows how the prosecution fed falsehoods to the media that became cemented as if proven in court — permanently poisoning the public record of a federal case.
Witness list — no allegation made by any witness at trial
NPR, TIME, CBS, Guardian articles linked above
Donoghue January 6 Committee testimony (CNBC report)
Walking through the proof
SA Mills told the jury the camera was handled the right way. The prosecution knew it wasn't.
1. The setup — Hajjar walks Mills through the standard FBI process for digital evidence.
On direct examination, AUSA Tanya Hajjar showed SA Christopher Mills the camera (Government Exhibit 520) and the memory card (Government Exhibit 524) and asked: "What happens when you recover a piece of digital evidence like Government Exhibit 520 and 524?"
Mills described the standard FBI process — submit the device to CART (the Computer Analysis Response Team) for review by computer evidence specialists.
2. The false answer — Mills affirmed that's what happened in this case.
Hajjar then asked the question that turned a description of the standard process into testimony about the specific case:
Q: "And is that what happened in this case with Government Exhibit 520?" A: "Yes."
The jury was told, by an FBI Special Agent under oath, that the camera and memory card had been handled with CART's involvement — the way every FBI agent is trained.
The actual handling of the camera and its memory card — documented in the FBI's own chain of custody and admitted by the government on appeal — was the opposite of the standard CART process Mills described:
SA Michael Lever diverted the camera and memory card from the forensics lab and gave them to an unidentified FBI "photograph technician" on September 19, 2018 — without anyone signing the chain of custody.
The technician accessed the original memory card without a write-blocker, leaving behind proof the data had been altered.
The memory card was not transferred to CART (Flatley) for forensic preservation until February 22, 2019 — nearly eleven months after the camera was seized.
None of that was disclosed to the jury. The government did not concede the existence of the off-CART access until four years after trial, and only in opposition to a Rule 33 motion.
4. Why this was elicited testimony, not just a witness mistake — the prosecution itself directed the off-CART access.
The government's own filing — Doc. 1213, footnote 6 — concedes that "law enforcement agents directed that a photograph technician copy the photographs from the camera card in order to provide the photographs more expeditiously to defense counsel." Production of discovery is a prosecutorial function, not a forensic one. By the government's own description, the off-books access existed to serve the prosecution's discovery obligation.
The metadata of the resulting discovery PDF confirms it. The PDF produced from that off-CART access has its author metadata set to "TCarby" — Teri Carby, the U.S. Attorney's Office paralegal specialist on this case. Created September 21, 2018, two days after the photograph technician's September 19 access. Not an FBI examiner. Not a CART analyst. The prosecution's own paralegal authored the file.
Two pieces of independent proof — the government's own filing and the metadata of the file the access produced — converge on the same conclusion: the prosecution directed the off-CART access and received its output. AUSA Hajjar was lead co-counsel. The questioner had at minimum the means to know what actually happened to that camera — and elicited a false affirmative from her own FBI witness that it had been handled always with CART's assistance.
Weniger said he discovered the photos. The FBI's own protocol says he shouldn't have seen them.
The "accidental discovery" of the alleged child pornography on the hard drive was supposedly made by Special Agent Michael Weniger. According to former FBI Senior Forensic Examiner Stacy Eldridge (10 years FBI, CART), if the FBI's standard protocol had been followed, no agent would have been able to see any file on that hard drive at all — because every file's timestamp fell outside the warrant's authorized date range.
1. The FBI's protocol filters digital evidence by warrant scope before the case agent ever sees it.
Eldridge ¶5: there is a standard FBI process called Case Agent Investigative Review (CAIR). CART personnel filter the data — commonly by file type and by date — "to exclude and filter out anything not within the scope authorized by the search warrant."
2. The warrant only authorized the search of items dated January 1, 2015 onwards.
Eldridge ¶6: "The search warrant only permitted the search of items occurring in or after January 1, 2015, and as such, everything before this date should have been filtered out from the reviewer's view."
3. Every file on the hard drive was dated 2010 or earlier.
Eldridge ¶8: based on her review of the hard drive contents, the file listing, and Booth's forensic report, the date range of all files on the hard drive was 2010 or earlier — entirely outside the warrant's date scope.
4. Eldridge's conclusion.
"Therefore, there should have been no discovery of the alleged child pornography, as all files would have been filtered out by CAIR, based on the date range."
5. Yet Weniger told the jury he personally discovered the files.
On direct examination by AUSA Penza (Tr. 5157):
Q: "And from your work — did you actually discover these files yourself personally?" A: "Yes, I did."
