← Drop Dead Serious With Ashleigh Banfield
Drop Dead Serious With Ashleigh Banfield
Chilling New Ransom Demand Claims Video Shows Nancy Guthrie With Main Kidnapper Before She Died?
00:40:32
Loading summary
Transcript88 lines
- [00:00]
Shannon Maldonado
My name is Shannon Maldonado. I'm the founder of Yaoi, a gift shop. From the lens of artists and handmade objects. I chose Shopify because when I was testing other platforms, it was definitely one of the most user friendly. It was important to me to think about where we would be in the future. All of the tools for reading your sales, like planning inventory, they're just right there on your dashboard. For anyone starting a small business, the biggest thing I can tell you is it doesn't have to be perfect. Shopify can help you build upon it. Start your free trial on Shopify.com this
- [00:30]
Lowe's / Advertisement Voice
July 4th at Lowe's. Get up to 45% off select major appliances, plus save $80 on a select Char broil Performance series gas Grill. Now $299. Our best lineup is here at Lowe's. Lowe's we help you Save valid through 7A while supplies last selection varies by location. See Lowes.com for more details.
- [00:54]
Heather Barnhart
Visit your nearby Lowes.
- [01:05]
Ashley Banfield
Hey, everyone, I'm Ashley Banfield and this is drop dead serious. Well, well, well. Wouldn't be a Friday without another big development in the Nancy Guthrie case. And as it turns out, there's yet another ransomy kind of communication that's come out, and this one is upping the ante, so to speak. Harvey Levin of TMZ received yet another email from whoever it is who's been insisting that he or she knows the identity of the kidnappers, plural, knows where they are, knows where Nancy Guthrie is buried. And now this person is saying has video. Yeah, that's something else. Let me break it down. Harvey announced today on TMZ that this person is the same person who has communicated before. Because the bitcoin address that this person said, send me a bitcoin and I'll send you the. The information on the kidnappers, it is the same as it was originally, but they've got a new bitcoin address. They've got a new bitcoin address where they want the money. And they say that the old bitcoin address is no longer working, but they have the old bitcoin address and they apparently use an alias that they used originally. So it is the same person who's been coming at Harvey Levin non stop. It seems. Honestly, I've lost count of the number of times this person has reached out to Harvey Levin, saying, give me a bitcoin and I will give you the kidnappers. I'll give you the info. And listen, Harvey's been amazing in all of this. I'm not Gonna lie. He is playing. He's playing chess to this guy's checkers because he said, why not just get the million dollar reward? That's a lot more than a bitcoin. I mean, I don't know. Last time I checked, bitcoin was in the 70 thousands or so. I don't know what it is today, but why not get the million instead of the tens of thousands? And that person's retort was, I'm too afraid of law enforcement and I'm too afraid of retribution and I need security. And therefore this is the only deal I'm prepared to make. Which makes me think they're full of shit, right? Just scammers. However, the ante that they've raised today is that they apparently say they've got video of the kidnappers, plural. And Nancy Guthrie, let me read for you some of the things that this kidnapper has said, according to Harvey Levin at tmc. So they say they've got video of the main guy, right? Which tells you it's plural. There's more than one. But this is the main guy and Nancy together on the day that she. She likely died. And Harvey's authenticated that it is the same person who sent the previous emails. They reference that old bitcoin address, right? In the new claims, this person says this quote, I have a phone stashed in a secure location, guaranteeing both the information it stores and the safety of the phone. That's weird syntax and it's kind of a weird statement to make. I almost wonder yet again, is this a translation? Because it's kind of like, who speaks this way? But okay. And Harvey says that the sender goes on to say this quote. What it contains is my definition of delivering them, meaning the kidnappers on a silver platter. A short video of the main guy with Nancy the day that was probably her last. Pictures of both involved names and addresses and age. Age, singular. But pictures of both involved, meaning two perps. And this person claims to know both of them. Video of one per with Nancy on the day that she, quote, probably died. The claims go on, according to Harvey. He says the the email that they received claims the phone is, quote, in a location easy to access if you know where it is, end quote. And this person says that he's going to give up the password for one bitcoin and then gives a brand new bitcoin address. This is all really interesting because Harvey communicated back and said this isn't going to happen without some kind of evidence, like maybe a screen grab. Again, Harvey is playing chess to this game of checkers and says, give me the screen grab. Let us know you really mean business. And last time all this happened, Harvey said, okay, you could get the million and you want just the bitcoin. And the person was too afraid. So Harvey actually