DOJ Continues to Let DHS Pick and Choose Screen Shots Pertaining to Their Assaults

There’s a general reason and specific reasons why people should care about Bill Essayli’s response to David Huerta’s motion to compel the government to turn over metadata associated with the evidence obtained against him.

Generally, DHS has permitted — encouraged, seemingly — DHS officers to use their own personal phones and to use Signal. And whether officers are using their own or government phones, DHS ditched its archiving software last year; it is relying on officers’ taking screen caps of relevant communications.

The Department of Homeland Security has stopped using software that automatically captured text messages and saved trails of communication between officials, according to sworn court statements filed this week.

Instead, the agency began in April to require officials to manually take screenshots of their messages to comply with federal records laws, citing cybersecurity concerns with the autosave software.

[snip]

The policy expects officials to first take screenshots of the text messages on their work phones, send it to their work email, download it on their work computers and then run a program that would recognize the text to store it in searchable formats, according to the department’s guidance submitted to the court.

Under the Federal Records Act, government agencies are required to preserve all documentation that officials and federal workers produce while executing their duties. They have to make federal records available to the public under the Freedom of Information Act unless they fall under certain exemptions.

And we’ve seen AUSAs rely on officers themselves to review their own devices for communications covered by discovery.

In the LaMonica McIver case, for example, officers didn’t turn over exculpatory texts until Judge Jamel Semper ordered supplemental discovery.

It wasn’t until November 26 — almost two weeks after Judge Jamel Semper ruled on McIver’s immunity bid —  that DOJ turned over texts copying this video, observing that it looked bad.

5 The Spotlight News video came to light during the course of supplemental briefing only because it was referenced in a May 9, 2025, text message that the government finally turned over on November 26, 2025. HSI special agents exchanged the video in that May 9 conversation, where the agents also acknowledged that the evidence in the video was “bad.” Ex. Y at 2-3. The prosecution team therefore clearly knew about the text messages (and thus the video) when disclosures were due in July.

McIver’s lawyer, Paul Fishman, says he will address this delayed discovery in a follow-up letter.

Inexplicable delays in the government’s discovery productions mean that the record continues to be developed.1

1 Congresswoman McIver will detail these shortcomings in a forthcoming letter to the Court.

But the implication of this is clear.

DOJ was never going to turn over these discussions — conducted on Signal — until Judge Semper ordered this supplemental briefing. They were sitting on evidence that shows that before DHS first started calling McIver’s actions an assault on May 10 (McIver had to ask to have these Tweets taken down, but the timeline is in her motion to do so), they had shared video noting that their own actions looked bad.

Consider how this policy would work in the case of Jonathan Ross’ killing of Renee Good. Given that Ross’ video of the killing was released unofficially, it seems likely he was using his own phone that day. Particularly given the impunity with which Pam Bondi has treated him so far, there’s no reason to believe he’d retain anything incriminating himself, much less people like Greg Bovino or Stephen Miller.

It would take someone actually seizing his phone to see if there are incriminating details about his own motives.

That’s what David Huerta is asking for: that DOJ provide the metadata associated with both the videos and texts messages surrounding the day.

The metadata Mr. Huerta requests here—for the agents’ text messages already produced in this case,10 and for the photos and videos taken of the scene on June 6 and already produced—is critical and material to his ability to adequately prepare for his defense in this case. It is also relevant to understanding the sequence of events that occurred on June 6, both the actions of protestors and Mr. Huerta at the scene (e.g., shown in photographs and video recordings) and the agents’ statements to one another and activities that day as reflected in the text messages. Lastly, the metadata information affiliated with iPhone photos and messages is routinely stored in the ordinary course for such ESI, and would be straightforward to extract from the agents’ cellphones or devices. Moreover, producing the photos and videos in a native, load-ready format along with a corresponding index is routinely done in criminal cases by the Department of Justice.

10 Because the agents’ text messages and the photos and videos have already been collected by the government in this case and produced to the defense, there can be no dispute about the government’s “possession, custody, or control” of that material and/or those devices, as the government already had, and likely continues to have, access to them in preparing their discovery productions.

