SWORN STATEMENT¶
DIGITALLY RECORDED¶
OIG CASE #:¶
2019-010614¶
OFFICE OF THE INSPECTOR GENERAL¶
SEPTEMBER 22, 2021¶
RESOLUTE DOCUMENTATION SERVICES¶
28632 Roadside Drive, Suite 285¶
Agoura Hills, CA 91301¶
Phone: (818) 431-5800¶
EFTA00125856¶
LIMITED OFFICIAL USE¶
EFTA00125857¶
EFTA00125858¶
LIMITED OFFICIAL USE¶
4¶
EFTA00125859¶
EFTA00125860¶
LIMITED OFFICIAL USE¶
EFTA00125861¶
LIMITED OFFICIAL USE¶
EFTA00125862¶
LIMITED OFFICIAL USE¶
EFTA00125863¶
LIMITED OFFICIAL USE¶
9¶
EFTA00125864¶
LIMITED OFFICIAL USE¶
10¶
EFTA00125865¶
LIMITED OFFICIAL USE¶
11¶
EFTA00125866¶
LIMITED OFFICIAL USE¶
EFTA00125867¶
LIMITED OFFICIAL USE¶
13¶
EFTA00125868¶
LIMITED OFFICIAL USE¶
14¶
EFTA00125869¶
LIMITED OFFICIAL USE¶
15¶
EFTA00125870¶
LIMITED OFFICIAL USE¶
EFTA00125871¶
LIMITED OFFICIAL USE¶
17¶
EFTA00125872¶
LIMITED OFFICIAL USE¶
18¶
have access to the room. That would be on a Friday. Then August 10th is when he called you back, and it looks like you -. The incident with Epstein happened, and he called you back.¶
MR. : Oh. Okay. Okay. Yeah, because I was going to say -. Let’s see.¶
Yeah. I have a different recollection than I thought, because I thought, from what, and I want to say, maybe that incident started earlier, but maybe not. Because what I was, what I was recalling on that was, me and my wife were actually about, I think, let’s see, 2019. So, that would have been -. Yeah.¶
Me and my wife and my son were out at a cabin on a weekend get-away, and I remember an email, I believe that was from Justin, saying something that he had gotten a call from¶
Now, that could have been after the initial reach out from him. That the drives were down. I think that might have been. So, I’m kind of questioning if reached out to me initially, or if he reached to Justin, and then Justin assigned that to me.¶
Because Justin, I believe, was also out on vacation, either that week or that weekend, as¶
EFTA00125873¶
LIMITED OFFICIAL USE¶
19¶
I was, but I was kind of local. So, he had asked me to reach out or, you know, basically work with him, work with Qognify. And so, that’s what I was remembering from that, because I know, I remember specifically, I was on vacation on the weekend.¶
And trying to reach out, basically, to, I want to say, like, our sales rep, Steve Smith (Phonetic Sp. *00:14:27), who worked, you know, for the Bureau, or worked with the Bureau of Prisons. He sold all their equipment. Reaching out to Derek Barr. But again, I could be -. I could be wrong on the timeframe there. But —¶
MR. : — either way, yes, I did work directly with - at one point, on the case, prior to visiting the site. So, yeah. I was just trying to get that timeline right, because I don’t want to tell you that it happened this specific way you’re saying it, and then it didn’t.¶
MR. : No problem. And you mentioned that you were away with your wife on a camping trip. Do you know how long the trip¶
EFTA00125874¶
LIMITED OFFICIAL USE¶
20¶
EFTA00125875¶
LIMITED OFFICIAL USE¶
EFTA00125876¶
EFTA00125877¶
LIMITED OFFICIAL USE¶
23¶
Yeah. I know it was basically right around this case time. So, it could have been the prior, or it could have been that weekend. But yeah. That’s really -.¶
MR. : Or I got a reply from him on the 8th. Yeah. Because I want to say we left out on the 9th, and we were at the cabin on the 9th. And I want to say that me and Justin were maybe communicating back and forth via email. And trying to kind of figure out, you know, what drives he could get, or whatever. So, maybe, maybe it all happened right in that weekend. Because I do remember something about hearing that, you know, the incident happened there.¶
EFTA00125878¶
LIMITED OFFICIAL USE¶
24¶
EFTA00125879¶
LIMITED OFFICIAL USE¶
25¶
EFTA00125880¶
EFTA00125881¶
LIMITED OFFICIAL USE¶
27¶
