RR SCwWOnHtDUN SwWwrP DIGITALLY RECORDED SWORN STATEMENT OF OIG CASE #: 2019-010614 DEPARTMENT OF JUSTICE OFFICE OF THE INSPECTOR GENERAL SEPTEMBER 22, 2021 RESOLUTE DOCUMENTATION SERVICES 28632 Roadside Drive, Suite 285 Agoura Hills, CA 91301 Phone: (818) 431-5800 3 = Ss It’s Senior Special Agent . He’s also assisting on the case. Is it i -- : Yeah. . os ? : Yeah. I'm right here. I'm the Senior Special Agent here. So, yeah. Like MM here just said, where we just want to ask you a couple questions regarding August 8th through the 10th of 2019. : Okay. : And just so you know, all of our interviews are recorded. + Okay. And just for documentation purposes. Just so you know. Understood. All right. Great. So, is going to take it. I'l] only jump in if we need some clarifying information. Okay. : Perfect. start_the recording. Okay. And I'm going to APPEARANCES: OFFICE OF THE INSPECTOR GENERAL BY: WITNESS: OTHER APPEARANCES: 4 ME: cane is A, and I'm a Special Agent with U.S. Department of Justice, Office of the Inspector General. New York Field Office. This interview is with former SigNet employee, . And it is being conducted as part of an official U.S. Department of Justice, Office of the Inspector General investigation. Today’s date is September 22nd, 2021. The time is 9:03 a.m. This interview is being conducted telephonically, via phone number Did I get that right? : Yes. Okay. Also present -- : I'm going to read that I'm sorry. a. : Yes. Perfect. Also present is = Senior Special Agent J . This interview will be recorded by me, Special Agent Could everyone please identify themselves for the record, and spell your last name? To start, again, I am DO) Special Agent [mmm a. Senior Special Agent EFTA00064250

--=PAGE_BREAK=--

Wonton fwWwrP 5 with the D0J/O1c. [M- : TEBE, can you introduce : Former SigNet employee, full none - That’s - no, no - I go by I apologize for :_ All right. But I gave you my formal. : Yeah. Thank you. This is an official D0J/OIG investigation into the death of inmate Jeffrey Epstein, and the surrounding circumstances. And you are being asked to voluntarily provide answers to our questions. Will you agree to a voluntary interview? : Yes. : Thank you. Please let me know if you do not understand any questions I ask, and I will repeat it, or try to rephrase it. ME: Okay. |g Was there a major you were following? 7 : It’s just business management. Okay. And what did you do prior to working for SigNet? Prior to SigNet, I actually for six months. Excellent. And when did you begin working for SigNet? : When did I pick up working there? | se working for SigNet? : Oh. I'm sorry. I'm sorry. I'm going back too far. Sorry. SigNet. I actually worked for That as in Sorry. I skipped a whole bunch of years there. : No problem. : Yeah. : I'm thinking before the security industry. Sorry about that. Okay. When did you begin 6 HE: okay? I'm going to go through some of your background, and then we’l] go into the service request. What is your current home address? Current home address is - that’s| -_and Okay. And -- Zip code isi -- thank you. What is your date of birth? , Is this your cell phone number? : Yes. Okay. And what is your highest level of education? High school. number, the One year of college. : All right. Where did you attend college? I went toll Where is that? : Yeah. Oh, no. Go ahead. : No, no. No problem. And when exactly did you work, start, begin work for SigNet? 8 : That was April 2011. : Okay. And what was your position with SigNet? : I came on as a service tech, initially. And then, I entered into the role, I want to say it was probably somewhere in 2012, middle of 2012, or maybe early 2013. I think it was the middle of 2012, they put me as the senior customer support representative. HE. And that was your position in August 2019? : Yes. : Okay. And what did that - as a senior customer representative - what did that position entail? : So, that was basically traveling to the Federal Bureau of Prisons, whenever they needed their VMS video system server upgrades. Basically, any swap outs of their systems, when they expired or went out of warranty. And then, if I wasn’t traveling, EFTA00064251

--=PAGE_BREAK=--

Wonton fwWwrP 9 doing the upgrades, I was at home, working from my house, and doing technical support for the video systems at the prisons. a. Okay. So, the main client that you worked with was the Federal Bureau of Prisons? : Yes. : Okay. SigNet? And when did you leave That was December 30th, 2019. Where are you employed now? I am at based company That’ s| Okay. Thank you. Off of (Indiscernible (Indiscernible called *00:05:36) an *00:05:39). : Thank you. As part of your job at SigNet, in 2019, do you recall working on projects, or work orders, for the Metropolitan Correctional Center in New York City? : Yes. : Do you recall working on a 11 HBB was July 9th. And my first day at [i was on July 12th. Okay. 2021. Okay. clarifying that. : Yup. : Now, as part of - and I'm going to go back to that last question I asked - as part of your job at SigNet in 2019, do you recall working on projects, or work orders, for the Metropolitan Correctional Center in New York City? Yeah. Thank you for : Yes. : Who were you dealing with at I believe that was J. ? the MCC? : “Okay. And we have a copy of SigNet service request, 24975. Because this is telephonically, I know I can't show it to you, but I will read it to you. Is that all right with you? Wey fwrP Phonetic Sp. *00:07:41), ee . The contact we have is, , and the service location is for g project that started August 8, 2019? : Yeah. I remember the project. I don't know the exact date, but that sounds about right. Hey. I just want to clarify. You mentioned the , that where you work, have you been working there since December 2019? When I It’s No. I worked at -. ae: left SigNet, I went to another company. : Okay. And that was in December 2019? Yeah. 31st, or yeah, basically. (Indiscernible *00:06:28) January. Okay. And you were there for It was December how long? Until July, pfft. What was that? July. It was July this year. Look it_up. July. And in July, you came over to You started working at ? Yes. So, my last day at 12 : It says, “Raid (Phonetic Sp. *00:07:32) just crashed.” That's under the service request. And this was created on August 8, 2019. That status shows FBOP assigned, and it's assigned to our -. 150 Park Row, New York, New York. Is your understanding that is for the MCC? a. Yes. I believe so. I don’t know their exact address, but yeah -- Okay. -- it sounds -- Now, this says -- -- familiar. -- is this an emergency request? It says, yes. Must call. The problem was reported by :o-- Ag I apologize. It’s . And I'm going to read the comments here. The earliest comment, it looks like, is on - it’s by you - on August 8th, at And - EFTA00064252

