SWORN STATEMENT DIGITALLY RECORDED OIG CASE #: 2019-010614 OFFICE OF THE INSPECTOR GENERAL SEPTEMBER 22, 2021 RESOLUTE DOCUMENTATION SERVICES 28632 Roadside Drive, Suite 285 Agoura Hills, CA 91301 Phone: (818) 431-5800 EFTA00125856 LIMITED OFFICIAL USE EFTA00125857 EFTA00125858 LIMITED OFFICIAL USE 4 EFTA00125859 EFTA00125860 LIMITED OFFICIAL USE EFTA00125861 LIMITED OFFICIAL USE EFTA00125862 LIMITED OFFICIAL USE EFTA00125863 LIMITED OFFICIAL USE 9 EFTA00125864 LIMITED OFFICIAL USE 10 EFTA00125865 LIMITED OFFICIAL USE 11 EFTA00125866 LIMITED OFFICIAL USE EFTA00125867 LIMITED OFFICIAL USE 13 EFTA00125868 LIMITED OFFICIAL USE 14 EFTA00125869 LIMITED OFFICIAL USE 15 EFTA00125870 LIMITED OFFICIAL USE EFTA00125871 LIMITED OFFICIAL USE 17 EFTA00125872 LIMITED OFFICIAL USE 18 have access to the room. That would be on a Friday. Then August 10th is when he called you back, and it looks like you -. The incident with Epstein happened, and he called you back. MR. : Oh. Okay. Okay. Yeah, because I was going to say -. Let’s see. Yeah. I have a different recollection than I thought, because I thought, from what, and I want to say, maybe that incident started earlier, but maybe not. Because what I was, what I was recalling on that was, me and my wife were actually about, I think, let’s see, 2019. So, that would have been -. Yeah. Me and my wife and my son were out at a cabin on a weekend get-away, and I remember an email, I believe that was from Justin, saying something that he had gotten a call from Now, that could have been after the initial reach out from him. That the drives were down. I think that might have been. So, I'm kind of questioning if reached out to me initially, or if he reached to Justin, and then Justin assigned that to me. Because Justin, I believe, was also out on vacation, either that week or that weekend, as EFTA00125873 LIMITED OFFICIAL USE 19 I was, but I was kind of local. So, he had asked me to reach out or, you know, basically work with him, work with Qognify. And so, that's what I was remembering from that, because I know, I remember specifically, I was on vacation on the weekend. And trying to reach out, basically, to, I want to say, like, our sales rep, Steve Smith (Phonetic Sp. *00:14:27), who worked, you know, for the Bureau, or worked with the Bureau of Prisons. He sold all their equipment. Reaching out to Derek Barr. But again, I could be -. I could be wrong on the timeframe there. But -- MR. : -- either way, yes, I did work directly with - at one point, on the case, prior to visiting the site. So, yeah. I was just trying to get that timeline right, because I don’t want to tell you that it happened this specific way you’re saying it, and then it didn’t. MR. : No problem. And you mentioned that you were away with your wife on a camping trip. Do you know how long the trip EFTA00125874 LIMITED OFFICIAL USE 20 EFTA00125875 LIMITED OFFICIAL USE EFTA00125876 EFTA00125877 LIMITED OFFICIAL USE 23 Yeah. I know it was basically right around this case time. So, it could have been the prior, or it could have been that weekend. But yeah. That’s really -. MR. : Or I got a reply from him on the 8th. Yeah. Because I want to say we left out on the 9th, and we were at the cabin on the 9th. And I want to say that me and Justin were maybe communicating back and forth via email. And trying to kind of figure out, you know, what drives he could get, or whatever. So, maybe, maybe it all happened right in that weekend. Because I do remember something about hearing that, you know, the incident happened there. EFTA00125878 LIMITED OFFICIAL USE 24 EFTA00125879 LIMITED OFFICIAL USE 25 EFTA00125880 EFTA00125881 LIMITED OFFICIAL USE 27 like, I know that he initially contacted us about the drives being out. And I want to say, it took -. I remember it -. I thought it was at least a couple of days of the process of trying to go back and forth with him. And I don’t know if it was me or Justin, basically saying, hey, we’ve got to get drives. You know, they don’t sell them anymore at Qognify, I don’t think. Because they are basically non-production drives, and we would have to get refurbished drives. And I think Justin was looking on, like, eBay, and, you know, a couple of our sources, to find some. So, I don't know exactly, did that comment say that he had EFTA00125882 LIMITED OFFICIAL USE 28 EFTA00125883 LIMITED OFFICIAL USE 29 EFTA00125884 LIMITED OFFICIAL USE 30 EFTA00125885 LIMITED OFFICIAL USE 31 MR. : Oh, no problem. Hopefully, I can find something that helps a little more. Okay. So, I've got -. All right. Let me see if I can load this into Outlook and see, if it will load. All right. So, files. Open. And export. Let's do an import. Oh, import from another program or file. Oh, that is a ODF. Yup, right there. Let's see. Allow duplicates to be created, replace duplicates with items imported. I have no idea. But I'll screw my work email up. Crap. MR. : This is, in here, it states, "During the rebuild process of the drives, the drives were required to be taken out of raid, on DVR-2. Once the drives are removed without proper shutdown of the recorder, the video database becomes corrupted." Is that your EFTA00125886 LIMITED OFFICIAL USE 32 