EFTA00156626.pdf

U.S. Department of Justice United States Attorney Southern District of New York The Silvio J. Mob Building One Saint Andrew's Plaza New York. Neu• York 10007 November 25, 2021 BY ELECTRONIC MAIL Christian Everdell, Esq. Cohen & Gresser LLP 800 Third Avenue New York, NY 10022 Laura Menninger, Esq. Jeffrey Pagliuca, Esq. Haddon, Morgan and Foreman, P.C. 150 East Tenth Avenue Denver, CO 80203 Bobbi Stemheim, Esq. Law Offices of Bobbi C. Stemheim 33 West 19th Street-4th Fl. New York, NY 10007 Re: United States v. Ghislaine Maxwell, 20 Cr. 330 (AJN) Dear Counsel: The Government expects to offer testimony fro of the Federal Bureau of Investigation's ("FBI") Computer Analysis Response Team ("CART"). As noted in the Government's September 15, 2021 letter, although the Government believes that testimony will not require admission through Rule 702 of the Federal Rules of Evidence, the Government provided ex rt notice. In an abundance of caution, the Government is providing additional description of anticipated testimony. The Government anticipates that will testify regarding the forensic examination of the devices marked for identification as Government Exhibits 54 and 55, and his determination that those exhibits are clones. He is ex ted to testify that a clone is an exact copy of one piece of media to another. is expected to explain that he connected Government Exhibits 54 and 55 to a write blocker and subs uentl ima ed, or made an exact copy, of the exhibits. The Government anticipates that will explain that the images of Government Exhibits 54 and 55 are exact copies of the original devices because he ran a hash, or mathematical algorithm that uniquely identifies data, on the original devices and the images, which are identical. EFTA00156626 Page 2 The Government further anticipates that will testify that Government Exhibits 405 and 419 reflect registry software information for Government Exhibits 55 and 54, respectively. will explain that such registry software information includes several fields, including registered organization and registered owner, which are user input data. He is expected to explain that Government Exhibits 405 and 419 were generated by Access Data AD Lab. The Government further anticipates that will testify that he examined certain exhibits contained on the devices marked for identification as Government Exhibits 54 and 55. In particular, he is expected to testify that Government Exhibits 412, 415, 424 are emails on Government Exhibit 54; Government Exhibits 418, 420, 421, and 422 are Word documents on Government Exhibit 54; and Government Exhibits 418B 420B 421B and 422B contain the properties, or metadata, for the corresponding exhibits. is expected to testify that Government Exhibits 418, 420, 421, and 422 were saved under a user profile named "GMax." He is also expected to testif that Government Exhibit 417 is a Word document stored on Government Exhibit 55. is expected to testify that that the metadata fields listed on Government Exhibits 417, 418, 420, 421, and 422 are true and accurate reflections of the metadata properties for those files, such as the fields listin the author, content created date, date last saved, last saved by, and last printed. will explain that he confirmed the accurac of metadata fields by running by Access Data AD Lab. In the course of doing so, will explain that metadata is information about a file, such as the file name and when the file was created. He will also explain that metadata can be stored in a computer's file system or embedded inside certain files, like Word documents. The Government also notes that discussed similar topics in testimony referenced in the September 15, 2021 letter. See Trial Tr. at 935-36, United States v. Hirst, 15 Cr. 643 (PKC) (describing metadata); Trial Tr. at 292-93, United States v. DiTomasso, 14 Cr. 160 (SAS) (describing hash values). He has also testified about similar topics in United States v. Healey, 11 Cr. 132 (SAS). As noted, the Government does not believe that the fore oin testimony encompasses the sort of "opinion" that requires expert testimony. Rather, testimony is based on his first-hand knowledge and observation during his examination of the devices in question. To the extent he offers anything resemblin an o inion it is the product of reasoning processes familiar to the average person. While possesses specialized knowledge by virtue of his training and experience, his testimony reflects his investi ato findings and conclusions, and is not rooted exclusively in his expertise. To the extent testimony is characterized as expert "opinion" testimony under Rule 702, we note that his experience and training are described in his curriculum vitae, which was produced to you on September 15, 2021 bearing Bates number 3503-001. EFTA00156627 Page 3 Very truly yours, DAMIAN WILLIAMS United States Attorney by: Assistant United States Attorneys EFTA00156628