--=PAGE_BREAK=--

13 3:36 p.m. It states that the a ssignment on August 8th to 16th, all day for a, ae ri vas been created. It says will be working on this. Get a case started with Qognify? Do you want to start with August 8th first. Is that what you started with? : Yeah. : Okay. Sorry. : It’s Qognify. That's Q-0-C- N-I-F-Y. Is that your internal system? No. So, Qognify is the video manufacturer of the software that they were using. At the time, though, they were - I believe - their system was a Nice Vision (Phonetic Sp. *00:08:57) system, just to give you guys a little background on it. So, Nice Vision was the prior company. : Okay. When most of the prisons got their video systems. And then, Qognify basically purchased, or bought, Nice Vision. I want to say that was probably in, like, 2018. Maybe 2017. 15 wondering who that was. I was going to guess Phonetic Sp. *00:10:19), but -. Is that someone -- Okay . -- internally, or is that from Qognify? — No. So, that -- yeah - that’s the Qognify technical support engineer. a So, you reached out to Qognify and to get assistance on this matter, and they responded on these are the steps? + Mm-hme : All right. And the next step, the next comment I have is by I a on August 14th, 2019. 8:02 p.m. this is approximately six days after the incident. So, RUSTE HE called us on Thursday, August 8th, stating that he had two bad drives in his raid unit. Off the Nice Vision Pro, Unit NVR (Phonetic Sp. *00:10:57). We advised him to get replacement drives. Once they are replaced, they should start to initialize, to become available for the raid PRR RR SwWwKN PCW OHMS SwMN Pe RPRRR oN Du ee od Wr Ow mre oe Re CWO HM fWwrNP 14 Okay. So, and that’s why -- a. So, they rebranded, basically, the new systems that they were putting in. a. Understood. Okay. And then, the assignment was created at 3:36 p.m. There is a comment by - that’s you, right? - at 3:38 p.m. And -- : Yeah. -- it looks like someone addressed it to you. It says, “Hi, Unable to locate anything official. The basic steps are as following: One, set the raid level to none, and save. It will restart it with all drives being J. Replace any faulty drives. Two, set the raid level to five, and save. It will restart and begin initialization. The password is 1111. Four ones. And if I recall correctly, once the raid te is created, you will need to restart Windows, and create the proper partitions. I'l] keep looking, but_that should get you going. Best regards, (Phonetic Sp. *00:10:13), Senior Support Engineer. — Okay. array. [ER GY did not have drives readily available. He checked with his local CSM." What _is CSM? Should be computer specialists manager -- That’s -- -- I believe. -- that’s internal for the I was 16 : Yup. Okay. That's what their IT manager, and the IT department, I think. : Thank you. “He checked with his local CSM, to see if they had any spare replacement drives. Once he located replacement drives on Friday, August 9th, he did not have access to the DVR room, to replace them. He called SigNet for some phone support on Saturday, August 10th, when he gained access to the DVR room. He attempted to replace the drives, and they started to rebuild. During the rebuild process of the drives, the drives were required to be taken out of raid, on DVR- 2. Once the drives were removed without proper EFTA00064253

--=PAGE_BREAK=--

RR rPFCowW OND SwhN re RPRRR Ww = Wh RR SD 18 19 20 21 22 23 24 25 RR SwWOHNDN FWwrNP RPRRPR RRR SD SwWwNPe ee ee ed eS WwrN Pr CO wc nm wm 17 shutdown of the recorder, the video database becomes corrupted. Typically, any time the raid is - raid on - raid five configuration loses two drives, the raid needs to be rebuild, and all data is wiped from the raid.” Do you recall making that comment? a. Yeah. That sounds about right. That sounds what I would have stated. Okay. So, I'm going to go back. Can you explain to me the phone call that you got from on August 8th, if you recall what he stated to you on August 8th? Yeah. I'm trying to think. I'm trying to -. So, August 8th, Was that a, like, a Well, yeah. well, that was a -. Saturday, maybe? + No. Maybe it was -. That was a Thursday. Thursday. Okay. It looks like, on Thursday, he called - August 8th - he called you, he reported the incident. You gave - possibly gave - him instructions on what to do. August 9th, he got replacement drives, but he did not 19 I was, but I was kind of local. So, he had asked me to reach out or, you know, basically work with him, work with Qognify. And so, that's what I was remembering from that, because I know, I remember specifically, I was on vacation on the weekend. And trying to reach out, basically, to, I want to say, like, our sales rep, (Phonetic Sp. *00:14:27), who worked, you know, for the Bureau, or worked with the Bureau of Prisons. He sold all their equipment. Reaching out to But again, I could be -. I could be wrong on the timeframe there. But -- : It's --. : -- either way, yes, I did work directly with J - as - at one point, on the case, prior to visiting the site. So, yeah. I was just trying to get that timeline right, because I don’t want to tell you that it happened this specific way you're saying it, and then it didn't. a No problem. And you mentioned that you were away with your wife on a camping trip. Do you know how long the trip RR ROW OHM fwrKP —— wr RPRRR oN Du MmNmenNrre rmrROow mre re WW = Ww RR ae ee PRR RRR Dw wr ed ool mel ro wo Mmmenmrn Ww Wr 18 have access to the room. That would be on a Friday. Then August 10th is when he called you back, and it looks like you -. The incident with Epstein happened, and he called you back. ——, Oh. Okay. Okay. Yeah, because I was going to say -. Let’s see. Yeah. I have a different recollection than I thought, because I thought, from what, and I want to say, maybe that incident started earlier, but maybe not. Because what I was, what I was recalling on that was, me and my wife were actually about, I think, let's see, 2019. So, that would have been -. Yeah. Me and my wife and my son were out at a cabin on a weekend get-away, and I remember an email, I believe that was from , saying something that he had gotten a call from —_ Now, that could have been after the initial reach out from him. That the drives were down. I think that might have been. So, I'm kind of questioning if reached out to me initially, or if he reached to MM, and then assigned that to me. Because MMMM, I believe, was also out on vacation, either that week or that weekend, as 20 was for? It was just a weekend. So, I think we might have left out on a Friday, you know, Friday afternoon, and then, probably came back, like, Sunday night. : So, it’s possible that you spoke to him on Thursday, August 8th, before you headed out for the camping trip? Possibly. Yeah. :_ You don’t recall? Yeah. I don’t - yeah - I don’t recall specifically. I do - and like I said - I do know, I did talk to him, at one point, about the drives, and that he couldn't - . Okay. So - yeah - that does clear it. Okay. So, that’s really -. Sorry. I'm just trying to piece it together. :_ No problem. : So, yeah. He did mention something about that he would check with -. So, that’s why I'm trying to think that it may have been the weekend prior to the 8th. Or not the 8th. But it would have been the 10th, would have been the Saturday. I want to say he reached out before then. Because I want to say EFTA00064254