offered to be the go between. Fine, I'll get the million. I'll give you the million. You give us the information, we will give it to the family and to the FBI who are paying the million dollars. Hence, you're right back where you started, but you're just a million dollars richer, but you're still safe. You're still anonymous. Etc. Well, that, you know, obviously wasn't good enough for this, for whoever it is sending these notes, which is again, why I think they're scammers, because that sounded like a pretty good deal, right? You can get 79,000 or so for a bitcoin, or you can get a million and you can still remain anonymous. Anyway, Harvey also said he's passed on all of this information to the FBI, as he has done all the way along. He hasn't been, like, operating in a vacuum. He's working with the FBI at all times. And there was something else in their communications that was interesting. If you remember, in an earlier episode, I told you that Harvey had offered to the FBI to do a documentary about all of this and pay the bitcoin, and the FBI ghosted him on that, which is odd. And now there's a lot of, like, criticism that the FBI may have really screwed up in, like, tickling the wire by throwing 200 and some odd dollars in the bitcoin account that the first ransom seekers were asking for. Right? These were the people who said they had Nancy. This was the first overture that came to TMZ and two local TV stations in Tucson. They wanted money in bitcoin, and instead of giving the 4 million, which was the first request, and if you missed that deadline, 6 million, nobody put that money in the bitcoin address in the wallet, but they put a couple hundred bucks in. And there's a lot of criticism now saying that may have been the opportunity lost to actually find these kidnappers and find Nancy Guthrie. Anyway, separate overtures coming from someone else still to TMZ saying, for a bitcoin, for one bitcoin, for the cost of one bitcoin, we'll give you the information. And apparently a silver platter will hand over these kidnappers and the location of Nancy Guthrie. So it's. It's a lot. Harvey also asked these people, whoever they Are. And remember, there was a. There was an FBI person who reached out to Harvey to say it. Sounds like the wording of the person who's reaching out to you is female. Interesting. I'm not so sure. Women can be just as ruthless as men. And one of the overtures I recall got really pissy. You know, like, really bitchy. Like, I'm not fooling around here, and you're not taking me seriously. Sounds like a kid. But anyway, Harvey did ask about the people in Mexico. The. The women's group in Mexico that searches for missing people. They got a tip in Sonora State, south of Nogales, that Nancy was buried near a stream, and they got specific information. And apparently, this tip was so believable that the Mexican authorities backed up this search group and helped them to go and. And do a search. They didn't find Nancy. This Group has unearthed 25 unmarked graves in the past. So they know what they're doing. They're serious. They didn't find Nancy. But Harvey asked this author of this latest note and some of the other notes he's received about the tipsters, you know, in Sonora State. Harvey says in. In this latest communication that these people admit there are multiple kidnappers. So specific to that Mexican operation. This is what the author of this latest writing said. Only two are directly involved. Meaning they'd mentioned before. There are multiple kidnappers, but only two are directly involved. And I doubt they'd be the ones calling to snitch on themselves. Take it for what it is. But it is, yet again, another development in a flurry of developments five months after the fact, five months after Nancy Guthrie disappeared from her bed in the middle of the night. Okay, so I wanted to ask about, I think, the elephant in the room. And that is with all the emails and all the ransom notes and the purported ransom notes and the notes saying, give me money and I'll tell you who the kidnappers are. How is it that the FBI hasn't found anybody?
- [11:17]
Heather Barnhart
Right.
- [11:18]
Ashley Banfield
Are you feeling the same way I am? Which is. The more people hit their keyboards, the more I keep thinking they're gonna get caught. We have to be better at this. Isn't the best of the best in the United States government, the FBI? Aren't they better than this? Like, is the cat and mouse game something we, the good guys, are losing?
- [11:41]
Lowe's / Advertisement Voice
Este cuatro de julio and Los Angeles ahorasiento en electro domestico selectos a de mas Ahora ocenta dole Char broil performance series Ahora dos noventa y nuevedo lares nuestra mejor Selection. De puertas personalizadas.
- [12:41]
American Express / Shell / Dish Advertisement Voice
There's nothing like my American Express Platinum card. I love that I can earn hotel credits when I travel. I can also earn resi credits, so you know, I'm hitting the restaurants everyone's talking about. Plus, with the digital entertainment credit, I'm even more excited to catch my favorite shows. All in all, I can access over $3,500 in annual value with benefits and eligible purchases across travel, entertainment, and more. Learn more@americanexpress.com Explore Platinum Enrollment Requirements monthly and other limits and terms apply.
