Editor’s Note: This is the second in a series of posts that will be looking at all the unanswered questions concerning the criminal computer trespass charges that were brought against Toni Natalie, Joe O’Hara, and John Tighe (Although similar charges were also brought against Barbara Bouchey, she was not originally part of the case – and she only became involved because she allegedly logged onto NXIVM’s server with someone else’s credential several months after the New York State Police had raided the home of Natalie, O’Hara, and Tighe and confiscated all their computers). Because this story is so complex, some may find it helpful to read the “Incident Report” that was prepared by Rodger Kirsopp, the NYSP Senior Investigator who oversaw the investigation (All of the quoted material in this post is from that “Incident Report”).
***
At the end of Part I of this series, we had established several key facts – and identified several unanswered questions. Those were as follows:
Key Facts:
– In mid-2011, one or more representatives of NXIVM filed a complaint with the Office of the Saratoga County DA alleging that Natalie, O’Hara, and Tighe had accessed its server without authorization.
– In April 2012, eight members of NXIVM filed a similar complaint with the NYSP. At that time, Kirsopp was assigned as the lead investigator on the case.
– For the next eight months, Kirsopp worked closely with ADA Ashdown to put together a prosecutable case against Natalie, O’Hara, and Tighe.
– During the course of his investigation, Kirsopp received “evidence” of the alleged unauthorized computer accessing from Myers and Ose – both of whom had told him that they were “contractors” for NXIVM.
– Throughout the investigation, Kirsopp had numerous meetings with – and numerous phone calls with – Coffey, Nichols, and McDermott.
– Kirsopp and the Saratoga County DA requested that the Office of the NYSAG get involved in prosecuting the case. That request was turned down because the NYSAG thought the case would be difficult to prosecute.
– Nichols informed Kirsopp that she had received a computer server that contained O’Hara’s email correspondence – and asked him whether she or the NYS police should download those emails.
Questions:
– Whose idea was it to have members of NXIVM file a new complaint with the NYSP several months after a similar complaint had been filed with the Office of the Saratoga County DA?
– Is it normal for an NYSP Senior Investigator like Kirsopp to meet so often with attorneys who are representing the complainants in a case?
– Why didn’t Kirsopp do any due diligence background checks on Myers and Ose – and why did he just accept all the “evidence” they provided to him without ever having the NYSP’s own computer forensic experts ever take a look at NXIVM’s server?
– What did Kirsopp tell Nichols when she asked him who should review the computer server that had O’Hara’s on it – her of the NYSP?
– How many other computer trespass cases has the NYSP been involved in before – and after – this case?
***
NOTE: As before, all of the quoted material is taken directly from Rodger Kirsopp’s “Incident Report”.
Part II
– On January 9, 2013, NYSP Senior Investigator Rodger Kirsopp was contacted by Albany County Assistant District Attorney (ADA) David Rossi who advised him that he had been contacted by Mike McDermott, one of NXIVM’s attorneys, about the alleged unauthorized accessing of NXIVM’s server – and that his office would possibly be seeking to have a Special District Attorney appointed to prosecute criminal computer trespass charges against Toni Natalie, Joe O’Hara, and John Tighe (Rossi indicated that they needed to do that because the Office of the Albany County District Attorney had a conflict-of-interest). Although Kirsopp knew that the NXIVM server was actually located in Saratoga County – which is why he had been working with the Office of the Saratoga County District Attorney on the case since April 2012 – he apparently raised no questions with Rossi as to whether Albany County had any jurisdictional basis to intervene in the case.
– On March 22, 2013, Kirsopp met with Bruce Lennard, a private sector attorney who had been appointed to serve as an Albany County Special District Attorney with respect to the complaints that had been filed against Natalie, O’Hara, and Tighe. Once again, Kirsopp apparently did not raise any questions as to how Albany County could possibly have any jurisdictional basis for bringing any charges for an alleged crime that occurred in Saratoga County.
– On April 8, 2013, Kirsopp had another meeting with Lennard to further discuss the case.