--=PAGE_BREAK=--

rR CSCwWOmOANDMDS fWwNHP RPRRRR We WN Re RRR CoN DD a de ood SWwWNr Ow nm w WOoOntDWNSwWwrP 16 17 18 19 20 21 22 23 24 25 we were out on the weekend, before that. So, hold on. Let me just clarify. Yeah. So, let me. I'm looking at this now, I. This is So, on August 8th -- + Uh-huh. : == that’s when you received, it looks like, a message from that individual. Who is it? So a. Yes. -- saying, “Hi, Hi. Unable to locate anything official. The basic steps are as follows.” So, it looks like, maybe somebody would have reached out to you before. So, in fact, that was the August 8th comment. And then -- + Yeah. : == that was something that says comment made by you. And then -- + Uh-huh. : == the next comment made by you was actually on August 14th, 2019. 23 Yeah. I know it was basically right around this case time. So, it could have been the prior, or it could have been that weekend. yeah. That's really -. I know it’s tough. It's been a couple years. So, remembering the exact details is kind of hard. You know, it may have been The 9th. So, you said I on the 8th? : Yes, : Or I got a reply from him on the 8th. Yeah. Because I want to say we left out on the 9th, and we were at the cabin on the 9th. And I want to say that me and HEB were maybe communicating back and forth via email. And trying to kind of figure out, you know, what drives he could get, or whatever. So, maybe, maybe it all happened right in that weekend. Because I do remember something about hearing that, you know, the incident happened there. Okay. Uh-huh. -- re-reading this. It But that Friday night. was talking to Yeah, and I'm -- PRR RR SwWwKN PCW OHMS SwMN Pe RPRRR oN Du ee od Wr Ow mrNm oe Re CWO HM fWwrNP 22 : And what you're stating here is, it’s saying, “Sg = called us on Thursday, August 8th, stating that he had two bad drives.” So, it doesn't specifically say he called you. Do you know if he would have called you direct, or he would have called someone else with SigNet? That's why I was saying. I think he may have called initially. And then, had asked me to basically work on that case because, like I said, I think waS out on vacation, and that’s why he passed the case to me, asking me to work with and Qognify to try to see if we could get those replaced. Let me look at the year here. I'm just trying to pull it up. — And you mentioned there is a possibility you were away on a camping trip the weekend prior to that. MEM: So, the 10th. Yeah. 1 mean, I could try to verify that, if that’s, like, an absolute -- I could see. : No, no. : == necessity. 24 doesn't specifically state in your comment, on the 14th, that you actually ever spoke with him. It just says -- : with i. : -- it - yeah - with It just says that he called us on the 8th. And then, it talks about, you talk about how, on the 9th, he didn't have access to the DVR room, to replace them. And then, it says, he called SigNet for phone support on Saturday, August 10th. So, do you know -- + Okay. : == if you were away, I'm assuming this information was passed to you on August 14th, when you made the comment? Would that be accurate, since it sounds like you were aware that weekend? Well, Ido -. So, I do remember talking to him, at some point, and him -. Well, I don’t know if I talked to him or emailed -- : Okay. : -- but basically, I remember, I remember him saying that, like, he was trying to find drives. He didn't have any, EFTA00064255