understanding of what happened, from your conversation with [blank]? MR. : I'm - so, yeah - I'm trying to figure out when that was happening, because I do know that, at some point, the FBI came there on site, I think prior to us showing up. And I want to say that the recorder was rebuilding, and they said that they had to take the equipment out. And that's what I'm -. That’s what I'm trying to piece together, if it was then that they took it out. Or if it was -. Yeah. Because I don’t, I don’t really make any sense of him putting them in and then pulling them out. MR. : Yeah, because I would think, once he puts them in, I mean, he would leave them to rebuild. And I think I would have probably made that comment, because he said something about the FBI coming in, they need to confiscate the equipment. And then, and I'm pretty sure I told him, I said, well, you don't want to, you don't want to unplug those while it's rebuilding because if it, you know, basically stops, you have no pick up EFTA00125887 LIMITED OFFICIAL USE 33 EFTA00125888 LIMITED OFFICIAL USE 34 everything was kind of compiled together, on the same raid in those servers. So, that would have put the OS, and the video storage on the same raid array. But they partition out for the OS. So, if they lost one drive, then that would be okay. With a raid five. If they lost two drives, then-. So, if they would have lost two drives simultaneously, they would lose everything. The recorder would go down, and you wouldn’t be able to get into the OS. From what I understood. So, it’s possible that he lost one drive and called us. Initially. Was trying to replace that. And then, when, you know, basically, another one went down while the other one was rebuilding. That could have been possible. And that could explain why the OS didn't crash. MR. : So, on that note, so, our understanding, there is, like, let’s say there is 150 cameras in the MCC. MR. : We were told about half of them go to one drive, and half of them go to the other drive. If that one drive went down EFTA00125889 LIMITED OFFICIAL USE 35 EFTA00125890 LIMITED OFFICIAL USE 36 what I said about the OS. Because now, I'm remembering their set up. I believe they had -. The way the old ones were, is they had a separate computer. They called the Nice Vision Pro units. So, that, I believe, had two drives in it. So, that would be a raid one redundancy. So, that -. So, again, the raid is a group of drives for storage. MR. : And what a raid allows is, so, like, in your case, you were just talking about if you had two drives, you had, you know, half the cameras recording in one, half the other, to the other one, if one went down, you would technically still have all the other cameras on that drive. So, what the raid does is basically, it allows you to take - say you don’t have that scenario, of losing half your cameras - the raid allows you to put, you know, there is a number of drives that it requires to have for certain raid levels. But basically, it allows you to, like, let’s say four to six hard drives. It groups those together. So now, you - then the EFTA00125891 LIMITED OFFICIAL USE 37 EFTA00125892 LIMITED OFFICIAL USE 38 have known that the DVR system went down? Was there any alerts that come up in Nice Vision, anything that comes up to them? MR. : Yeah. So, it would. It would normally come up on the -. It’s called the AMS, or the Application Management Server. And that’s, like, the primary unit that controls the whole video system. And then, you add recorders underneath that AMS. Depending on how many cameras you have. That’s how they kind of allocate recorders. So, if you have 100 cameras, okay, let’s put 100 cameras on this recorder. Let’s put 100 more on the second one. So on and so forth. And then, Application Management Server basically allows the users to authenticate and log into that system, from any client in the facility. Or outside if you, you know, if they’ve managed to network that way. But yeah, the Application Management Server is kind of, like, the gateway to let people in, to view the video. And then, that also manages the traffic of, okay, you want to see this video and this recorder. Okay, you’ve got, you know, you’ve got correct credentials. Okay, you’re allowed EFTA00125893 LIMITED OFFICIAL USE 39 MR. : There was five different applications for Nice Vision. Supervision would keep all of the, like, the hardware, and I think most software events, in that application. And I think you could control, basically, if you had pop-ups messages or anything. But as far as if you didn't go to that server physically, and check, from what I know from the Bureau, they did not allow those servers to send email notifications out. MR. Because that would have required them to load with an email client, on the server, and then, you know, basically act like it’s, you know, someone’s account on that server, to send those email notifications out EFTA00125894 LIMITED OFFICIAL USE 40 EFTA00125895 LIMITED OFFICIAL USE 41 of the time, from what I see, you’ve got -. So, there is a control app that’s normally for, you know, you can play back video and see live video in that application. And then, there is an app called Site Builder, and