6. The "Yes, I did" admission is itself a protocol violation.
If CAIR had filtered the data per the warrant's date scope — the protocol Eldridge says was "always followed" in her FBI experience — Weniger could not have been looking at the files at all. They would have been excluded from his reviewer view before any "discovery." His own sworn testimony that he did personally discover them establishes that the protocol was bypassed.
7. This is independent of the lead prosecutor's HBO admission.
Lead AUSA Moira Kim Penza later admitted on HBO's The Vow that the discovery was a targeted search ("a matter of finding those" photos), not an accident. Even setting that admission aside, Weniger's own trial testimony — that he personally discovered the files — establishes a date-protocol violation on the agent side.
Two independent angles, same conclusion: the "accidental discovery" was not accidental.
The "accidental discovery" wasn't accidental — the lead prosecutor admitted it on camera.
On the verge of trial, a hard drive that had been in FBI custody for eleven months suddenly produced alleged underage nude photos — outside the warrant's timeframe and charges, justified to the court as "plain view because accidental," later admitted on camera by the lead prosecutor to have been targeted, and forensically determined to have been planted.
1. The 8 Hale warrant did not authorize a search for child pornography.
The hard drive was seized at 8 Hale Drive (Halfmoon, NY). The warrant (Attachment B) was scoped to sex trafficking, forced labor, extortion, and racketeering.Child pornography is not on the list.
2. Eleven months later — on the verge of trial — the FBI claimed an "accidental discovery."
On February 21, 2019, the FBI claimed to have accidentally discovered nude photos of a female (no sex act depicted) on the drive, dated to 2005. The 2005 date is the entire basis for charging the images as illegal — it would have made the subject 15. The discovery was logged "pursuant to 8 Hale Warrant" and justified to the court as "plain view." It produced new child-exploitation charges, possession charges, and all five codefendants pleading guilty within a week, on the eve of trial.
3. Years later, on HBO, AUSA Moira Kim Penza admitted it was a targeted search.
"Once we knew about the picture taking, picture keeping, it was a matter of finding those. And when I mean, that is game-changing evidence."
— AUSA Moira Kim Penza, The Vow, S2, Ep. 6, 15:20–15:38 (HBO 2022).
The language of a targeted search — not an accident.
4. The "accidentally discovered" photos were forensically determined to have been planted.
Seven post-conviction forensic experts (four former FBI), with a combined 150+ years of digital forensics experience, concluded under penalty of perjury that the photos had been planted on the drive and that timestamps on both the drive and the Canon memory card had been falsified to simulate the 2005 timeframe.
"The involvement of government personnel in this evidentiary fraud is inescapable — an unprecedented finding in our combined 150+ years of forensic experience."
The secret second forensic image — and the 37 additional files that appeared on its report.
In FBI digital forensics, the original device is supposed to be copied once through a process called "forensic imaging," which creates a complete replica of the data. After that, investigators work from the forensic copy (also called a "forensic image") — not the original device itself. That safeguard exists because repeatedly accessing the original device risks altering or contaminating the data itself.
On June 11, 2019 — in the fifth week of a six-week trial — a secret, prohibited second forensic image of the camera's memory card was created and used by a substitute FBI examiner, Brian Booth. The report from this second image contained 37 additional files that did not appear in the report from the first authorized image, made months earlier — after the card had already been altered once in FBI custody (see Secret Alteration by Technician). Seven post-conviction forensic experts (four former FBI) concluded at least 28 of those 37 files were demonstrably manipulated and at least 20 were planted. The episode implicates SFE Brian Booth and SSA Trenton Schmatz in knowing violations of FBI policy.
1. The cover story: Flatley was supposedly in Ghana.
Booth substituted in for CART analyst Stephen Flatley on the basis of one claim: that Flatley was unavailable because he had been sent to Ghana. Lead prosecutor Penza told the court Flatley was "in Africa right now"; Booth testified Flatley was "out on assignment in Ghana". Ghana's own immigration records show that wasn't true.Full Ghana drawer →
2. What Booth actually did — a prohibited second forensic image.
Booth created a second forensic image of the memory card directly from the original device. Under FBI DEPG 3.3.11.2, a forensic re-examination requires written approval from the Assistant Director of the FBI's Operational Technology Division. That approval was never obtained.
Booth's own CART notes describe his "processing" as "SSA Trenton Schmatz concurred and authorized to process the item" — but a CART supervisor cannot authorize what only an Assistant Director can.
Four former FBI forensic examiners (combined 55 years of FBI experience) reviewed the misconduct and named both Booth and Schmatz as responsible for the unauthorized second image. Their conclusion: "this was a knowing violation of protocol by SFE Booth" and Schmatz's approval "was also a knowing violation of FBI protocol."