--=PAGE_BREAK=--

rR CSCwWOmOANDMDS fWwNHP RPRRRR We WN Re RRR CoN DD a de ood SWwWNr Ow nm w RR SCwWOnHtDUN SwWwrP 25 so he was going to check with the CSM, to see if they had any on site. Then, I believe he found them, and then, he said, and he called, he either called me back, or emailed, and said, hey, the room where the NVR is locked, and it’s our internal investigation office, and they have the keys. I don’t have access to that. So, I'm going to have to wait until such and such. It was probably Saturday. I think I stated there that he could actually get access into the room, to go try and replace the drives. Okay. So -- Sorry. You just -- : == don’t know if that’s August 8th or August 9th, the day you left for your trip? No. I was actually trying to see if I could pull up a Outlook data file, because I believe I saved some emails. Oh, that would be awesome. And then, specifically -- I'm just like that. 27 like, I know that he initially contacted us about the drives being out. And I want to say, it took -. I remember it -. I thought it was at least a couple of days of the process of trying to go back and forth with him. And I don't know if it was me or [MM, basically saying, hey, we've got to get drives. You know, they don’t sell them anymore at Qognify, I don’t think. Because they are basically non- production drives, and we would have to get refurbished drives. And I think was looking on, like, eBay, and, you know, a couple of our sources, to find some. So, I don't know exactly, did that comment say that he had drives on site? : So -- Or did he order them? -- that -- Because that’s the other question -- -- it looks -- -- is, did he not have them? -- he didn't have access to them. PRR RR SwWwKN PCW OHMS SwMN Pe RPRRR oN Du ee od Wr Ow mrNm oe Re CWO HM fWwrNP 26 -- yeah. No. That would be great. Specifically -. a. I want to even say I saved all of my tickets from SigNet, but I can't promise that. Oh, that would be huge. And I think going back, as far as, like, July 29th, if you don’t mind, because that's when we think that the drives may have actually gone down. : July 29th? Yeah. I mean, I don't know that they contacted you or not, but that would be the follow up question, after we figure out what happened on the 8th and 9th. It would be, how far back did you know that these drives, or (Indiscernible *00:20:50) you've been working with , to replace these things, because it looks like they may have gone bad on 7/29/2019. : 29th. So, that would have been about. That sounds about -. That sounds about_right. :_ Why do you say that? : Well, because - again - 28 HE. okay. So, that may have been the gap, from the 29th. Well, it does say -- Indiscernible *00:22:07). -- so, after the August 8th thing, it says, “He checked with his local CSM to see if they had any spare replacement drives. Once he located replacement drives, on Friday, August 9th, he did not -- : Okay. : == have access to the DVR room to replace them.” MMM: Okay. So then, he did have them on site. Okay. : At least that’s -- : That's what it sounds like. : -+ that's what it sounds like. Yeah. : Yeah. :_ Okay. So, I'm assuming that means that you wouldn't have sent them. Do you know who the CSM was, by chance? I can try to look here. I'm looking at our database. I probably EFTA00064256

--=PAGE_BREAK=--

RR rPFCowW OND SwhN re RPRRR Ww = Wh RR SD 18 19 20 21 22 23 24 25 RR SwWOHNDN FWwrNP RPRRPR RRR SD SwWwNPe ee oe od eS WwrN Pr CO wc nm wm 29 shouldn't have all this information, but -. It helps us a lot. We appreciate it. Okay. Maybe, yeah. I don’t pass it out to, you know, other companies, but stuff like this, I do find it useful, if it -. Hmm. Okay. I've got -. Hey. There is a camera outage. Oh. I've got a camera outage report. : What is that? : But I don't -. That shows from 8/16. These are all looking at August 16th. Which could have been the time that I actually was on site. + Okay. : Yeah, we would be looking specifically 8/10, and prior. Okay. Let me see what I’ve got. Do I have screenshots? 8/16. 8/11. Okay. Let me go back and see. Let me look at this report and see if it gives me, like, a date of when this was exported to, because that could be something, if you guys need it. : I don't know if you guys : No problem. -- information here. No. We appreciate it. Thank_you. a Oh, no problem. Hopefully, I can find something that helps a little more. Okay. So, I’ve got -. All right. Let me see if I can look (Indiscernible *00:25:28) Outlook and see, if it will load. All right. So, files. Open. And export. Let's do an import. Oh, import from another program or file. Oh, that is a ODF. Yup, right there. Let's see. Allow duplicates to be created, replace to (Indiscernible *00:26:04) items. Imported. I have no idea. But I'll screw my work email up. Crap. HE: No problem. Can I - while you're doing it, while you take a look - can I ask you a question? : Yeah. : This is, in here, it states, “During the rebuild process of the drives, the drives were required to be taken out of raid, on DVR-2. Once the drives are removed without proper shutdown of the recorder, the video RR ROW OHM fwrKP —— wr RPRRR oN Du MmNmenNrre rmrROow mre re WW = Ww RR ae ee RPRRR Ww Wr MRRP RRR Pow OAS Mmmenmrn Ww Wr 30 have all that or not. We don’t have the -. This is -. This is between SigNet employees. Right? This is an Excel document, but again, but I've got to see what date it shows on here. Because they kind of hide it in the columns. I'm trying to see if it has a date. This is basically just a camera outage report. So, I don't know if you guys need that. And if that, again, I don’t know if that was ran from him, and we got that. But you said this was on the 16th? That one shows that it was edited on the 17th, but it - like I said - in the outage report, I thought that they give you a date when it was actually exported from the system. + Okay. So, I would have to look at the order. But yeah, let me go back to your original. You're looking for the email traffic and everything. So, let me see if I can find that. Oh. Hmm. Oh, what's that? Sorry. I'm looking through gigs and gigs of -- 32 database becomes corrupted.” Is that your understanding of what happened, from your conversation with ? : I'm- so, yeah - I'm trying to figure out when that was happening, because I do know that, at some point, the FBI came there on site, I think prior to us showing up. And I want to say that the recorder was rebuilding, and they said that they had to take the equipment out. And that’s what I'm -. That's what I'm trying to piece together, if it was then that they took it out. Or if it was - Yeah. Because I don’t, I don't really make any sense of him putting them in and then pulling them out. : Okay. : Yeah, because I would think, once he puts them in, I mean, he would leave them to rebuild. And I think I would have probably made that comment, because he said something the FBI coming in, they need to confiscate the equipment. And then, and I'm pretty sure I told him, I said, well, you don’t want to, you don't want to unplug those while it's rebuilding because if it, you know, EFTA00064257