- [13:12]
Lowe's / Advertisement Voice
Ahora mascolos yeva cada projecto al sigente niver ahora quince porciento nuna selection de puertas de entradas e interiores personalizadas Ademas aurora centado la res.
- [13:41]
Ashley Banfield
And so I reach out to Heather Barnhart because she's been one of these people who's just been so ahead of the curve when it comes to digital forensics. And if you don't believe me, how about this resume? She's been doing this for well over 20 years. She's played key roles and investigations into Osama bin Laden, the Boston Marathon bombing, the Pulse nightclub shooting. She worked on the Bryan Kohberger case and analyzed his cell phones and laptop hard drives. She's also done a lot of expertise in blood spatter and DNA and how they all come together with digital forensics. Heather works for the SANS Institute, which is leading cybersecurity training provider in the world. So I called Heather just to ask her that very same question, which was, how on earth have we not caught these people with all the keyboard activity that's been going on in the last five months? And here's our conversation. Heather, it's good to have you on the podcast again. Thanks for being here. Here we go again, another missive overture. I don't even know what to call these communications anymore. Something more from someone who says he or she knows who the kidnappers are. But this time they go further and they say they got video. They've got video of, say, perhaps the last day that Nancy was alive. What do you make of this?
- [15:02]
Heather Barnhart
The family obviously needs more information, otherwise they would have paid and maybe they did. I'm not aware of any payments that were made, but I know if it were me, I would want to know. How am I going to find my mother? What information do you have? So it seems like they're baiting with some more of those details now.
- [15:21]
Ashley Banfield
And the baiting is either desperate or cruel or both. I don't know. But what Harvey Levin says is interesting about this. He says that this is an old bitcoin address is referenced in the email, as well as an alias that this person used. So it's definitely the same person who made these requests beforehand. And again, just to be totally clear, there's the first two that, you know, communications that came from people who purported to be the kidnappers. One said, give me the money. Here are the deadlines. There's two deadlines, and if you miss either one of them and they go up, you know, we'll kill your mother. That's. That's the first group. And then the second message that came from the same sender was basically, we're sorry, you know, she died. We didn't. We underestimated her health condition. She died. And. And we apologize. She's buried with nature. These people different. They came later saying, we know who the kidnappers are, and for a Bitcoin, we're prepared to give you the information. And they have sent multiple communications to Harvey. I don't understand for the life of me how all of this communication could be going on, and we're still five months with the FBI unable to find the kidnapper or the person who thinks they know the kidnapper.
- [16:42]
Heather Barnhart
Yes. So let's. Let's talk about the email quickly on what is possible. And I'll try to formulate this in a way that hopefully makes sense to everyone. When you get an email, you know that there's the message body and an attachment, if one were included in that message. But there's also something called the mail header, and that's where forensic analysts like myself, that's what we look at. This includes the send again a mail. The mail header header. Okay, so this would be the envelope or the envelope that something comes in your mailbox. It would have the sender, the recipient. Where did the message come from, and where did it go through? So if it's coming from Russia, does it hop through California to get to you, or is it straight in Arizona? So where does it start? Where does it end? Is it Google dates and times? And all of that stuff is so important. So think of it as the truth behind the package, the tracking id.
- [17:38]
Ashley Banfield
So you would think then it would be easy to find people if they're sending digital communications, possibly.
- [17:45]
Heather Barnhart
So the message ID and reply to id, if I send you an email right now, it will show that I'm sending it from my Gmail. So it would have Google information, and it would be Unique for me and unique from me to you for that specific email chain. If you reply back, that's how we communicate. If AI is used and not AI, if I say, hey, type a message to Ashley saying X, Y and Z, that would still go physically from my Gmail to you. But if something like openclaw or another form of AI is used on the backend to auto generate and send on a human's behalf, the message ID and reply ID will be missing because they just won't be there. And I think that law enforcement may not even be aware on why these things are missing because it's new that AI can do this.
- [18:33]
Ashley Banfield
So therein lies the issue. It's cat and mouse, it always has been. But I always have felt that the FBI gets ahead of these things. That as soon as the hackers and the thieves and the thugs and this, you know, the, the liars who are using digital technology for their ill gotten gains, as soon as they get good at it, we get better. The, the good guys get better. That maybe isn't true with AI.
