The attached FD-302 is a sanitized version of the events that transpired on April 9, 2013. It should be read as a cautionary tale about thinking law enforcement are the “good guys”. Sometimes they are, and sometimes they aren’t. In other words, every encounter is 50/50 (See the movie Crash.)
Shortly after I get home from work, there is a knock on my door as I’m fixing myself dinner on an idle Tuesday as the advice song warns: “The real troubles in your life … Are apt to be things that never crossed your worried mind … The kind that blindsides you at 4 p.m. on some idle Tuesday”.
I go to the window that overlooks my front door and see two average looking white guys, I say “whatever you’re selling, I don’t want it” and one of the guys flashes an FBI badge and I go to open the door. That was a mistake, I should have immediately asked them – from the window – “Do you have a warrant?” This would have forced the bastards to reveal the warrant immediately; because I wouldn’t have opened the door without an affirmation.
Instead, I opened the door and let them inside, for what is legally called a “knock and talk”. They immediately began by asking me if I was a terrorist then quickly pivoted to asking if I was a member of the criminal images community. Again, I made the mistake of trying to defend myself and trying to be cooperative. In hindsight I should have 1) Not let them inside until they produced the warrant and 2) Said “I invoke my 5th Amendment right to remain silent”. As that would have put them in a bind, because their search warrant was based on fraudulent information.
In the PDF, you’ll see that the lead agent memorialized these events in the first four paragraphs of his FD-302. He based those paragraphs totally on the chicken scratch of first two pages of the PDF and his imagination. As you can see, the FD-302 is mostly a sanitized re-arrangement of what actually occurred, but thanks to no-one recording the “interview” (even though POS Becker ordered them to – See Nebraska Case No. 8:13CR106 Doc# 247 “Although Agent Koontz recorded the interview, due to an oversight she did not record the advisement of Miranda rights … Agent Koontz explained the oversight occurred because FBI policy did not permit her to record interviews; however, she recorded the interview with the defendant at the Department of Justice’s request”), it’s just my word against their’s; but I have receipts.
The key sanitization occurs in paragraph 5 where the agent (SA Couch) states “Cottom was then told that the FBI had a search warrant for his residence”. That is not what happened. In sum, the two Agents performed what is known as a “knock and talk” when they should have performed a “knock and announce”. But Courts often think this is just fine, so YOU need to be vigilant to protect your rights.
What actually occurred during those first 5 paragraphs was that the two Agents (who didn’t have clue of what computer they were looking for) got me to discuss Tor and what computer I used to access it. (At the time these idiots thought that using Tor was a key admission – Courts later rejected that belief.) That made them focus on my Linux computer for the triage, that was turned off in my office/bedroom. The lead agent then asked if I’d consent to a digital exam of that computer and I said “No, you’ll need a warrant for that.” Note how the lead agent left that FACT out of his 302. Odd no? Well, things just got odder from there.
Notice paragraph 6 states that “…a hard drive from Cottom’s desktop computer was looked at from behind a write blocker using X-Ways…” and that they located “multiple images…under the home/adama directory”. The lead agent then reports in paragraph 7 that “Cottom denied knowing how [images] had gotten onto his computer”. That’s not what happened, When SA Couch confronted me in the kitchen (were I was made to stay] about the images, I actually said “Bullshit, all the home directories are encrypted!” Couch being technically ignorant offers to show me. BIG Mistake!
SA Couch reports that after he showed me the images I just said “whatever” and walked away. Again, this is an egregious sanitization. First, I told the tech (SA Ramos) – after looking at his laptop screen – “those are thumbnails genius and you wrote over an encrypted home directory to plant them, be sure to save the X-Ways log.” That caused the tech to immediately get angry and he shut down the triage. I told the lead agent “he planted the thumbnails in a decoy account”. SA Couch then responded with some nonsense and I said “whatever” and walked away from my office. The triage I saw (which they didn’t photograph, even though they took 74 pictures during the raid) consisted of the desktop’s 500GB drive on a TV table next to a laptop running X-ways. That’s right, he took a cold hard drive (off) out of my desktop computer and connected it to his laptop with a standard USB to SATA adapter (It was slim, thus not thick like a write blocker would have to be). When you look at exam chicken scratch you can see it just says “write blocker with an arrow to X-ways” no name or make was noted.
Here is what I observed from my kitchen table during the triage. The tech examined the hard drive for about an hour finding nothing but MP3 files (a had about a half a million). SA Couch stated “You have a lot of MP3s” And I replied “Yes”. I also knew that the home directories were encrypted, so I knew they couldn’t examine them. After that first hour, I saw an agent pick up my locked laptop and open its screen. I knew it would present him with my picture associated with the user name Adama. Unknown to them, the Adama account on my linux box was a decoy, it was there for hackers to make the mistake that the admin account on my windows computer was the same on my linux computer. So my decoy trapped these clowns, a few minutes later they claimed to have found images in Adama’s account. I knew they were lying because 1) I didn’t use that account (no-one could, it was locked in the shadow file) and 2) all home directories were encrypted – thus my response was “bullshit”. (Note: I am asserting that the tech had a script (likely python) that generated the fake thumbnails in seconds. He overwrote/modified the home directory fast because I had told them the linux os drive wasn’t encrypted (which it wasn’t). The tech just falsely assume the home directories weren’t encrypted either. Thus his fatal mistake.)
As you can see from the indecipherable notes the tech took, there is no way to contradict my story. So I had my attorney ask for the X-ways logs from the triage or a picture of it (because I knew they didn’t use a write blocker). The AUSA said neither was available. 100% Suspicious, you betcha! So that’s when they came to the agreement that my case would just be about the NIT. Since I was a legal novice at this time, I trusted my CJA Attorneys. As I’ve documented on this blog, that trust was misplaced