--=PAGE_BREAK=--

RR ROW OHM SWwrNP RPRRR We Wr RR SD 18 19 20 21 22 23 24 25 RR SwWOHNDN FWwrNP RPRRPR RRR SOW WNP ee ee ed eS WwrN Pr CO wc nm wm 33 basically stops, you have no pick up point to start rewriting. It's going to start all over and then, you’re going to have gaps where you're going to be missing recordings. a: Now, so, do you believe, then, for whatever they did, that erased all prior data, anything that was saved on there would have been erased? If - yeah - if they pulled, if they pulled power, and pulled the units out, then yeah. I mean, it would have wiped, wiped the raid, I would think. : So -. : Now, if we have information that the servers were already down, since 7/29/2019 -- + Mm-hmm . : -- would have those servers been recording up until the date that they tried to rebuild them anyway? That depends, because I don't remember if the -. I think those servers, the way, the older servers, I believe they were set to a raid five. Let’s see. Those are the pros. So, I want to say that is 35 the other drive. If that one drive went down on 7/29/2019, would those cameras that were on that drive had continued to have recorded on the other drive, or would have they stopped recording, and only the other drive that was good, that housed the other half of the cameras, have recorded? Well, sorry. So, it really doesn't work like that. But yeah. I mean, yeah, in theory, you would want it to work like that. But essentially, the raid will spread the data over all drives. Oh, I'm going to stop -. explain what_a raid is? a So, a raid is a group of drives. Can you Is that, like, a DVR system? What's that? Is that, like, a DVR system? : Yeah. I'm sorry. Yup. Let's - yeah - let’s go back. So, the DVR system recorder. So, normally, their old set up, I believe, had a - and that would be a PC or a computer, like a server. A server. Like, a rack PC server. That would contain the 0S. PRR RR Se ee a RPRRR COND mreNyre rmrROow mrer WW = Ww Wey DHfwrP RR eo PRR RRP RRR OOD fwr mre reo MmmenNn Ww Wr 34 a raid five, and they loaded, basically everything was kind of compiled together, on the same raid in those servers. So, that would have put the 0S, and the video storage on the same raid array. But they partition out for the 0S. So, if they lost one drive, then that would be okay. With a raid five. If they lost two drives, then -. So, if they would have lost two drives simultaneously, they would lose everything. The recorder would go down, and you wouldn't be able to get into the OS. From what I understood. So, it’s possible that he lost one drive and called us. Initially. Was trying to replace that. And then, when, you know, basically, another one went down while the other one was rebuilding. That could have been possible. And that could explain why the 0S didn't crash. So, on that note, so, our understanding, there is, like, let’s say there is 150 cameras in the MCC. + Uh-huh. We were told about half of them go to one drive, and half of them go to 36 Okay. So, yeah. Never mind. Let me take back what I said about the 0S. Because now, I'm remembering their set up. I believe they had -. The way the old ones were, is they had a separate computer. They called the Nice Vision Pro units. So, that, I believe, had two drives in it. So, that would be a raid one redundancy. So, that -. §0, again, the raid is a group of drives for storage. + Okay. And what a raid allows is, so, like, in your case, you were just talking about if you had two drives, you had, you know, half the cameras recording the one, half the other, to the other one, if one went down, you would technically still have all the other cameras on that drive. So, what the raid does is basically, it allows you to take - say you don’t have that scenario, of losing half your cameras - the raid allows you to put, you know, there is a number of drives that it requires to have for certain raid levels. But basically, it allows you to, like, let's say four to six hard drives. It groups EFTA00064258

--=PAGE_BREAK=--

RR rPFCowW OND SwhN re RPRRR We Wr RR SD 18 19 20 21 22 23 24 25 RR SwWOHNDN FWwrNP RPRRPR RRR SD SwWwNPe ee ee ed eS WwrN Pr CO wc nm wm 37 those together. So now, you - then the recorder takes the video, the video recording, and starts to spread it out over all those drives, and it basically makes a mirrored copy. So, if one did fail, it still can go back on the other drives, and access the copied files, or the mirrored files. + Now -. So, how -. It's for the purpose of redundancy, in case you did lose a drive, you're not losing, you know, certain data that was just written on that drive. Because then, you have gaps in the recording. So, a raid can also be referred to as DVR system. Right? Now, if a DVR system, they have two DVRs. If DRV-2 went down completely, right? It stopped recording. Should it have -- Mm-hm . : == stopped recording on DVR- L No, because they are two They are two separate -- : Systems. -- machines. separate -. 39 got correct credentials. Okay, you're allowed to view that camera. And then, it sends the feed -- + Okay. : == to their client station. So, yeah. In short, the AMS would normally have alerts, in an application, I believe it’s - it's not Investigator - it’s called Supervision. + Mm-hmm. There was five different applications for Nice Vision. Supervision would keep all of the, like, the hardware, and I think most software events, in that application. And I think you could control, basically, if you had pop-ups messages or anything. But as far as if you didn't go to that server physically, and check, from what I know from the Bureau, they did not allow those servers to send email notifications out. : So-. Because that would have required them to load with an email client, on the server, and then, you know, basically act like it’s, you know, someone’s account on that RR ROW OHM fwrKP —— wr RPRRR oN Du MmNmenNrre rmrROow mre re WW = Ww Wey DHfwrP RR eo PRR RRP RRR Oo OUD wr mre reo Mmmenmrn Ww Wr 38 Okay. And how would they have known that the DVR system went down? Was there any alerts that come up in Nice Vision, anything that comes up to them? —. Yeah. So, it would. It would normally come up on the -. It's called the AMS, or the Application Management Server. And that’s, like, the primary unit that controls the whole video system. And then, you add recorders underneath that AMS. Depending on how many cameras you have. That's how they kind of allocate recorders. So, if you have 100 cameras, okay, let’s put 100 cameras on this recorder. Let’s put 100 more on the second one. So on and so forth. And then, Application Management Server basically allows the users to authenticate and log into that system, from any client in the facility. Or outside if you, you know, if they've managed to network that way. But yeah, the Application Management Server is kind of, like, the gateway to let people in, to view the video. And then, that also manages the traffic of, okay, you want to see this video and this recorder. Okay, you've got, you know, you've 40 server, to send those email notifications out to other people in the facility there. And as far as I know, up until I left, they didn't allowed that. : So -- So, you had, you would have to go the physical server, to see those notifications. Or you would -. Well, I take that back, because you could go on the client and log into Nice Vision. And then, check the Supervision. But it's not going to send you, like, an email notification. So, I want to clarify this for this. If you log into Nice Vision, let's say you're reviewing the video footage -- Mm-hmin . : -- if you log in, there would have been an alert, saying that these cameras are not recording? Yes. Now -- Normally. I don’t -. Now, I don’t know if there would have been a pop-up. I would say, to be safe, you would have to actually go into that Supervision app. So, If you -. Yeah. EFTA00064259