- [19:02]
Heather Barnhart
I feel like we're always trying to keep up and it's whoever gets it first seems to be excelling and then we're playing catch up on the back end, which is unfortunate. And I don't know if something as sophisticated as openclaw would be used here. And when I say sophisticated, it's difficult to get it set up. But you could tell, have AI tell you and train you how to do it and then it succeeds. We're doing a test server right now, so from my phone I can send email from three different people to a fake company. And this server is sitting in Denver, Colorado, so it's not anywhere near me. And that's another thing too. If it's AI generated, it would not match the time zone. Let's say the kidnapper or the person that's trying to get this ransom money is leaning into AI generated email on the back end. That server, wherever that AI server exists, is what will show in the time zone for the message. So I assume this person would have to be in proximity to Nancy to have pictures and videos and all these things that they're saying they'll provide to the family. So that would be around mountain time. So if it's in a completely different time zone, that's another clue that it's AI generated.
- [20:20]
Ashley Banfield
So what should the FBI be doing right now given what we know we have received? Right. I don't know if there's other things the FBI has that we don't know about. But you know, things have been pretty public so far. Anybody who's made any kind of outreach has done so publicly through either TV stations or tmz. And given the fact that they've been very public, sort of felt like it was going to be a no brainer that you'd catch the person. But that hasn't happened. What should the FBI be doing right now?
- [20:48]
Heather Barnhart
What I would recommend. And they may have done this. I know typically if you have the person's computer seized that helps and then these search warrants naturally happen. But their greatest investigative lead is likely to get a search warrant to Gmail and look for machine ID cookies. So what this will do is be able to tell them if another device like maybe my iPhone or a Mac or a PC, something else is being used associated to that ransom account. Now I'm just going to call it the ransom email account because that's exactly what it is. So it would be able to try to tie that person to other devices. But they have to keep logging in as that same account. And as you said, they were using the same Bitcoin address. And there are tendencies here that I think if they get that machine ID cookie, it will tell the truth for associated devices.
- [21:42]
Ashley Banfield
Let's say the FBI is doing that. Where might these, these bad actors screw up?
- [21:51]
Heather Barnhart
So, and that's what I hope they do. But we know criminals are getting smarter. We know this from when I talk to you about the Idaho investigation in incognito mode. If all these emails are being sent in incognito mode, it makes it even more difficult. Those cookies wouldn't exist, which is unfortunate. And that's assuming that when your session ends you properly close it. And some people don't even know what that means. I wish they would have been sloppier at this point. If you think about it with the nests and the fact that no one was pinging cell towers and I know in that area that the cell tower data and cell service is really poor. So that's not helpful. But I was hopeful that someone's ring or nest or something would have caught these suspects. But it seems like they're, they have done their due diligence. But this may be not the kidnapper and someone that may have slipped up or left a trail somewhere. So whether it's the crypto, the mailheaders, potentially finding a cookie that associates to a phone that then could associate to a location, I think it's just constantly trying to pull these threads. But it has to be so frustrating for the investigators and for the family.
- [23:00]
Ashley Banfield
You said it makes things more difficult if they use these kinds of encryption technologies. But impossible. That's where the rest of us are
- [23:10]
Heather Barnhart
all holding on to hope.
- [23:11]
Ashley Banfield
Sure, it's all difficult and these people are spoofing and masking and doing all these things, but is it impossible to find them?
- [23:17]
Heather Barnhart
No. Everyone makes a mistake. I do not believe in the perfect criminal out there. Think about one strand of hair left behind, one digital footprint that you forgot to clean up. No one's perfect and there isn't a perfect criminal. We just have to find that imperfect trace which then will open the entire investigation.
- [23:35]
Ashley Banfield
And what do you think might actually end up being that that one screw up?
- [23:40]
Heather Barnhart
I believe it's going to be something associated to a cell phone, whether it's a location or a tower ping. And maybe the location has just spanned so far that it hasn't been found yet. But that is the most personal item that we have with us all the time. And even if you leave your phone in your car to go commit a crime, you're back with it again. So I do believe it will be something cell phone related that leads to the suspects.
- [24:04]
Ashley Banfield
So talk to me like I'm five and connect what a cell phone might do in the back pocket of a bad actor who's on a laptop using all this encrypted technology and then heads out to the car and pings all over, say, Tucson.
- [24:21]
Heather Barnhart
So here's the biggest mistake that people make. Logging into the same account on your phone and your computer. And I say it's a big mistake. It's only a big mistake if you're committing crimes. If you're a bad guy, yeah, it's normal behavior. Like why would you not be logged into the same. So the syncing of data, maybe my laptop is set to have zero location artifacts on it, but my phone is because I like to get Uber and I like to look up restaurants. So all the things that you rely on location for, your phone knows that truth. And most people and criminals aren't diligent enough to go through and turn off all these settings on every single device they touch. But the one that's always with you is your phone. And that is likely the one that knows the truth.