– On April 16, 2013, Lennard contacted Kirsopp to tell him about the information he had received about the location/ownership of the various IP addresses that two of NXIVM’s high-ranking members, Ben Myers and Steve Ose, had given to Kirsopp (These were the IP addresses that had allegedly illegally accessed NXIVM’s server). At this same time, Lennard also requested “…a review of the NXIVM server to verify accuracy and honesty of the information” that Myers and Ose had provided to Kirsopp (Kirsopp had apparently never thought to do that). Kirsopp passed along Lennard’s request to NYSP Investigator Terry Aubin, Troop G Computer Crimes Unit – and set up a time for Lennard to meet with Aubin on April 23, 2013.
– On April 26, 2013, Lennard contacted Kirsopp to provide him with the details of his meeting with Aubin. At this same time, he also told Kirsopp that he had been in contact with Clare Bronfman, Pam Nichols, and Ben Myers – and he requested that Kirsopp contact Jack Goldenberg who reportedly had the server that contained O’Hara’s emails (Those of you who have been paying attention will recall that Pam Nichols informed Kirsopp that she had this server back in October 2012 – and gave him copies of some of O’Hara’s emails that she had printed from it).
– On May 2, 2013, Kirsopp contacted Nichols to get Goldenberg’s phone number and email address. At this time, Nichols also informed him that the server with O’Hara’s emails had been “…returned to Brooklyn, NY”.
– Also on May 2, 2013. Kirsopp contacted Jack Goldenberg who informed him that he did, in fact, have the server with O’Hara’s emails – and that he would require a court order in order to turn it over to Kirsopp. Goldenberg also informed Kirsopp “…that an IT person from BRONFMAN, C was at his office last Friday from 9:00 AM to 4:00 PM looking at the server”.
– Also on May 2, 2013, Kirsopp contacted Ben Myers who advised him that was not the IT person who was at Goldenberg’s office the prior week. Kirsopp next contacted Pam Nichols who informed him that she had “…directed her own technician to go to GOLDENBERG’S office and receive a copy of the actual server itself”. Kirsopp then noted in his “Incident Report” that “Apparently, NXIVM and O’Connell and Aronowitz have been working with a copy of a copy of the original server” – and that “The copy of the server was completed under the supervision of an IT person from GOLDENBERG’s office”.
Author’s Note: If you’re a little confused at that point, that’s quite understandable. But it appears that Kirsopp has tried to come up with a storyline that would explain away the fact that Nichols claimed to have the server with O’Hara’s emails back in October 2012. The “explanation” that she only had “a copy of a copy” should, of course, logically have led Kirsopp to ask “Whose copy did you copy” but he apparently didn’t think to ask that question. Nor did he think to ask Nichols why she needed to make another copy of the same server in May 2013.
– On May 7, 2013, Kirsopp received a call from Alex Finn, who does business under the name Stockade Associates and who told him that he was the person that Nichols had sent to Goldenberg’s office. According to Finn, Nichols told him that “…there had been a security breach, internal access to a server and requested assistance in the recovery of emails, their headers, and to compare the IP addresses of the emails to IP addresses captured from the unauthorized access to the company (NXIVM) server”.
– Finn went on to explain that he had only accessed the server one time – on April 26, 2013 – and that “…he was able to corrolate (sic) IP addresses to the IP logs of the breached (NXIVM) system”. He went on to explain that the server in question had been offline for 2-3 years – and that “…the emails were backed up to MacAffee (sic) ‘cloud’ service”.
– When Kirsopp called Goldenberg to discuss the matter, all Goldenberg told him is that the server is a Dell “… a stand alone computer tower type server”. He then advised Kirsopp that all future communications should go through his attorney, Ronald Kleinberg.
– On June 5, 2013, Kirsopp attended a meeting with Special District Attorney Lennard – and three other members of the NYS Police: Eugene Bell, Terry Aubin, and Sara Vandusen. During that meeting, Lennard advised them that he had served a subpoena on Goldenberg’s attorney to obtain the server that had O’Hara’s emails – and that O’Hara had pled guilty to unrelated charges in El Paso, TX and was expected to begin serving a 36-month service in December 2013.