--=PAGE_BREAK=--

rR CWO D SWwrNP RPRRRR We WN Re RRR CoN DD a de ood SWwWNr Ow PRR RPE RR Re rm CON Dw SW N rR OW ON DW Sw Nr “ a a ee ond We wWwrr Ow 41 like I said, there was multiple apps, and most of the time, from what I see, you've got -. So, there is a control app that’s normally for, you know, you can play back video and see live video in that application. And then, there is an app called Site Builder, and that’s basically letting you set up the site. But the Supervision app would be where you check on the status of, okay, if your recorder is offline, if you've got a bad hard drive, things like that. So, that’s where you have to go, to see that. So, I don't know if they had pop-up alerts on there, and you, like I said, I think you could set those up to pop- up on your machine. But again, that would dependent if you're logged in to Nice Vision. And you have those pop-up alerts turned on. Otherwise, you would have to log in, go to that application, and look at the list of alerts -- : To see it. Okay. : == to see what was going on. Or, if they tried to review video, they would realize the fact it was not recording. B HE. And they didn't, in this case? No. All right. So, regardless if they pulled the drives when it was being rebuilt on the 10th, if the server went down on the 29th of July, nothing would have -. They wouldn't have been able to extract anything from 7/29 to August 10th, anyway. a. Yeah. If the whole server went down. Yup. : And just to clarify, I think my understanding is, when the FBI got in there on Saturday morning - - Mm-hmm . : -+ BBD already had pulled out two drives. Okay. And he was rebuilding it. : Okay. So, if they walked in, and if - let's just say FBI followed the proper protocol, they shut it down properly, they =— ROW OHMS fwrNP —— wr RPRRR oN Du ee od Wr Ow mre oe RR ae ee RR i) MRRP RRR RRR POoOwCmBADH ew Mmmenmrn Ww Wr 42 a: That's the other + Okay. Well, that goes back to, I don’t think that you actually ever answered this question. I think we got kind of diverted. Was -- + Sorry. : == you were talking about the half of the video that were on the one server, if that server went down, would have that other server, then, captured it? Where you're saying the mirrored it. Would have they have captured that video, that, you know, the server went down on 7/29/2019, the other server is good. Would those videos have been saved somewhere, if they were still a live feed was going? Right. way. Okay. So, you're saying, if the server two went down, but server one stayed up, you're asking, could you retrieve the video from server two on server one? Correct. No. Because you have to have a redundant server backup. ulled it down. And is it possible, when — went to replace the drives, when he replaced the drives, he could have wiped out whatever was saved on the drives? If - yeah - it just depends if they showed if they were bad. So, or if they were totally, like, wiped. And non- retrievable. 44 All right. Because I thought_-- + (Indiscernible *00:39:07). -- what you were saying - : Sorry. Go ahead. -- was that J was rebuilding them -- : Yeah. : -- and that’s what he should have done, was to replace those drives, but then, the FBI pulled the ones that he was replacing. Is that not correct? That he was rebuilding. : I don't know if they pulled the drives, or if they pulled the whole recorder out. EFTA00064260

--=PAGE_BREAK=--

RR ROW OHM SWwrNP RPRRR We Wr RR SD 18 19 20 21 22 23 24 25 RR SwWOHNDN FWwrNP RPRRPR RRR SOW WNP ee ee ed eS WwrN Pr CO wc nm wm 45 HE: They pulled the whole system. And my understanding is, when they left the MCC, they took the whole system with them. a. Okay. Then that, I think that was when I actually showed up on site the following. And then, you guys set up a new system for them, right? a. Yes. Yeah. + Okay. : -- I know that FBI met me there. Yeah. They showed up when I was kind of getting the new system set up. And then, they kind of jumped in and they were doing stuff, and asking me questions about a, you know, check to see where those video gaps and stuff like that. Okay. So, I'm starting to remember a little bit. On the drives that you’re talking about, so, I want to say that we actually suggested to him to pull all of the drives out, and try to rebuild it, because I think that was our normal protocol. If, let’s say you had a bad drive, sometimes on those older Pro units, you can Because I know replace the drives, and they started to rebuild. During the rebuild process of the drives, the drives were required to be taken out of the raid on DVR-2. Once the drives are removed without proper shut down of the recorder, the video database becomes corrupted. Typically, any time the raid on a raid five configuration loses two drives, the raid needs to be rebuilt, and all data wiped from the raid.” Does this - based on your comment - does it mean that - your understanding is - that he went in, tried to replace it, and he pulled the drive without the proper shut down of the recorder? Wait, so, you don’t have to shut down the drive if - or, you don't have to shut down the recorder if you're pulling a drive out. Like, one drive. And it's called a hot swappable (Phonetic Sp. *00:42:11) drive. + Yeah. : So, what that means basically, you can pull it out, re-insert it, and let it rebuild. But there is a limit to how many you can do. Because you can't just say, okay, I’ve got two bad drives. Lightbulb PRR RR Se ee a RPRRR COND mreNyre rmrROow mrer WW = Ww Re CWO HM fWwrNP R Re PRR RRP RRR OOD fwr id o 46 pull one out. As long as you don’t have, like, two failed drives, like I was saying on our range five. : Okay. : Because if you have two failed drives, you're not going to do anything to fix it. But if you had one, you can pull one out, and refeed it, and it will give you a status on the front of that recorder, saying it’s attempting to rebuild. So, I'm starting to recall that we may have told him to pull one out. : Okay. : And let it rebuild. : That would be the same -. That would be based on the instructions came over froma ? : Yes. And so, I think what I'm recalling is, I think we had him pull one out, try to rebuild. That failed, I think. And then, I think he told the other -. He may have pulled the second drive out, that was showing bad, and tried to rebuild that. : And then, your comment, your comments exactly on this is, “He attempted to 48 goes out. And try to re-insert them, let those build. Because once you do that, if there is a possibility of the one of the two being good, and it’s writing somewhat, you pull those both out, you’re going to crash your system. So, so, and those drives, when you rebuild them, it takes - I want to say it takes at Jeast eight hours. So, I do remember him replacing one, and I want to say it was an overnight process. He pulled it out. Put it in. It looked like it started rebuilding. And I think he came in the next day, and it failed. I don’t know if he tried it again. Or he may have tried that second drive, then, at that point. Tried to pull that and let it rebuild. And that may have been the point where the FBI, maybe, come on site. And said, hey, we’ve got to, you know, confiscate it or whatever. I don't know, at that point. : Yeah. : I don't know. : And that's what my uestion was. Is this all talking about , his actions, or is it talking about both his actions, as well as the FBI actions of EFTA00064261