- [25:05]
Ashley Banfield
Do you think that the folks who work at the FBI are up to the task?
- [25:09]
Heather Barnhart
I hope so. I really do.
- [25:11]
Ashley Banfield
I thought you were going to say yes.
- [25:13]
Heather Barnhart
I hope so. I have to have faith in this. I train a lot of FBI agents and I have good friends that work for the FBI that Reach back and ask for help. And that's the other thing too. Ask for help if you feel like you're stuck or you just need a smart friend. That is how I've excelled in my career, asking for help. And it's okay to not have all the answers. But they do have training, and they do have experts in crypto, and they probably have the best experts in crypto tracing in the email and writing warrants. So it may just be something that they haven't thought of yet.
- [25:45]
Ashley Banfield
But do they? Like, that's when I. I keep coming back to are the bad guys smarter in the cat and mouse game, Are. Are the bad guys still the cat? And you know that the FBI is still the most desperately trying to figure it out.
- [26:00]
Heather Barnhart
I would say it depends on the investigation. But now with the amount of data per investigation, the criminals are definitely the cat because they're only focused on their one crime, whereas the FBI have hundreds of crimes that they're working at the exact same time.
- [26:16]
Ashley Banfield
You know, a lot of us have talked about these. Whoever did this to Nancy Guthrie. Wow. Has to be somebody so good at this if they've been able to keep the US Government at bay for five months. But then you just happened to sort of hit something I don't think many of us thought of. Could they have just used AI to get smarter?
- [26:35]
Heather Barnhart
That's what I really think criminals are doing. When you think of the little plant in the camera, that still drives me insane. Why not smash it? Why not have spray paint? Why not do something to destroy that camera versus, like, let me just dangle a plant. So when I saw that, I was thinking, this person's not sophisticated. I did look at the first few ransom notes, and they were written differently, and one seemed to have better grammar. So I was like, AI wrote that one. It just crossed my mind immediately. But I believe that a lot of criminals are using AI to learn how to leave a smaller digital footprint, how to turn off their phones, which logs are in place, how to do simple things like run eraser to clean things off your computer. This isn't normal knowledge, but now everything is available through AI and the Internet that criminals are sadly getting smarter and we have to keep up.
- [27:28]
Ashley Banfield
Yeah. But I hope that as they employ these tools, they leave a breadcrumb trail behind them in the effort to find the tools to clean up their breadcrumb trail. That actually leads me to the note that you just mentioned.
- [28:12]
Kiana
I'm Kiana, and I leveled up my business with Shopify. Once I figured out that Shopify was a thing I never turned back. I can create a site with my eyes closed. Shopify thinks ahead of us, you know, and it thinks about the customer more than anything. Every day I'm thinking about some other new business, but Shopify is doing it to me because it's so easy to use. It's like, I can't switch. Stop. I'm addicted. Start your free trial@shopify.com.
- [29:04]
Lowe's / Advertisement Voice
Agiliza tus proyectos mi entra sigues aurando con loves
- [29:10]
American Express / Shell / Dish Advertisement Voice
Shell V Power Nitro plus fuels every drive with a fuel like no other. It removes up to 100% of performance, robbing deposits to rejuvenate your engine's performance. That means more power when you need it and more performance with every drive. Shell VPower Nitro Plus Premium Gasoline. More power, more performance. Formulation unique to Shell in gasoline Direct injection engine fuel injectors with continuous use of Shelby Power Nitro plus Premium gasoline compared to lower octane fuels. Actual effects and benefits may.
- [29:40]
Ashley Banfield
One of the things that Harvey Levin said about the notes that he's been receiving subsequent to the first two. So these would be the other notes from the person who says, I want, you know, I want a bitcoin to lead you to the people who did this. Right. Harvey said that the FBI contact, they have mentioned that the wording seemed as though it was a woman. Have you ever felt comfortable enough to say something like that in your work, where you can actually get a feel for how somebody writes something, Especially given what you just mentioned, that that sounded like A.I.
- [30:17]
Heather Barnhart
yes. Tone. It's interesting. I. I didn't think of that. But in text messaging, I can typically tell in cases if it seems like it's written by a male, a female, someone with a close relationship, even if it's denied. You can tell the assumed tone in many messages. So that's actually an interesting perspective there. I assumed AI and he's assuming female.