3. What the prosecution told the court at the time — concealment.
At trial, AUSA Hajjar framed Booth's work as creating just "another report", with no mention of a second forensic image:
And in a sidebar with the judge, Hajjar represented that Booth "never said I was the one who imaged the devices" — concealing the prohibited second forensic imaging from the court.
4. What the prosecution finally admitted on appeal — 5.5 years later.
On January 27, 2025, AUSA Hajjar acknowledged for the first time that "The Canon Camera was forensically imaged a second time." Her citation? (T:4986–87) — the very transcript excerpt where Hajjar herself had concealed it.
And to this day, the prosecution still refuses to disclose the actual second forensic image to the defense.
5. The report from the secret image (admitted at trial) shows 37 additional photo files.
Two forensic copies of the same memory card should contain exactly the same files. They didn't. Booth's report contained 37 additional photo files not in Flatley's first authorized image:
Flatley's report (first copy).Booth's report (second copy) — red boxes show files not in Flatley's.
Seven post-conviction forensic experts (four former FBI) concluded at least 28 of those 37 files were intentionally manipulated and at least 20 were planted onto the memory card.
SA Michael Lever checked out the hard drive — and the chain of custody never shows it being returned.
1. The hard drive in question.
Item 1B16 — a Western Digital external hard drive (serial WCAS81365334), seized on March 27, 2018 at 8 Hale Drive (Halfmoon, NY). This is the same hard drive on which the alleged child-pornography photos were later "discovered" — the device at the heart of the planting case (see Hook 1).
2. What a chain of custody is supposed to do.
The FBI's chain-of-custody form is the official, signed record of every person who has handled the evidence: who took it, when, who they returned it to, and when. It is the only document a court has to verify that the device admitted at trial is the same device that was seized — unaltered, untampered, untouched outside the documented transfers. Gaps in the form mean gaps in that verification.
3. Lever's checkout was the last entry.
The official chain-of-custody form for Item 1B16 shows SA Michael Lever signing the device out — and then no further entries. No signature recording the device being returned to evidence storage. No subsequent transfers. The form runs blank from Lever's checkout all the way to the bottom of the page.
Hard drive chain of custody, last page — "No Entries Post-February 2019 in the Hard Drive's Chain of Custody."
Last page of the chain-of-custody form — "No Entries Post-February 2019 in the Hard Drive's Chain of Custody"
Walking through the proof
SA Maeghan Rees held the memory card for 17 days — before it had ever been forensically preserved.
1. The chain of custody documents Rees's checkout.
From July 10, 2018 to July 27, 2018, SA Maeghan Rees held the camera's memory card — seventeen days — with no legitimate investigative reason on the record.
2. FBI policy explicitly prohibits this.
Under FBI DEPG 3.3.4.5, only authorized CART personnel may access original digital evidence. CART forensic preservation is a required first step before any access by anyone. Rees was not CART personnel, and the memory card had not yet been forensically preserved.
3. The memory card had not yet reached the FBI digital forensics lab.
None of the devices seized from the property had been forensically preserved at the time. The camera and memory card were not transferred to CART (the FBI Digital Forensics Unit) until February 22, 2019 — roughly seven months after Rees's checkout.
4. The "knowing violation" finding.
Four former FBI forensic examiners — with a combined 55 years of FBI experience — reviewed the misconduct in this case and explicitly named SA Maegan Rees, along with lead investigator SA Michael Lever and an unidentified FBI "photo technician," as the personnel responsible for accesses to the camera and memory card "prior to forensic preservation, in direct violation of FBI protocol." Their conclusion: "These were knowing violations of FBI protocol."
5. No records of what Rees did with the card during those 17 days have ever been provided.
Any record of whether she accessed the card may have been overwritten by the later September 19, 2018 alteration in FBI custody. See Secret Alteration by Technician →
Sources
Chain of custody record — SA Maeghan Rees, 07/10/2018–07/27/2018
FBI Senior Computer Scientist David Loveall II's rebuttal report — defective at the basic level.
1. Who Loveall is.
FBI Senior Computer Scientist out of Quantico. Recipient of the Presidential Early Career Award for Scientists and Engineers for his contributions to digital forensics, the FBI Director's Award for Outstanding Technical Advancement, and the Intelligence Community Seal Medallion.
He is not a forensic examiner routinely assigned to prosecutions. Over a four-year span, the only other case in which Loveall was brought in for testimonial evidence was Jack Smith's Mar-a-Lago prosecution of President Trump.
Under Federal Rule of Evidence 702, expert testimony must be based on sufficient facts or data. Loveall's rebuttals contain technical language but no proof — only hypotheticals presented as findings. His own diagrams are illustrations he created, not proof.