that's basically letting you set up the site. But the Supervision app would be where you check on the status of, okay, if your recorder is offline, if you've got a bad hard drive, things like that. So, that's where you have to go, to see that. So, I don't know if they had pop-up alerts on there, and you, like I said, I think you could set those up to pop-up on your machine. But again, that would dependent if you're logged in to Nice Vision. And you have those pop-up alerts turned on. Otherwise, you would have to log in, go to that application, and look at the list of alerts -- MR. : To see it. Okay. MR. : -- to see what was going EFTA00125896 LIMITED OFFICIAL USE 42 EFTA00125897 LIMITED OFFICIAL USE 43 EFTA00125898 LIMITED OFFICIAL USE 4 4 EFTA00125899 LIMITED OFFICIAL USE 45 MR. : -- I know that FBI met me there. Yeah. They showed up when I was kind of getting the new system set up. And then, they kind of jumped in and they were doing stuff, and asking me questions about a, you know, check to see where those video gaps and stuff like that. Okay. So, I'm starting to remember a little bit. On the drives that you’re talking about, so, I want to say that we actually suggested to him to pull all of the drives out, and try to rebuild it, because I think that was our normal protocol. If, let’s say you had a bad drive, sometimes on those older Pro units, you can pull one out. As long as you don’t have, like, EFTA00125900 LIMITED OFFICIAL USE 46 EFTA00125901 LIMITED OFFICIAL USE 47 rebuild. During the rebuild process of the drives, the drives were required to be taken out of the raid on DVR-2. Once the drives are removed without proper shut down of the recorder, the video database becomes corrupted. Typically, any time the raid on a raid five configuration loses two drives, the raid needs to be rebuilt, and all data wiped from the raid.” Does this - based on your comment - does it mean that - your understanding is - that he went in, tried to replace it, and he pulled the drive without the proper shut down of the recorder? MR. : Wait, so, you don't have to shut down the drive if - or, you don't have to shut down the recorder if you're pulling a drive out. Like, one drive. And it's called a hot swappable (Phonetic Sp. *00:42:11) drive. MR. : So, what that means basically, you can pull it out, re-insert it, and let it rebuild. But there is a limit to how many you can do. Because you can't just say, okay, I've got two bad drives. Lightbulb goes out. And try to re-insert them, let those EFTA00125902 LIMITED OFFICIAL USE 48 build. Because once you do that, if there is a possibility of the one of the two being good, and it’s writing somewhat, you pull those both out, you’re going to crash your system. So, so, and those drives, when you rebuild them, it takes - I want to say it takes at least eight hours. So, I do remember him replacing one, and I want to say it was an overnight process. He pulled it out. Put it in. It looked like it started rebuilding. And I think he came in the next day, and it failed. I don’t know if he tried it again. Or he may have tried that second drive, then, at that point. Tried to pull that and let it rebuild. And that may have been the point where the FBI, maybe, come on site. And said, hey, we’ve got to, you know, confiscate it or whatever. I don't know, at that point. question was. Is this all talking about Daniel, his actions, or is it talking about both his actions, as well as the FBI actions of them pulling it, while it was trying to be EFTA00125903 LIMITED OFFICIAL USE 49 drives, the drives were required to be taken out of the raid on DVR-2. Once the drives are removed without proper shutdown of the recorder, the video database becomes corrupted.” So, my question there would be, like, is that new sentence - “Once the drives are removed without proper shut down” - is that anything that you’re talking about with regard to the FBI removing them without proper shut down, or are you still talking about what Daniel did? MR. : I would say what the FBI because I wouldn’t -. I don’t think I would have put “required to be.” Did I say, “Required to be taken out,” or “Required to be EFTA00125904 LIMITED OFFICIAL USE 50 MR. : Okay. So, yeah. And listening to my statement of, “During the drives being rebuilt, they were required to be taken out.” Yeah. I wouldn’t have stated that they would have been required to be taken out. Because there was nobody requiring him, other than the FBI, to take them out. MR. : I thought that was EFTA00125905 LIMITED OFFICIAL USE EFTA00125906 LIMITED OFFICIAL USE 52 EFTA00125907 LIMITED OFFICIAL USE 53 EFTA00125908 LIMITED OFFICIAL USE 54 EFTA00125909 LIMITED OFFICIAL USE 55 EFTA00125910 LIMITED OFFICIAL USE 56 EFTA00125911 LIMITED OFFICIAL USE 57 EFTA00125912 LIMITED OFFICIAL USE 58 EFTA00125913 LIMITED OFFICIAL USE EFTA00125914 LIMITED OFFICIAL USE EFTA00125915 LIMITED OFFICIAL USE EFTA00125916 LIMITED OFFICIAL USE 62 ## CERTIFICATE I hereby certify that the foregoing pages represent an accurate transcript of the electronic sound recording of the proceedings before the Department of Justice, Office of the Inspector General in the matter of: Brianna Rose Burton, Transcriber EFTA00125917