--=PAGE_BREAK=--

rR CWO D SWwrNP RPRRRR We WN Re RRR CoN DD a de ood SWwWNr Ow PRR RPE RR Re rm CON Dw SW N rR OW ON DW Sw Nr “ a a ee ond We wWwrr Ow 49 them pulling it, while it was trying to be rebuilt? Are you able to tell by what was read? So, you can't send me that comment, right? a. No. Well, I'll just keep on reading it to you. It says, “He attempted to replace the drives, and they started to rebuild. During -- + Oh. : -+ the build of the drives, the drives were required to be taken out of the raid on DVR-2. Once the drives are removed without proper shutdown of the recorder, the video database becomes corrupted.” So, my question there would be, like, is that new sentence - “Once the drives are removed without proper shut down” - is that anything that you’re talking about with regard to the FBI removing them without proper shut down, or are you still talking about what did? : I would say what the FBI because I wouldn't -. I don’t think I would have put “required to be.” Did I say, : I thought that was (Indiscernible *00:45:26). + Okay. : So, that’s, like, you're talking about him rebuilding it, and then the FBI pulling them while they were being rebuilt? + Yup. Yeah. Okay. That's - yeah - that’s what and what I would have -- Thanks for clarifying -- -- yeah. -- that for us. : Yeah. I'm going to keep moving I'm understanding, because -- Sorry. Sorry it took so I was just, like -- -- no, no, no. -- uhh. No, no. I guess the main question is, is there anything that I did, that was wrong, or did he, you know, was he doing everything that he could have done to rebuild this thing, but then the FBI came and long. RR ae ee RR i) MRRP RRR RRR POoOwCmBADH ew Mmmenmrn Ww Wr 50 “Required to be taken out,” or “Required to be removed"? Yeah. So, I'll just read it again. + Okay. “He attempted to replace the drives, and they started to rebuild. During the rebuild process of the drives, the drives were required to be taken out of the raid on DVR-2. Once -- + Okay. -- once the drives are removed without proper shutdown of the recorder, the video database becomes corrupted. Typically, any time the raid on a raid five configuration loses two drives, the raid needs to be rebuilt, and all data is wiped from the raid.” WM: Okay. So, yeah. And listening to my statement of, “During the drives being rebuilt, they were required to be taken out.” Yeah. I wouldn’t have stated that they would have been required to be taken out. Because there was nobody requiring him, other than the FBI, to take them out. 52 pulled it, and lost any chance of potentially recovering things? a. Yeah. From what I can tell, he was - yeah - going through the process of what we instructed him to do, pull the drive out, insert, then let it rebuild. And yeah, I think he gave it plenty of time on the first drive. Like I said, I think, I think, from what I remember, that was an overnight process. And so, that may have been the Thursday, or something, maybe. Again, prior to that incident, I believe -- Okay. -- where he would have inserted it, let it rebuild, and came back in the next morning, or hours later, and realized that it had failed. And then, yeah, then that second drive was probably where he went next. Well, just for clarification -- : (Indiscernible *00:46:47). -- on that, prior to the - in that same statement - you said, you August 8th, he contacted you regarding the two bad drives. And then, you advised him to get EFTA00064262