A forensic report without underlying proof is not admissible expert opinion — it is assertion.
4. Loveall's rebuttal to the "37 additional files" finding — defects on display.
The seven experts found that 37 files appeared on a second, undisclosed forensic copy of the memory card — indicating either planting in FBI custody between the first and second copy, or omission from the first copy's report. They concluded at least 28 of those files had been tampered with and at least 20 had been planted.
Loveall's full rebuttal:
Loveall report, Doc. 1213-3, pp. 4–5.
What's missing:
He says the "additional files" came from "different settings" in the reporting software — but doesn't specify which settings, or provide any proof.
He says he determined the disk images are "identical" — but how? What test? Where's the proof? The standard check here is simple: a hash value (digital fingerprint) — the exact test Jack Smith called him to testify about in the Mar-a-Lago case. He provided no hash values here.
He identifies the evidence as "1B15 and 1B15a" — but those are the wrong items. 1B15 is the camera. 1B15a is the camera's memory card. Saying a copy of the camera is "identical" to a copy of the memory card is as nonsensical as saying a copy of a DVD player is identical to the DVD inside it.
5. The FBI's own examiner testified at trial about the hash standard.
The government's own examiner, Brian Booth, testified that the FBI uses hash verification on every case: "Message Digest 5, called the MD5 verification" — if "anything gets changed on a hard drive… this whole function… would be different and we know something has been changed."
6. The report contains no date.
Not on the cover. Not in the body. Not anywhere. 28 U.S.C. § 1746 requires a date to legally bind a declarant to the penalty of perjury. Without a date, the declaration has no legal force — the expert is not bound by his own findings.
7. The only testing the report claims was on a computer model that does not exist.
Loveall's only claimed independent testing was on "a Dell Dimension 8300-20090330" — a computer he says he procured to test the opposing expert's claim. No such Dell model exists. The "20090330" suffix is a date code (March 30, 2009) lifted from a folder name in the case evidence — not part of any real Dell hardware identifier. Either the testing never happened, or the report's most basic factual claim about its own methodology cannot be verified.
Did FBI Senior Computer Scientist David Loveall — recipient of the Presidential Early Career Award for Scientists and Engineers, the FBI Director's Award for Outstanding Technical Advancement, and the same expert Jack Smith selected to explain hash values to a jury in the prosecution of President Trump — not know that his report contained no proof, no date, and a claim of testing on a Dell model that does not exist?
Booth trial testimony — FBI MD5 hash verification standard
Walking through the proof
SA Elliot McGinnis pre-filled the search documentation and simulated portions of it as if it were real-time.
The search findings below were independently verified by Kenneth DeNardo (23-year FBI Evidence Response Team photographer) and Mark Bowling (retired FBI Assistant Special Agent in Charge). Their reports are linked at the bottom of this drawer.
Before we get into the search documentation itself, three things to keep in mind:
1
Eleven months after this search, the government claimed that two of the devices collected here — a camera (with its memory card) and a hard drive — were evidence of alleged CP, after photos were "accidentally discovered" on the hard drive. That alleged discovery became the basis for new charges on the verge of trial.
2
After the trial, lead AUSA Moira Kim Penza said on HBO that the discovery was actually a targeted search, not accidental:
"Once we knew about the picture taking, picture keeping, it was a matter of finding those."
— AUSA Moira Kim Penza, The Vow, S2, Ep. 6, 15:20–15:38 (HBO 2022).
3
In the search itself, those exact two devices were claimed in the evidence log as Item 1 and Item 2 — the first items "found" — even though they were physically not the first you would come across. Plenty of other devices on the way to them were skipped over.
Taken together, this raises serious questions about whether these devices were being specifically targeted from the very beginning — despite the government 11 months later claiming the alleged CP evidence on them had been "accidentally discovered."
These are also the exact two devices that seven forensic experts (including four former FBI experts), along with an independent expert retained by Newsweek, later concluded contained falsified evidence, including planted files.
Now let's get into the search itself — which shows even more staging:
1) Real-time search documentation — pre-filled and simulated.
The evidence recovery log was supposed to be a real-time record of the search — agents on-site write and initial their own names on the personnel sheet, then document evidence in the order it's actually found.
SA Elliot McGinnis was the evidence logger. The sign-in log shows he arrived roughly 45 minutes into the search; everyone else was already there.
Small townhouse. 10 members of the search team.
Yet on the personnel sheet, Christopher T*** (illegible) — who appears to have been physically present at the property for roughly 3 hours — is missing entirely.
