U.S. Department of Justice =e United States Attorney Southern District of New York The Silvie J. Mollo Building One Saint Andrew's Plaza New York, New York 10007 November 25, 2021 BY ELECTRONIC MAIL Christian Everdell, Esq. Cohen & Gresser LLP 800 Third Avenue New York, NY 10022 Laura Menninger, Esq. Jeffrey Pagliuca, Esq. Haddon, Morgan and Foreman, P.C. 150 East Tenth Avenue Denver, CO 80203 Bobbi Sternheim, Esq. Law Offices of Bobbi C. Sternheim 33 West 19th Street-4th FI. New York, NY 10007 Re: United States v. Ghislaine Maxwell, 20 Cr. 330 (AJN) Dear Counsel: The Government expects to offer testimony fro | | of the Federal Bureau of Investigation’s (“FBI”) Computer Analysis Response Team (“CART”). As noted in the Government’s September 15, 2021 letter, although the Government believes that fF testimony will not require admission through Rule 702 of the Federal Rules of Evidence, the Government provided expert notice. In an abundance of caution, the Government is providing additional description of | anticipated testimony. The Government anticipates that fF will testify regarding the forensic examination of the devices marked for identification as Government Exhibits 54 and 55, and his determination that those exhibits are clones. He is expected to testify that a clone is an exact copy of one piece of media to another. a is expected to explain that he connected Government Exhibits 54 and 55 to a write blocker and subsequently imaged, or made an exact copy, of the exhibits. The Government anticipates that | will explain that the images of Government Exhibits 54 and 55 are exact copies of the original devices because he ran a hash, or mathematical algorithm that uniquely identifies data, on the original devices and the images, which are identical. EFTA00156626

--=PAGE_BREAK=--

Page 2 The Government further anticipates that FY will testify that Government Exhibits 405 and_ 419 reflect registry software information for Government Exhibits 55 and 54, respectively. Pt will explain that such registry software information includes several fields, including registered organization and registered owner, which are user input data. He is expected to explain that Government Exhibits 405 and 419 were generated by Access Data AD Lab. The Government further anticipates that Fo will testify that he examined certain exhibits contained on the devices marked for identification as Government Exhibits 54 and 55. In particular, he is expected to testify that Government Exhibits 412, 415, 424 are emails on Government Exhibit 54; Government Exhibits 418, 420, 421, and 422 are Word documents on Government Exhibit 54; and Government Exhibits 418B.420B.421B_ and 422B contain the properties, or metadata, for the corresponding exhibits. is expected to testify that Government Exhibits 418, 420, 421, and 422 were saved under a user profile named “GMax.” He is also expected to testify that Government Exhibit 417 is a Word document stored on Government Exhibit 55. a is expected to testify that that the metadata fields listed on Government Exhibits 417, 418, 420, 421, and 422 are true and accurate reflections of the metadata properties for those files, such as the fields listing the author, content created date, date last saved, last saved by, and last printed. | will explain that he confirmed the accuracy of metadata fields by running by Access Data AD Lab. In the course of doing so, a will explain that metadata is information about a file, such as the file name and when the file was created. He will also explain that metadata can be stored in a computer’s file system or embedded inside certain files, like Word documents. The Government also notes that discussed similar topics in testimony referenced in the September 15, 2021 letter. See Trial Tr. at 935-36, United States v. Hirst, 15 Cr. 643 (PKC) (describing metadata); Trial Tr. at 292-93, United States v. DiTomasso, 14 Cr. 160 (SAS) (describing hash values). He has also testified about similar topics in United States v. Healey, 11 Cr. 132 (SAS). As noted, the Government does not believe that the foregoing testimony encompasses the sort of “opinion” that requires expert testimony. Rather, a testimony is based on his first-hand knowledge and observation during his examination of the devices in question. To the extent he offers anything resembling an opinion, it is the product of reasoning processes familiar to the average person. While a possesses specialized knowledge by virtue of his training and experience, his testimony reflects his investigatory findings and conclusions, and is not rooted exclusively in his expertise. To the extent a testimony is characterized as expert “opinion” testimony under Rule 702, we note that his experience and training are described in his curriculum vitae, which was produced to you on September 15, 2021 bearing Bates number 3503-001. EFTA00156627

--=PAGE_BREAK=--

by: Very truly yours, DAMIAN WILLIAMS United States Attorney Assistant United States Attorneys Page 3 EFTA00156628