like, I know that he initially contacted us about the drives being out. And I want to say, it took -. I remember it -. I thought it was at least a couple of days of the process of trying to go back and forth with him. And I don’t know if it was me or Justin, basically saying, hey, we’ve got to get drives. You know, they don’t sell them anymore at Qognify, I don’t think. Because they are basically non-production drives, and we would have to get refurbished drives. And I think Justin was looking on, like, eBay, and, you know, a couple of our sources, to find some. So, I don’t know exactly, did that comment say that he had¶
EFTA00125882¶
LIMITED OFFICIAL USE¶
28¶
EFTA00125883¶
LIMITED OFFICIAL USE¶
29¶
EFTA00125884¶
LIMITED OFFICIAL USE¶
30¶
EFTA00125885¶
LIMITED OFFICIAL USE¶
31¶
MR. : Oh, no problem. Hopefully, I can find something that helps a little more. Okay. So, I’ve got -. All right. Let me see if I can load this into Outlook and see, if it will load. All right. So, files. Open. And export. Let’s do an import. Oh, import from another program or file. Oh, that is a ODF. Yup, right there. Let’s see. Allow duplicates to be created, replace duplicates with items imported. I have no idea. But I’ll screw my work email up. Crap.¶
MR. : This is, in here, it states, “During the rebuild process of the drives, the drives were required to be taken out of raid, on DVR-2. Once the drives are removed without proper shutdown of the recorder, the video database becomes corrupted.” Is that your¶
EFTA00125886¶
LIMITED OFFICIAL USE¶
32¶
understanding of what happened, from your conversation with [blank]?¶
MR. : I’m - so, yeah - I’m trying to figure out when that was happening, because I do know that, at some point, the FBI came there on site, I think prior to us showing up. And I want to say that the recorder was rebuilding, and they said that they had to take the equipment out. And that’s what I’m -. That’s what I’m trying to piece together, if it was then that they took it out. Or if it was -. Yeah. Because I don’t, I don’t really make any sense of him putting them in and then pulling them out.¶
MR. : Yeah, because I would think, once he puts them in, I mean, he would leave them to rebuild. And I think I would have probably made that comment, because he said something about the FBI coming in, they need to confiscate the equipment. And then, and I’m pretty sure I told him, I said, well, you don’t want to, you don’t want to unplug those while it’s rebuilding because if it, you know, basically stops, you have no pick up¶
EFTA00125887¶
LIMITED OFFICIAL USE¶
33¶
EFTA00125888¶
LIMITED OFFICIAL USE¶
34¶
everything was kind of compiled together, on the same raid in those servers. So, that would have put the OS, and the video storage on the same raid array.¶
But they partition out for the OS. So, if they lost one drive, then that would be okay. With a raid five. If they lost two drives, then-. So, if they would have lost two drives simultaneously, they would lose everything. The recorder would go down, and you wouldn’t be able to get into the OS. From what I understood. So, it’s possible that he lost one drive and called us. Initially. Was trying to replace that. And then, when, you know, basically, another one went down while the other one was rebuilding. That could have been possible. And that could explain why the OS didn’t crash.¶
MR. : So, on that note, so, our understanding, there is, like, let’s say there is 150 cameras in the MCC.¶
MR. : We were told about half of them go to one drive, and half of them go to the other drive. If that one drive went down¶
EFTA00125889¶
LIMITED OFFICIAL USE¶
35¶
EFTA00125890¶
LIMITED OFFICIAL USE¶
36¶
what I said about the OS. Because now, I’m remembering their set up.¶
I believe they had -. The way the old ones were, is they had a separate computer. They called the Nice Vision Pro units. So, that, I believe, had two drives in it. So, that would be a raid one redundancy. So, that -. So, again, the raid is a group of drives for storage.¶