- [30:46]
Ashley Banfield
Interesting. And by the way, about the camera, I keep thinking about the sophistication of this guy on the porch. First of all, it's just a harrowing image, no matter how you slice it. Whether he's sophisticated, not he did something terrible.
- [30:57]
American Express / Shell / Dish Advertisement Voice
Yes.
- [30:59]
Ashley Banfield
I keep thinking that those. Those twigs, the. The vines, the thing that he grabbed out of the garden, weren't to dangle it over. They were actually to get in between the camera and the mount and yank. That's what I saw because he's. He's gripping a lot on those as opposed to trying to, you know, dangle. There's a lot of Grip going on, and eventually the camera was actually pulled off. But I also know from those cameras, the. The amount of space between the mount and the camera is so skinny, barely put a coin between them. So you might need something to get behind it to yank.
- [31:36]
Heather Barnhart
Yeah, this is a frustrating case for sure. I really thought within days something would have been found. And I was so hopeful when the cell tower data and, and still.
- [31:46]
Ashley Banfield
So now that we're at five months, you work in the business of, you know, digital intelligence and cyber security, et cetera, at five months, are you losing hope? I mean, should we remain as hopeful that we're going to find this person through the digital popcorn trail that may be left behind, or are you losing Hope at 5 months?
- [32:07]
Heather Barnhart
You will lose key evidence on cell phones, but you should not lose hope. Definitely don't lose hope, because preservation orders. The FBI clearly has preservation orders in place with cloud providers that that data is not going to get overwritten. The suspect has more time to clean up their trail, but they can't go back to the scene on what was left behind on that night. So that's the key, is preserving what happened in those hours when Nancy was taken from her home. Whatever they do now, they can keep trying to mask it, but they cannot cover up what happened on that night.
- [32:43]
Ashley Banfield
Do you put more stock in the digital trail of the communications that have come in, the emails that have been sent in, the requests, the demands, that kind of thing, or do you put more stock in the crypto trail and that that's how to catch this person is through the crypto angle, not so much through the email angle? I would say both.
- [33:07]
Heather Barnhart
I don't. I wish I could see the headers to know what they look like and then say, you know what, Ashley? Based upon what is in this email, I would focus on the crypto. But both could be equally important if you know how to do the examination of that. And there's so many forensic tools out there that will do this analysis for you and put it into a forensic report. It's not as if the person has to sit there and manually go through each email, which they likely would, because how many is it, like 5 or 6? Like less than 10? So it's not like they're looking through hundreds of thousands of email messages, but just going at that basic level. And that's the thing here. This is basic digital forensics. When you're looking at mail, and I think we get so extreme and caught up in the media and caught up in what's expected that we sometimes Forget to just take it back to the simple basics and look at the mail header.
- [33:58]
Ashley Banfield
Well, this is what's so maddening to someone like me who knows nothing about your business, is that it feels like it should be solvable. And that's why every single time there's a new message, like today, a message that's really detailed, I mean, saying, I've got phones stashed in a secure LOC guarantee the information it stores and the safety of the phone. I keep thinking, are you kidding me? This should be like, you know, handcuffs tomorrow. But why is this basic stuff not as easy as it seems?
- [34:28]
Heather Barnhart
And I would want proof of that. So it's not as easy because it's going one, it's going to the media or tmz. So it's not as if the it's going straight to the family's computers. Also, it's odd behavior with ransom. So from the cases that I've worked where I've seen things like this, most often this is done quietly and you pay your money and you press on. It's not made to be a media frenzy of pay me this information. That's also what's weird with the bitcoin and the crypto, because if these people truly know what crypto is, as soon as that wallet becomes active, then it can become traced. But you could have a crypto, you could have an ID that until it becomes active, isn't traceable. So maybe even pay like a few bucks and see what happens if that becomes active. But these wallets can be shut down as quickly as they're started, and then it's just like a dead trace.
- [35:26]
Ashley Banfield
So, I mean, the way I understand it, and again, it's. One has to speak with me like I'm five truly to get it. But the way I get it is that you can put the money in and, and stay anonymous, but the minute you try to take the money out, you do leave a trail and you will found. Or is there a way that very savvy crypto folks could actually get a payout and make off with it, abscond with it, and leave no trail behind.
- [35:53]
Heather Barnhart
You would still have to touch a bank. That crypto has to become cash in some format and that you can't just get it. You have to have someone physically get that cash to proceed on. But often it's transferred into bank accounts. So, sure, you could go and you could close all those things, but I guarantee law enforcement will be faster than that person is to close that all out.