– On June 5, 2013, Kirsopp also contacted Ben Myers to advise him that he would be contacted by someone from the NYSP’s Computer Crimes Unit to do “…a search/imaging of the NXIVM server”.
– On June 10, 2013, Goldenberg’s attorney informed Kirsopp that he would make arrangements for the server with O’Hara’s emails to be turned over to the NYSP. In addition, Kirsopp was also informed by fellow NYSP Trooper Vandusen that she had made arrangements with Myers “…for the exchange of information from the NXIVM server”.
– On June 14, 2013, Kirsopp was informed by Goldenberg that the server with O’Hara’s emails was ready to be picked up (Goldenberg advised Kirsopp that he would make himself available along with his IT person when that occurred). Kirsopp then made arrangements to retrieve the server.
– On June 17, 2013, Kirsopp contacted Clare Bronfman “ as a result of a separate investigation (SJS #5123683)” – and advised her of the status of the criminal computer investigation involving Natalie, O’Hara, and Tighe. It is unknown at this time what the other investigation entailed and/or how it was resolved.
– On June 19, 2013, Kirsopp and Vandusen drove to Brooklyn, NY and picked up the server that contained O’Hara’s emails (Goldenberg was not there as he had previously promised to be). In addition to picking up the server, they took photographs of it – and the server room in which it had been stored. The server was then transported back to the NYSP building in Clifton Park, NY “…where it was secured as evidence pending submission to the NYSP FIC” (Forensic Investigation Center).
– Kirsopp also noted on June 19, 2013 that Vandusen was continuing to have conversations with Myers “…for obtaining data from the NXIVM/ESP computer server”. She also advised him that “…this action should be completed in the next week or two”.
– On July 16, 2013, Kirsopp received an email from Vandusen that indicated she had been in touch with Myers about reviewing the NXIVM server – and that “…consent has been provided to review certain areas of concern, specifically the areas where subjects had obtained information”.
– On July 17, 2013, Kirsopp contacted Special District Attorney Lennard “…to advise of case status including the review of the NXIVM server on today’s date by Inv Vandusen and S/Inv Aubin”.
– On July 19, 2013, Kirsopp received a DVD that contained the information that had been downloaded from the NXIVM server.
– On August 27, 2013, Kirsopp attended a meeting with Lennard, Vandusen and Barry Friedman to discuss the status of the case and the next investigative steps to be taken.
– On September 1, 2013, Kirsopp conducted background checks on Natalie. O’Hara, and Tighe.
– On October 3, 2013, Kirsopp met with Steve Coffey, Mike McDermott, and Pam Nichols to provide them with a status update on the investigation of the alleged unauthorized accessing of NXIVM’s server.
– On October 8, 2013, Kirsopp did additional research to verify where Natalie, O’Hara, and Tighe were living – and requested other members of the NYSP to take photographs of those locations as part of his preparation for obtaining search warrants on those three individuals.
– On October 8, 2013, Kirsopp also met with Lennard to discuss the scope and targets of the search warrants – and spoke with S/Inv Aubin about that same topic.
– On October 17, 2013, Acting Supreme Court Justice Kimberly A. O’Connor signed the requested search warrants regarding the residences of Natalie, O’Hara, and Tighe.
– On October 23, 2013, Kirsopp oversaw the simultaneous pre-dawn raids on the residences of Natalie, O’Hara, and Tighe. According to their individual recollections, a total of 12-15 NYSP Troopers were involved in those raids.
***
Part III of this series will focus on the events that took place from October 23, 2013 onward. In the meantime, here are the new key facts – and the new unanswered questions – regarding the period of time from January 13, 2013 and October 23, 2013.
Key Facts:
– Less than one month after the Office of the New York State Attorney General and the Office of the Saratoga County District Attorney declined to prosecute Toni Natalie, Joe O’Hara, and John Tighe for allegedly accessing NXIVM’s server without permission, one of NXIVM’s attorneys, Mike McDermott, contacted David Rossi, an Assistant District Attorney in Albany County, to discuss the alleged illegal act (Prior to joining the O’Connell & Aronowitz law firm, McDermott was the Chief Assistant District Attorney for Albany County and may have been Rossi’s former supervisor).