MR. : And what a raid allows is, so, like, in your case, you were just talking about if you had two drives, you had, you know, half the cameras recording in one, half the other, to the other one, if one went down, you would technically still have all the other cameras on that drive. So, what the raid does is basically, it allows you to take - say you don’t have that scenario, of losing half your cameras - the raid allows you to put, you know, there is a number of drives that it requires to have for certain raid levels.¶
But basically, it allows you to, like, let’s say four to six hard drives. It groups those together. So now, you - then the¶
EFTA00125891¶
LIMITED OFFICIAL USE¶
37¶
EFTA00125892¶
LIMITED OFFICIAL USE¶
38¶
have known that the DVR system went down? Was there any alerts that come up in Nice Vision, anything that comes up to them?¶
MR. : Yeah. So, it would. It would normally come up on the -. It’s called the AMS, or the Application Management Server. And that’s, like, the primary unit that controls the whole video system. And then, you add recorders underneath that AMS. Depending on how many cameras you have. That’s how they kind of allocate recorders. So, if you have 100 cameras, okay, let’s put 100 cameras on this recorder. Let’s put 100 more on the second one. So on and so forth.¶
And then, Application Management Server basically allows the users to authenticate and log into that system, from any client in the facility. Or outside if you, you know, if they’ve managed to network that way. But yeah, the Application Management Server is kind of, like, the gateway to let people in, to view the video. And then, that also manages the traffic of, okay, you want to see this video and this recorder. Okay, you’ve got, you know, you’ve got correct credentials. Okay, you’re allowed¶
EFTA00125893¶
LIMITED OFFICIAL USE¶
39¶
MR. : There was five different applications for Nice Vision. Supervision would keep all of the, like, the hardware, and I think most software events, in that application. And I think you could control, basically, if you had pop-ups messages or anything. But as far as if you didn’t go to that server physically, and check, from what I know from the Bureau, they did not allow those servers to send email notifications out.¶
MR. Because that would have required them to load with an email client, on the server, and then, you know, basically act like it’s, you know, someone’s account on that server, to send those email notifications out¶
EFTA00125894¶
LIMITED OFFICIAL USE¶
40¶
EFTA00125895¶
LIMITED OFFICIAL USE¶
41¶
of the time, from what I see, you’ve got -.¶
So, there is a control app that’s normally for, you know, you can play back video and see live video in that application.¶
And then, there is an app called Site Builder, and that’s basically letting you set up the site. But the Supervision app would be where you check on the status of, okay, if your recorder is offline, if you’ve got a bad hard drive, things like that. So, that’s where you have to go, to see that. So, I don’t know if they had pop-up alerts on there, and you, like I said, I think you could set those up to pop-up on your machine. But again, that would dependent if you’re logged in to Nice Vision. And you have those pop-up alerts turned on. Otherwise, you would have to log in, go to that application, and look at the list of alerts —¶
MR. : To see it. Okay.¶
MR. : — to see what was going¶
EFTA00125896¶
LIMITED OFFICIAL USE¶
42¶
EFTA00125897¶
LIMITED OFFICIAL USE¶
43¶
EFTA00125898¶
LIMITED OFFICIAL USE¶
4 4¶
EFTA00125899¶
LIMITED OFFICIAL USE¶
45¶
MR. : — I know that FBI met me there. Yeah. They showed up when I was kind of getting the new system set up. And then, they kind of jumped in and they were doing stuff, and asking me questions about a, you know, check to see where those video gaps and stuff like that. Okay. So, I’m starting to remember a little bit.¶
On the drives that you’re talking about, so, I want to say that we actually suggested to him to pull all of the drives out, and try to rebuild it, because I think that was our normal protocol. If, let’s say you had a bad drive, sometimes on those older Pro units, you can pull one out. As long as you don’t have, like,¶