Even if these witnesses — HSI Supervisory Agent Ryan Ribner and Undercover Officer Jeremy Crossen — were reliable, this would be a reasonable ask. While the bulk of the video in discovery is unavailable publicly, the texts are difficult to unpack, and because Ribner “wrote the arrest report … from memory,” there are time discrepancies between the narrative he tells in the arrest report and the texts, to say nothing of additional discrepancies in Crossen’s countersurveillance report.

But these witnesses are not reliable. Crossen, for example, told interviewers that he was using his personal phone because his government phone “was not working at the time of the incident.”

TFO Crossen stated he used his personal phone to document the events which was turned over to an HSI Computer Forensics Agent (CFA) to download and preserve evidence.

TFO Crossen stated his government issued phone was not working at the time of the incident.

Except his texts show he switched phones during the incident (his testimony is so inconsistent I actually misunderstood whose phone this was on first read).

Plus, he told Ribner had had a couple hundred videos. The discovery includes far short of that.

And that’s just one reason to question Crossen’s candor when he told investigators, “he did not alter or delete any videos.” There are other holes in what appears in exhibits (this may be available in videos): he told investigators that somebody — I think he means protestors — called out “he’s a union member,” about Huerta, which is … not how I’d expect people in left-leaning politics to describe a senior SEIU official. The specific description of Huerta would go to the denials of everyone involved that they assaulted Huerta because he is a senior union official.

And Crossen described not filming the most important footage for this case, purportedly showing Huerta standing right in front of the van, rather than to its side, where the DHS goons assaulted him.

TFO Crossen recalled that immediately before 0:10 seconds before starting  video 2790, he observed HUERTA standing in front of the van, closer to the center of the van. He stated that he did not film that particular moment because there were a lot of distractions “from persistent instigators” including HUERTA.

And that’s why Essayli’s argument — that DOJ can provide Electronically Stored Information in whatever format they want so long as it maintains the data integrity — falls short.

In relevant part, the ESI protocol recommends that (1) after conferral, any format selected for producing discovery should maintain the ESI’s integrity, allow for reasonable usability, and reasonably limit costs, and, if possible, conform to industry standards for the format;

Crossen’s testimony, along with problems in the testimony of others, raises more than enough reason to question the integrity of the data as provided. A Cellebrite extraction, which is what Huerta is asking for, would show whether there were gaps in production.

Essayli is also citing in poor faith to misrepresent Huerta’s argument (and in his motion to dismiss, switched between PDF and document page numbers, further obscuring his references). He repeatedly claims Huerta just wants DOJ to create a searchable index.

To the extent defendant is requesting the government create an index of the metadata in a searchable format, see Dkt. 58 at 3:1-5, that request is beyond the government’s discovery obligations.

[snip]

Instead, defendant’s true complaint is that the government has not created a searchable index of the photos’ and videos’ metadata. (Dkt. 58 at 3.)

But the cited passage (this is on document page 2) reveals they’re asking for far more than that.

The screenshot PDF images of the messages do not contain any metadata affiliated with the messages or the source iPhones, and no corresponding index was provided to defense counsel with this information. Notably, the phone numbers belonging to the sender(s) and recipient(s) of the messages, or even the iPhone contact cards, were not included in the production or visible in the screenshots. Nor do the iMessage screenshots contain a timestamp for each message; while some messages do have a timestamp at the top (sometimes owing to a gap in time), many of the messages contain no timestamp whatsoever.6 Additionally, because of the nature of the initial production (individual PDFs named only by “IMG” file number), there is no way in which to tell who the owner and custodian (e.g., which agent) is of each set of messages and each phone. Additionally, due to the screenshot nature of the messages, certain messages are cut off and the messages were not all provided in chronological order to Mr. Huerta. Finally, the iMessage screenshots do not contain any geolocation or coordinate information, if any is available, as is often part of cellphone metadata or any “native” file.

There are a whole bunch of reasons this is necessary to reconstruct what happened.