Meanwhile, Kevin McGee is listed even though he was not at this search at all. McGee's entry appears written by McGinnis and is not initialed. And multiple other agents' entries on the sheet also appear written by McGinnis rather than by the agents themselves.
And then you have team leader SA Christine Doyle signing directly next to Kevin McGee's line — the line for an agent who wasn't even at the search.
So either: McGinnis and Doyle somehow overlooked that an agent who wasn't even there had been included on the official search personnel record — or, more logically, this portion of the search documentation had already been pre-filled by McGinnis before he even arrived at the property.
That is a knowing violation of protocol. And it destroys the integrity of the personnel sheet as a contemporaneous real-time record of the search.
And the same pre-filling pattern appears in the evidence log itself.
The item numbers are supposed to reflect the actual order evidence is discovered during the search. But on Page 3 of McGinnis's log: crossed-out entries appear for items already logged on Page 1 (as Items 1 and 9).
Here are those same items as Items 1 and 9 on Page 1 of the log:
But here's the critical point: those crossed-out entries existed before the current Page 1 became Page 1.
How do we know?
The logic of how the on-page sequencing itself indicates these were pre-filled before the entries were made on the page
If the log were actually being completed sequentially in real time, why would McGinnis:
go from Item 19 (where Page 2 left off),
suddenly back to Item 1,
then to Item 20,
then back again to Item 3,
then continue to Item 21 —
when that same CD, "Heaven in Exile," had already been logged in by McGinnis as Item 9 on Page 1 — collected by none other than himself?
The only logical explanation is that these crossed-out entries were not created during the live progression of the search. They are remnants of a pre-filled template, crossed out when the actual sequence was substituted in.
And the current Page 1 contains the personnel sheet, marking it as Page 1. The personnel sheet itself appears to have been pre-filled before McGinnis even arrived at the property (as established above).
Meaning: those crossed-out Item 1 and Item 3 entries were also written before McGinnis arrived at the search.
That's an extraordinary result. Before the search team was even on-site, McGinnis was already prescribing (and pre-filling in the search record) what Item 1 and Item 3 would be, what rooms they'd supposedly be found in, and the order they'd supposedly be discovered — as if the log were documenting a real-time search before the search had unfolded.
And then the pre-choreographed sequence was changed.
Originally: the CD "Heaven in Exile" was pre-scripted as Item 1.
Later: the Canon camera becomes Item 1 instead — the sole camera collected, the camera tied to the memory card later alleged to contain the falsified images, and the centerpiece of the government's later "accidental discovery" narrative.
Meanwhile, the CD "Heaven in Exile" gets pushed down to Item 9.
They are not documenting the search. They are staging key parts of the presentation of the search, in advance, and simulating it as if it were real-time.
Here's a forensic reconstruction of how the pages had to have been modified — bringing the re-sequencing to life:
Forensic reconstructionStep 1 of 3
2) McGinnis repeatedly writes in Mills's name instead of Mills, for 80% of evidence item entries — even though Mills was present at the search.
The evidence log was also supposed to preserve accountability — one agent collects, another observes, and each agent documents their own participation.
Instead: for 32 out of 40 entries, McGinnis writes Christopher Mills's name himself — in McGinnis's own handwriting.
Eighty percent of the evidence log.
Mills was physically present and signed the other 8 entries himself. Here's Mills's actual signature alongside McGinnis's own handwriting — the handwriting that appears on the 32 entries claiming to be Mills:
Mills's actual signature — on the 8 entries Mills wrote himself.McGinnis's handwriting — matches the 32 entries claiming to be Mills.
This wasn't unavailability. It was one agent repeatedly filling out another agent's authentication fields, while that agent stood right there.
The result is not a record that reads like multiple agents documenting a live search.
In summary: knowing violations of FBI search-documentation protocol.
SA Elliot McGinnis's actions during this search constituted multiple knowing violations of FBI evidence-handling and personnel-documentation protocol, including:
Pre-filling the personnel sheet before arriving at the search — including listing an agent (Kevin McGee) who was not present, and writing other agents' entries in his own hand without their initials.
Pre-scripting evidence log entries — including item descriptions, exact locations, room labels, and discovery sequence — before the search team was on-site.
Repeatedly writing SA Christopher Mills's name on the evidence log — in McGinnis's own handwriting — for 32 of 40 entries, while Mills was physically present and writing his own name on the other 8.
The cumulative effect: the official record of this search is not a contemporaneous, authenticated document of what was found and by whom.
These findings were independently verified by retired FBI Evidence Response Team photographer Kenneth DeNardo and retired FBI Assistant Special Agent in Charge Mark Bowling. Their reports are linked below.