EFTA00125900¶
LIMITED OFFICIAL USE¶
46¶
EFTA00125901¶
LIMITED OFFICIAL USE¶
47¶
rebuild. During the rebuild process of the drives, the drives were required to be taken out of the raid on DVR-2. Once the drives are removed without proper shut down of the recorder, the video database becomes corrupted. Typically, any time the raid on a raid five configuration loses two drives, the raid needs to be rebuilt, and all data wiped from the raid.” Does this - based on your comment - does it mean that - your understanding is - that he went in, tried to replace it, and he pulled the drive without the proper shut down of the recorder?¶
MR. : Wait, so, you don’t have to shut down the drive if - or, you don’t have to shut down the recorder if you’re pulling a drive out. Like, one drive. And it’s called a hot swappable (Phonetic Sp. *00:42:11) drive.¶
MR. : So, what that means basically, you can pull it out, re-insert it, and let it rebuild. But there is a limit to how many you can do. Because you can’t just say, okay, I’ve got two bad drives. Lightbulb goes out. And try to re-insert them, let those¶
EFTA00125902¶
LIMITED OFFICIAL USE¶
48¶
build. Because once you do that, if there is a possibility of the one of the two being good, and it’s writing somewhat, you pull those both out, you’re going to crash your system.¶
So, so, and those drives, when you rebuild them, it takes - I want to say it takes at least eight hours. So, I do remember him replacing one, and I want to say it was an overnight process. He pulled it out. Put it in. It looked like it started rebuilding. And I think he came in the next day, and it failed. I don’t know if he tried it again. Or he may have tried that second drive, then, at that point. Tried to pull that and let it rebuild. And that may have been the point where the FBI, maybe, come on site. And said, hey, we’ve got to, you know, confiscate it or whatever. I don’t know, at that point.¶
question was. Is this all talking about Daniel, his actions, or is it talking about both his actions, as well as the FBI actions of them pulling it, while it was trying to be¶
EFTA00125903¶
LIMITED OFFICIAL USE¶
49¶
drives, the drives were required to be taken out of the raid on DVR-2. Once the drives are removed without proper shutdown of the recorder, the video database becomes corrupted.” So, my question there would be, like, is that new sentence - “Once the drives are removed without proper shut down” - is that anything that you’re talking about with regard to the FBI removing them without proper shut down, or are you still talking about what Daniel did?¶
MR. : I would say what the FBI because I wouldn’t -. I don’t think I would have put “required to be.” Did I say, “Required to be taken out,” or “Required to be¶
EFTA00125904¶
LIMITED OFFICIAL USE¶
50¶
MR. : Okay. So, yeah. And listening to my statement of, “During the drives being rebuilt, they were required to be taken out.” Yeah. I wouldn’t have stated that they would have been required to be taken out. Because there was nobody requiring him, other than the FBI, to take them out.¶
MR. : I thought that was¶
EFTA00125905¶
LIMITED OFFICIAL USE¶
EFTA00125906¶
LIMITED OFFICIAL USE¶
52¶
EFTA00125907¶
LIMITED OFFICIAL USE¶
53¶
EFTA00125908¶
LIMITED OFFICIAL USE¶
54¶
EFTA00125909¶
LIMITED OFFICIAL USE¶
55¶
EFTA00125910¶
LIMITED OFFICIAL USE¶
56¶
EFTA00125911¶
LIMITED OFFICIAL USE¶
57¶
EFTA00125912¶
LIMITED OFFICIAL USE¶
58¶
EFTA00125913¶
LIMITED OFFICIAL USE¶
EFTA00125914¶
LIMITED OFFICIAL USE¶
EFTA00125915¶
LIMITED OFFICIAL USE¶
EFTA00125916¶
LIMITED OFFICIAL USE¶
62¶
CERTIFICATE¶
I hereby certify that the foregoing pages represent an accurate transcript of the electronic sound recording of the proceedings before the Department of Justice, Office of the Inspector General in the matter of:¶
Brianna Rose Burton, Transcriber¶
EFTA00125917¶