The story of NXIVM, DOS, and the downfall of their founder and leader, Keith Raniere, is the subject of the true-crime documentary series The Vow on HBO Max.
On October 27, 2020, Raniere was found guilty of racketeering, sex trafficking, forced labor conspiracy, and wire fraud conspiracy and he was sentenced to 120 years in prison. He was also fined $1.75 million.
Raniere has always denied all of the charges against him.
Since his incarceration, Raniere has had a host of supporters campaigning for his release and, in recent months, has attracted the attention of a new legal team and experts who have raised concerns about key evidence presented at his 2019 trial.
Now Raniere's legal team, fronted by attorney Joseph Tully, are accusing the FBI of tampering with the photographic evidence to fit the "government's narrative" which was then used to "secure convictions for the racketeering acts of possessing child pornography and sexual exploitation of a minor" according to the "Motion to Hold Appeal" documents, seen by Newsweek, that were filed on October 6, 2022, by Tully.
The allegations of tampering and falsification of evidence have been supported by experts including former FBI Special Agent and computer forensic examiner and instructor Dr. J. Richard Kiper, and former FBI Senior Forensic Examiner Stacy Eldridge. They were joined by Harvard Law School professors Ron Sullivan and Alan Dershowitz, and former U.S. Attorney for the Eastern District of Arkansas Bud Cummins, as well as California-based Tully.
The panel of six believe there is new evidence of substantive due process violations at Raniere's original trial.
Speaking to Newsweek, Cummins, who is one of the attorneys advising on the case, said: "We have a number of digital forensics experts, somebody who has experience within the FBI and are very familiar with their procedures, who are willing to go on the record and testify that they believe tampering occurred."
The Manipulation of Photo and Folder Dates
Raniere was found guilty of racketeering and one of these counts related to possession of child pornography found on a hard drive seized from Raniere's townhouse on March 27, 2018, in Halfmoon, New York, and two counts of Sexual Exploitation of a Child for allegedly taking the images.
The charges relate to Camila (not her real name), who was 15 years old when she reportedly began a sexual relationship with Raniere. She did not testify at trial but, in a victim impact statement read in court, Camila confirmed she had been a victim of sexual abuse at the hands of Raniere.
Prosecutors successfully argued at trial that Raniere had sexually groomed three daughters from one family, "Marianna", the eldest, "Daniela" the middle child, and "Camila", the youngest. They used an array of WhatsApp messages exchanged between Camila and Raniere, where Raniere referred to her as his "slave" and asked her to recruit more "sex slaves", alongside testimony from her sister Daniela. They also presented 22 nude photos of Camila, allegedly taken in 2005 by Raniere when she was 15.
Raniere's defense team are arguing first and foremost that the images of Camila were not obviously child pornography and were only considered pornographic based on the photos' dates being in 2005, when Camila would have been underage.
Six experts, including Kiper, argue the photo dates on the hard drive have been manipulated and folder names were forged to look like they were auto-created in 2005.
Kiper told Newsweek: "The external hard drive allegedly holds the backup copies from photographs that originated on the camera card. You can take photos with the camera then they are saved to the camera card and then they were transferred to another computer, an intermediary computer that was never found, never produced, never seen. But then from that mysterious computer, the backups of all of these photographs were made onto an external hard drive and it was on that hard drive that the alleged child pornography was found. No child pornography was actually found on that camera card. I just want to be very clear about that point. There was nothing naturally that tied the alleged child pornography to that camera card, except for something we call excess data or metadata that is very easily modified."
To show Camila was under the age of 18 in the photographs, the government used metadata, primarily the exchangeable image file format (EXIF) creation dates of the 22 images. Senior FBI forensic examiner Brian Booth testified under oath that EXIF data cannot be easily modified, which the six experts argue to be false. They also allege Booth had committed perjury by making that statement according to the motion submitted by Raniere's attorney Tully in October 2022.
The EXIF date of a photograph will not change without manual alteration of the data, Kiper explained to Newsweek.
He added: "The government completely relies on timestamps in order to mean that those photographs on the external hard drive deemed them as child pornography because, according to that timestamp, the subject of those photographs would have been 15 years old. That is their entire child pornography charge based on those timestamps and timestamps are extremely easy to change."
Senior FBI forensic examiner Booth also testified at trial that it was not unusual for agents to receive evidence unsealed with no record of the unsealing taking place.
In court documents, Raniere's team argues this also amounts to perjury as FBI policy clearly states there is a chain of custody in place to establish evidence has not been altered in any form.
Kiper said: "The government, their intention was to create a strong relationship between the camera card and the backup hard drive that allegedly contained those [child pornography] backups but the first FBI forensic report that was created only had four files that were common to both the camera card and external hard drive. That was in the first FBI report and that FBI forensic examiner was not allowed to testify."
He continued: "In the last week of trial, he got an assignment overseas and this camera card was transferred to another forensic examiner, in an unsealed package by the way, and that second examiner found 37 additional files and additional photographs on the camera card and 31 of those were in common to external hard drive.
"So in other words, there was a second examination done of that camera card which in itself violates FBI policy, what we call the Digital Evidence Policy Guide, and so a second forensic examination resulted in conveniently more photographs that had in common with the external hard drives."
Kiper, who also trained the FBI's Computer Analysis Response Team, explained the seriousness of dealing with unsealed evidence.
He told Newsweek: "Whenever we transfer evidence in the FBI, we have not only the chain of custody that the person signs, accepting custody of evidence at a date and time, but also they sign if the evidence looks to be sealed and it must be sealed with evidence tape with the person's initials and the date across the seal.
"When that seal is broken, and it is opened, then it's used, photographed and gets examined. Then when it is transferred to another person it needs to be resealed and reinitialized and all of that. But when this camera card went to the second examiner, it was received by the second examiner unsealed, which is crazy."
Tampering of Images on Camera Card
According to court documents, experts believe the camera card was likely altered between April 11, 2019, and June 11, 2019, while in FBI custody.
According to FBI practice, no examination of an electronic evidence can take place before a forensic image (exact copy) has been made of the device by the CART [Computer Analysis Response Team] lab. However, on September 19, 2019, an FBI examiner took the camera card out of evidence control for "review" before CART had processed the evidence, according to court documents.
On the same day the camera card was accessed without a write-blocker, Raniere's attorney has argued, which he says means the last accessed dates were overwritten, inevitably removing all traces of when the evidence was last accessed.
What is concerning to experts and Raniere's attorney Tully is the review of evidence took place before the 22 photographs of alleged child pornography had been officially discovered and later presented at trial.
Additionally, the experts discovered that files 93, 94, 96, and 97, which were used by the prosecution to argue the images of Camila were taken on Raniere's camera when she was underage, featured thumbnails of a blonde woman on the camera card. However, on the hard drive, the thumbnails for the photo files 93, 94, 96, and 97 featured a completely different woman, with brown hair.
Kiper described the thumbnail discovery as the "smoking gun."
He explained: "That would mean that a camera would have been able to simultaneously take two pictures of two different women at exactly the same time. It doesn't happen, so obviously, the new files that appeared on the second FBI report, they were put in there, very likely to create that stronger relationship between the camera card and the external hard drive."
On a normal backup, the images from the camera card, including their thumbnails, would identically match their counterparts on the hard drive.
Tully argued in the motion to appeal "this anomaly" is only down to "manual tampering."
Following the appeal submission, the trial judge declined to address the motion to hear the evidence. Newsweek has contacted the FBI for comment.
Raniere remains incarcerated at United States Penitentiary Tucson and is continuing his fight for freedom.
The Vow is streaming on HBO Max now.