- [36:15]
Ashley Banfield
Can. Can you. Can you Actually guarantee that, like, is law enforcement that good and that fast? So that if. If, say, they tickle the wire, like, they put, like, a couple hundred bucks in the crypto account, no one ever touched it. And why would they? What would be the point of risking everything for $200? You know, but, you know, there's a lot of talk about how that's a big failure of law enforcement, not to just pay and then wait for the criminals to surface, and they could.
- [36:40]
Heather Barnhart
And that's what I. I thought initially when the offering for the reward on information that the person running this ransom would just go that path and say, you know what? Okay, I'm just going to take that reward because it was matching the ransom, essentially. And that would have been a safer way to get money, give intelligence to police, and remain anonymous versus this method of the ransom.
- [37:05]
Ashley Banfield
Does any of this behavior smack of scammers? I mean, to me, it does, but I'm not an expert, and I don't work with these folks, and I don't work at cybersecurity on a regular basis. But, I mean, someone who keeps coming at TMZ even though they bring solutions, right? TMZ and Harvey are playing chess. They really are. They're not playing checkers with this guy. They're playing chess. And they said, look, first thing they said was, why not just take the. The ransom money? It's a hell of a lot more than one bitcoin. If you know the identity of the kidnapper and where Nancy is, get your million and go. And the person came back said, well, I'm just afraid of law enforcement, and I'm afraid of security, and I think these kidnappers will come for me. Like, sure, that's convenient. Then the next thing Harvey did was said, fine, we'll do it. You know, like, this is smart, right? Harvey said, fine, we will be the go between. No one will know who you are. We'll get the money. We'll get the. We'll get the reward money. We'll get it to you, and you'll still remain anonymous. And that wasn't good enough either. And now here they come again, saying, I've got video. I've got a secured phone. I'm going to hand you the identities of these people. And they say plural on a silver platter. Does this smack of just scammers trying to up the ante and change the game?
- [38:18]
Heather Barnhart
Yeah, the secured phone doesn't make sense to me. Why do you need a secure phone? You could backup videos to other locations. It's not like the video is going to naturally go away or pictures or whatever you have. And I initially thought it was scammers right from the get go because it wasn't something directly to Nancy's family or directly to the home. It was always this pay attention to me vibe.
- [38:43]
Ashley Banfield
And also this person with Harvey got nasty. Like they got all petty and pissed off saying, you're not taking me seriously enough. I. I don't know what iteration of the note it was. I think it was like the third or fourth time they'd reached out to Harvey, but they did. They got pissy with him and said, you're not taking me seriously enough. And I'm getting angry. Yeah, I don't.
- [39:06]
Heather Barnhart
Yeah.
- [39:06]
Ashley Banfield
The reason I say that, Heather, so weird. Well, because scammers are like that, right? Scammers get pissy and angry. Liars and cheaters and scammers, they get pissy and they just try bully you into paying.
- [39:18]
Heather Barnhart
Yes.
- [39:18]
Ashley Banfield
And that's what I felt like with this guy. I felt like it was a bullying
- [39:22]
Heather Barnhart
and I would still want proof if I. I know the family wants to know where Nancy is and I would as well. And I feel like you don't have full peace until that is closed out for you. But show something. If you really have all this. Show something. Blur out the suspects, blur out whatever. Show the actual picture of Nancy. Yeah, that's what I would keep challenging. Because if they're a scammer, they don't have it. And then the fun begins on. Is that AI generated?
- [39:52]
Ashley Banfield
Well, then there's the next thing, because that's exactly what Harvey said to them. We're going to need something, a screen grab or something of what you say you have. And so we'll wait to see if they come forward with anything. But then the next question, Heather, is, will we be. Would we be able to tell if it's AI generated? Because that's something else that, you know, in this day and age, can't trust your own eyes.
- [40:15]
Heather Barnhart
Yeah, we. So unfortunately for them, we have really progressed forensically on that. And there are tools and software that make it pretty easy to say AI are real. Yeah, that will be helpful. And that's one of the things that I thought right away, hopefully they produce an image and hopefully law enforcement looks on, is it AI or real? Which I'm sure they would.
- [40:38]
Ashley Banfield
And if it's real, what's the next step?
- [40:43]
Heather Barnhart
Well, personally, then I would, I would likely pay if it seems that's like the proof of life that you always want. It's showing you like hey, this is someone that does know about this kidnapping and may have information on my mother, but that's me personally. And I know everyone is different and it's a sensitive topic, but if someone does prove that it's real and it's not something that was in the news, and it's not just a photo that they could have randomly stolen from the home, but even if it were, that would show that they know where she is.