– Rossi, in turn, contacted NYSP Senior Investigator Rodger Kirsopp – and told him that Albany County was thinking about appointing a Special District Attorney to prosecute Natalie, O’Hara, and Tighe.
Kirsopp never raised any questions as to the jurisdictional basis for Albany County getting involved in the case – even though he was well aware that the NXIVM server in question had been located in Albany County at the time it was allegedely accessed ny Natalie, O’Hara, and Tighe.
– Bruce Lennard was appointed as an Albany County Special District Attorney to prosecute Natalie, O’Hara, and Tighe.
– Shortly after his appointment, Lennard requested that Kirsopp arrange to have the NXIVM server reviewed in order to verify that the allegations of unauthorized access were true. But rather than actually doing a forensic analysis of the NXIVM server, all the NYSP did is download some information from the sections on the server that NXIVM claimed had been illegally accessed.
– In May 2013, Pam Nichols, another of NXIVM’s attorneys and the Managing Partner of the O’Connell & Aronowitz law firm, informed Kirsopp that the server with O’Hara’s emails that she had previously obtained from Jack Goldenberg had been returned to Goldenberg’s office in Brooklyn, NY.
– When Kirsopp contacted Goldenberg to discuss the matter, Goldenberg informed him that an IT person sent by Clare Bronfman had recently spent an entire day at his office working on the server with O’Hara’s emails.
– When Kirsopp tried to verify the identity of the Bronfman “IT person”, Pam Nichols informed him that it was, in fact, her IT person, Alex Finn, who had spent a day in Goldenberg’s office working on the server with O’Hara’s emails.
– Finn explained that he had gone to look at the server in Goldenberg’s office to compare the IP addresses on O’Hara’s emails with the IP addresses that had allegedly accessed NXIVM’s server without permission.
– Kirsopp later claimed that Nichols only had “a copy of a copy” of the server with O’Hara’s emails – which would still not explain why she had sent Finn to Goldenberg’s office rather than have him do his IP address comparison work off of her copy.
– Kirsopp apparently never asked Nichols how she had obtained her “copy of a copy” of the server with O’Hara’s emails.
– Kirsopp and another NYSP Trooper eventually drove to Brooklyn, NY to pick up the server that had O’Hara’s emails on it. Why it took two Troopers to accomplish this task is unknown.
– In October 2013, a judge in Albany, NY issued search warrants for the residences of Natalie, O’Hara, and Tighe (In a separate post, we’ll be looking at the “Affidavit” that was filed by Kirsopp in order to obtain those search warrants).
– On October 23, 2013, Kirsopp oversaw the operation of the simultaneous pre-dawn raids on the residences of Natalie, O’Hara, and Tighe.
– Throughout this period of time, Kirsopp continued to maintain close contact with NXIVM’s attorneys – Steve Coffey, Mike McDermott, and Pam Nichols – and to keep them fully apprised regarding every aspect of the investigation concerning Natalie, O’Hara, and Tighe.
Questions:
– Why did Kirsopp not raise any questions about the jurisdictional basis – or lack thereof – for Albany County getting involved in the prosecution of Natalie, O’Hara, and Tighe?
– Since Kirsopp knew that the NXIVM server was, in fact, located in Saratoga County shouldn’t he have known that Albany County had no basis for getting involved in the case?
– Why did Kirsopp not arrange to have the NXIVM server forensically analyzed by a member of the NYSP – and why did he let NXIVM decide what information it would download for the NYSP to look at?
– How did Pam Nichols get possession of the server that had O’Hara’s emails? Did O’Connell & Aronowitz pay Goldenberg for that server?
– Why did Goldenberg suddenly instruct Kirsopp to “talk to my attorney” when Kirsopp asked him some questions about the server that had O’Hara’s emails?
– Did Kirsopp perjure himself in the “Affidavit” he provided in order to get search warrants issued for the residences of Natalie, O’Hara, and Tighe?
– Is it normal NYSP practice to have 12-15 Troopers involved in collecting evidence in a case involving alleged computer trespassing?
TO BE CONTINUED…