Expert witnesses in classified documents case expected to shine a light on damning digital trail

While attention was on the former president’s absurd claim of absolute immunity – even for ordering the assassination of a political rival – the Special Counsel’s office quietly put Donald Trump on notice with a series of filings in the Southern District of Florida.

The documents, placed on the docket in the classified documents case on Friday, outlined a number of expert witnesses the Government intends to call on to testify at trial and gave an indication of the breadth of the evidence against Trump and his co-defendants Waltine Nauta and Carlos De Oliveira. Nauta is a long-time Trump aide, accused of obstructing the investigation and concealing records at the former president’s direction, and making false representations to investigators. Carlos De Oliveira was a maintenance worker at Mar-a-Lago who is also charged with attempting to obstruct justice, concealing records and making false statements to the FBI.

Each document – six in all, appended to a notice filing – detailed the credentials of a number of FBI agents specializing in computer and cellular analysis, and digital forensics. Alongside the qualifications of the expert witnesses were explanations of what they’d be called to testify about.

Enter the Experts

Gabriela Mancini, an information technology specialist and digital forensic examiner with the FBI’s Computer Analysis Response Team (CART) extracted data from Nauta’s two iPhones. That data included three photos that contained classification markings.

The indictment included an image that Nauta had taken on December 7, 2021, showing a number of boxes on the floor of the storage room at Mar-a-Lago with their contents spilled. One of the documents visible in the image was marked “SECRET//REL TO USA, FVEY”, meaning that the information was “relatable only to the Five Eyes intelligence alliance consisting of Australia, Canada, New Zealand, the United Kingdom, and the United States.” 

According to the indictment, Nauta took two photos of the spill, though only one appears in the document. The image was sent to an individual identified only as “Trump Employee 2” with the message “I opened the door and found this…”. Tellingly, Trump Employee 2 responded “oh no oh no”.

Stacy Shahrani, an FBI Special Agent and digital forensic examiner with CART, conducted a forensic analysis of Nauta’s two iCloud accounts and of Trump Employee 2’s iPhone. She found two images with classification markings on the iPhone, sent from Nauta – one on October 27, 2021, and another, as referred to above, sent on December 7, 2021.

Henry Ha, a digital forensic examiner with CART extracted data from Carlos De Oliveira’s iPhone and conducted an analysis of the contents. Andrew Kochy, an FBI Special Agent with CART, carried out a forensic examination of the content and data that Ha obtained from the iPhone, where he managed to access “certain geolocation information, metadata, device information, evidence of user attribution, phone numbers connected to the device, phone contacts, call information, electronic messages, photographs, videos, messaging platforms, device location data, device power information, and corresponding time and location data of certain photos and videos.” The Government noted that he will testify “about his analysis of geolocation data artifacts extracted from the device that pertain to certain images taken on various dates.”

Johnathon Hoyt, an FBI Special Agent with the Cellular Analysis Team “created three reports that detail his historical cell site analysis of the call detail records” of Nauta and De Oliveira’s phones, showing where the devices were located when certain calls were made. The data shows that Nauta made a series of calls to De Oliveira while traveling between Mar-a-Lago and Bedminster, New Jersey, where Trump has another resort property, with De Oliveira also calling Nauta from the Mar-a-Lago club.

The Government highlights a series of calls between the two men on June 27, 2022, which relates to an episode recounted in the superseding indictment whereby they conspire to have the CCTV servers at the Florida club deleted and made a trip to the IT office in furtherance of that scheme.

David Loveall II, a senior computer scientist in the FBI’s Operational Technology Division, is expected to testify “as to the authenticity of certain publicly available videos, images, and social media posts captured from the internet— to include some of defendant Trump’s speeches, media interviews, and Truth Social posts—that the Government intends to offer into evidence during its case-in-chief at trial.” Two sections of the indictment are referred to in a footnote, both pertaining to instances whereby the former president made televised claims of his promise to “enforce all laws concerning the protection of classified information”, stating on a separate occasion that anyone mishandling such information should be “really ashamed”.  The two statements are an important aspect of the case, showing that Trump knew how national defense information should be handled and that he therefore had criminal intent when he took and concealed hundreds of highly sensitive documents at this Florida club.

The extent of the digital trail left by Trump and his co-defendants is obvious – each and every claim in the indictment appears to be backed up with irrefutable evidence. Perhaps in light of this, Trump’s team signaled in a filing in Florida this week that they’re about to start rolling out the same delay tactics they’ve deployed in D.C., noting that they intend to file “at least six motions to compel discovery from the Special Counsel’s Office”, some of which appear to be essentially the same as those filed on Judge Chutkhan’s docket. How far they get with this venture is an open question, especially with Judge Cannon at the helm. Perhaps their discovery demands would be better received if they’d engaged in reciprocal discovery – to date, they have turned over exactly nothing to the Government in this case.