- [41:16]
Ashley Banfield
You know, I've been focusing so much about the notes that, that Harvey's been getting since the first two, what we call real, you know, the likelihood that they might have come from real perpetrators. Those two random notes. I just wanted to get your thoughts, having worked in this business and dealt with, you know, real ransom seekers. The second note didn't ask for any money. You know, the second note was apologetic. It explained what happened. Do you have any thought about why a true kidnapper would take a risk to make another connection that could lead back to them? Just in order to explain, sorry, we underestimated her health. She died and she's buried. My bad, you know, do you have any thoughts about that kind of a second overture?
- [42:09]
Heather Barnhart
I would say just a brief check of consciousness. Like. Like did you suddenly feel human, that you needed to get something off your chest and just make yourself feel better? That's the only thing that makes. Makes sense to me is that they had a brief moment of in, in the criminal world, weakness where they came forward with something, but it also just doesn't make sense saying, you would think they would say in that one, okay, that we messed up, we didn't mean for this to happen. However, we still want this amount of money and we'll tell you where she is.
- [42:44]
Ashley Banfield
Yeah, that's what I mean. Like, if you're in the business of taking someone from her bed in the middle of the night and yielding blood, how are you this other person that just sends a note saying oops, sorry, as opposed to still cold, dead hearted business sorry, she's dead, prices dropped, I get it. But I want the money. And you'll get your, you know, you'll get your, your body back. Doesn't that sound more like the people that you'd be dealing with?
- [43:15]
Heather Barnhart
It does. And it could be the case of more than one person, and hence the tone, that one may have been a woman. So what if it is a man and a woman or several people, and I had that brief lapse of I need to get something off my chest, I'm going to send this message this time versus the Good cop, bad cop approach of, nope, I'm doing this and I'm in charge. It could also be that battle too, between these criminals on who's in charge and who's sending these messages. So it may be coming from the same location, same source, but different people behind the keyboard each time.
- [43:51]
Ashley Banfield
And again, from my, you know, sophomore understanding of all of this, the more communication, the better. I mean, the more they communicate all. Whoever they all are. Does that. Is that helpful or is it just more of the same?
- [44:06]
Heather Barnhart
Yes. I feel like this goes back to old school 80s crime movies where it's like, keep them on the line.
- [44:12]
Kiana
Okay.
- [44:13]
Heather Barnhart
Right. Like the home phone. Like, keep them on the line. The longer they're on. It's the same thing with all communications. The more messages that are sent, the more email that's sent, the more likelihood there will be of cloud data or a trace left behind or a message header, like the actual envelope with all the information on it existing.
- [44:35]
Ashley Banfield
Heather Barnhart from Sans Institute. If I were in high school, you would be the one I'd be cheating off of.
- [44:41]
Heather Barnhart
Well, thank you. Thank you.
- [44:43]
Ashley Banfield
It's good to see you. Thanks for being on.
- [44:44]
Heather Barnhart
Good to see you too, Ashley. Thank you.
- [44:47]
Ashley Banfield
So there you have it. My great thanks to Heather Barnhart. She has been so instrumental in helping me sort of understand the world of digital forensics, especially after the Bryan Coburger case. And I hope that she's right when she says we. We should have hope. We should have hope. Especially since criminals tend to screw up somewhere. And I just hope these criminals have or will screw up and that we will be the cat and not the mouse. The good guys. Thanks for watching, everybody. Good to have you here. And remember, truth isn't just serious, it's drop dead serious.
- [45:31]
Kiana
I'm Kiana and I leveled up my business with Shopify. Once I figured out that Shopify was a thing, I never turned back. I can create a site with my eyes closed. Shopify thinks ahead of us, you know, and it thinks about the customer more than anything. Every day I'm thinking about some other new business, but Shopify is doing it to me because it's so easy to use. It's like, I can't stop. I'm addicted. Start your free trial@shopify.com.
- [45:59]
Lowe's / Advertisement Voice
celebrate America's 250th with Dish for a limited time.
- [46:05]
American Express / Shell / Dish Advertisement Voice
Get an extra $250 off when you sign up. Call 888-add-d dish or visit dish.com today and use code DISH250 to claim your $250 savings.
- [46:20]
Lowe's / Advertisement Voice
That's 888.
- [46:21]
American Express / Shell / Dish Advertisement Voice
Add Dish. Offer ends August 12th. Terms apply.
- [46:31]
Lowe's / Advertisement Voice
Ahora mascolos hill. Personalizadas.