--=PAGE_BREAK=--

rR CSCwWOmOANDMDS fWwNHP RPRRRR We WN Re RRR CoN DD a de ood SWwWNr Ow nm w RR SCwWOnHtDUN SwWwrP 53 replacement drives. It says, “Once they are replaced, they should start to initialize, to become available for the raid array. [a did not have drives readily available. He checked with his local CSM, to see if they had any spare replacement drives. Once he located replacement drives on Friday, August 9th, he did not have access to the DVR room to replace them. He called SigNet for some phone support on Saturday, August 10th. when he -- + Oh, okay. : == gained access.” So, it sounds like -- : Okay. : -+ it all happened on the 10th, or he replaced them -- Yeah, because he -- -- and -- : -+ didn't have access. He didn't have access in -- | gl -- and then -. -- there until the 10th, right? Yup. Right. So, he started rebuilding them in the morning, and then it 55 at the same time, it might have contributed to the failure, and also the fact that, if he has two drives rebuilding, and the FBI came in and pulled it out in the middle of the rebuild, it could have also contributed to the failure? That is correct. So, yeah, and that’s what I was questioning, is if the statement said that he had two drives basically out of the system at that point, and if there were two drives out, then, and nothing was replaced, if there was two blank spots, then yeah, then the system would have already been failed. As far as the video sort side. : Okay. But again, yeah, I don’t know - again - if he had four total drives, two old ones, two new ones, and he was kind of in the process of that when they came in. :_ But when -- And I don't know the detail -- my understanding is when - -- (Indiscernible *00:48:54). PRR RR SwWwKN PCW OHMS SwMN Pe RPRRR oN Du ee od Wr Ow mrNm oe Re CWO HM fWwrNP 54 sounds like the FBI came in, and then pulled the drives while they were being rebuilt. Does that sound right, based upon on your comments? I - yeah - I think so. Yeah. Yeah. :_ And just to clarify, too. Yeah. My comments are going to be a little more solid than my memory, I think. Yeah. : At this point. : Yeah. If, based on these right, and if -- : Yeah. : == based on the FBI, my understanding is, when they came in, two drives were pulled out. And there was two drives that were replaced, and it was going through. You mentioned before that, if he pulls one drive out, it’s okay, but if he pulls out two drives, at the same time, it could have possibly corrupted everything. > Mm=hmm : All right. So, it’s a possibility that, if he did pull out two drives 56 HS. -— they came in, they took everything, there were two old drives that were sitting -- : Yeah. : -+ outside of the housing, two new drives sitting inside, that -- -- he could have replaced that morning. : Okay. Gotcha. : So-. : So, yeah. I don't know at that process, or, at that point, if he - yeah - basically maybe pulled, you know, maybe he had attempted both old ones. : (Indiscernible *00:49:15) SigNet. WM «.Maybe they failed. And then, he said, okay, I'm going to pull those. This is all speculation, at this point, but yeah, he could have. If they both failed at that point, then yeah, it would have been screwed anyways. :_ Who actually -- Because he -- comments , EFTA00064263

--=PAGE_BREAK=--

rR CSCwWOmOANDMDS fWwNHP RPRRRR We WN Re RRR CoN DD a de ood SWwWNr Ow nm w RR SCwWOnHtDUN SwWwrP 57 | &§ -- go ahead. Sorry. : -- he had already lost the two drives, at that point. So, White House, at SigNet, would have walked him through this process? That_would have been, probably between me and —. But you both were on vacation, technically. Right? : Yes. : I think both of you were on camping trips. So, would -. a. And I want to say -. So, ou had mentioned, there was a comment from = And so, he had actually started with SigNet, I believe it was February of 2019. So, yeah. He was a former Bureau employee. He was a-. What's -? com tech (Phonetic Sp. *00:50:04), (Indiscernible *00:50:04) city. And then, we brought him on to work with SigNet because he knew, he knew Nice Vision pretty well. HM: Okay. You think he might have -- So -. 59 -- that’s all. That was the There is nothing else only comment over there. in there. They didn't give you any right? :_ No. I'm going to look and see if I have more tickets. I don’t know if I saved the tickets, or if I just saved contacts, but -. other tickets I'm going to ask you that, if you can get everything together, right? Pl Mm-hmm : Everything you have on this tickets, any communications, things like that, can you forward that over to me? : Yeah. : We actually have another interview starting at 10:00. So, I'm going to wrap it up quick. : All right. Yup. : We're not trying to push you Just had a question for you. + Mm-hmm : Do you recall, prior to off. PRR RR SwWwKN PCW OHMS SwMN Pe RPRRR oN Du ee od Wr Ow mrNm oe Re CWO HM fWwrNP |S -- worked with him? : That's kind of what I'm wondering because, that kind of started to ring a bell, since, if me and were out, BBM basically pushed it to me. And I don’t think I had access to, like, our -. Something was -. It might have been, like, my internet service, or phone service, or something, because I, I mean, I was out in the middle of nowhere. At that point. So, I may have tried to text him, or, you know, if we went into town or something, and I contacted him, and said, hey, you know, this is what's going on. Can you get a case started? That may have been what I had done. So, he may have had a little bit of interaction with , as well. Okay. 1°11 reach out to him More at least -- -- about that, too. --, now was there -- I'm look -. -- any additional comments? No. That’s all -- About him on that case? 60 August 8th - right? - were there any issues that you were aware of, with the MCC cameras? a. Prior to August 8th. No. So, whenever - again, I don’t know if the -. So, that’s where I was unclear on the weekend, basically. But I think we may have clarified that, that everything happened on the 8th, through the 10th. So, I think, prior to the 8th, I may have known about - yeah, I mean - I may have known about_issues through correspondence with [M. : Okay. : He may have been working. Yeah. I don't know. But yeah. And I would say, August 8th is when I definitely picked up the case. Understood. Okay. So, but you were not aware of any other issues, prior to it? > No. : Thank you for taking the time to talk to us today. Is there anything that you think that we’ve missed to ask, or anything pertinent that you think will be useful for our investigation? EFTA00064264

--=PAGE_BREAK=--

rR CSCwWOmOANDMDS fWwNHP RPRRPRPRRR SOW SW N Re ee ee od Oe el nm w 61 I don’t believe so, at this time. Yeah. But if I can think of anything, I can send you some information over, but -. —. I appreciate that. You have my email address. Anything you have, if you can forward that over to me, I would really appreciate it. Okay. + Mm-hmm. Yeah. I'll take a look here in a few minutes, and see if I can find some stuff. Thank you for taking the time to talk to us today. : Yes. And -- All right. Not a problem. -- I'm going to end the interview. The time is 9:55 a.m. on September 22nd, 2021. This is Special Agent , and the interview is being ended. CERTIFICATE I hereby certify that the foregoing pages represent an accurate transcript of the electronic sound recording of the proceedings before the Department of Justice, Office of the Inspector General in the matter of: Interview of CE, Transcriber EFTA00064265