But in DHS’ new parallel evidentiary role, it’s not clear whether Huerta — or any of the other people accused of assault using evidence from officers’ personal cell phones — will have access to that.

Share this entry
27 replies
  1. newtons.third says:

    I would hope that judges begin to only believe federal officers if there is a full documentary evidence chain as required. If there are gaps or issues like the ones you note, I would assume that they are hiding something. And issue rulings using that as a baseline assumption.

    [Thanks for updating your username to meet the 8-letter minimum. Please be sure to use the same username and email address each time you comment so that community members get to know you. /~Rayne]

    • Ginevra diBenci says:

      Ribner actually wrote quite a bit, two weeks ex post facto. Too bad he decided to jettison facts and truth in favor of what seems increasingly like the kind of artistic license his agency should trademark: inventing descriptive details to persuade the public that Huerta was “angry” (and therefore presumably violent), and emphasizing his own victimhood and heroism withal.

      When homicide detectives get their prime suspect inside an interrogation room, their first goal is just to get him or her talking. The aim is to lock a presumptive criminal into a story that can be assailed using the known facts. Ribner has volunteered a story that will not withstand the kind of fact-based inquiry a court of law requires. That’s why he won’t be called as a witness–at least, not by the government.

      • P J Evans says:

        I’d like to ask them if they were the Good Guys or the Bad Guys when they were kids playing games. And which side they were on when watching war movies.

  2. Matt Foley says:

    It’s the MAGA way. Lies of omission. Report “the truth” but not the whole truth. It’s Fox New’s business model.

    E.g.,
    “Thousands of hours of video show peaceful protesters on January 6.” (Nothing about 140 cops assaulted.)
    “Trump has released thousands of Epstein files.” (Nothing about the other 99% of files.)
    “Trump has lowered price of eggs and gas.” (Nothing about overall cost of living increase.)
    Ad nauseum

    Even when a MAGA is telling the truth you can be virtually certain he is lying.

  3. Fraud Guy says:

    At some point, is every government case going to lose presumption of regularity and it will just be assumed that they do not have it (outside of certain jurisdictions in SDFL)?

  4. zscoreUSA says:

    “Instead, the agency began in April to require officials to manually take screenshots of their messages to comply with federal records laws, citing cybersecurity concerns with the autosave software.”

    I’m not a techie, but that sounds made up. My dog ate my homework.

    • williamockham says:

      Well, I am a techie and that is total bullshit. There were privacy concerns with one particular spectacularly crappy software system for autosaving Signal messages that the administration used. They’re making an article equivalent to “the bathroom stall latch didn’t work, so I’m going to piss you”.

    • RipNoLonger says:

      I haven’t seen any official specification (regulation?) that states when these screen captures are to be made.

      Once every time a new message is sent/received? Long messages won’t fit on the screen so it’ll only be a partial capture.

      Once when waking up and before going to bed?

      Somewhere in between? (At the discretion of the perp.)

  5. Error Prone says:

    Off point, but very related, in the Good killing, there is no public domain info on who if anyone was in charge and when the shooter came onto the scene did he have prior contact with agents on scene, was there a plan that he would arrive and take control, or that he needed to touch base with a control person already on scene. Appearance were he parked his car, driver side door open, in a way restricting Good’s ability to safely leave the scene, i.e., blocking part of an egress route. Was that by instruction or election? Official cell phone in his hand, or a personal one? If Good had previously been told to leave the scene, there was no indication she could not do so when agents approached and breached her vehicle and intimidated her. The shooter said nothing not even that he was with the government. At least he said nothing when he was filming and was spoken to by Bekka Good. It did not appear to be an official vehicle in which he arrived and dismounted.

    But that video he took first surfaced as best as appeared to me via Alpha News, a rightwing web presence, and was it released by the government or the shooter giving it to Alpha. Many questions.

    Last a video, “Frame by Frame Analysis: How Minneapolis Woman Exercised Her Rights in ICE Encounter.”
    https://www.youtube.com/watch?v=PG2hsArjzis, is something OT but related and helpful in these times. And, please, any reader knowing whether the YouTube coding is identifiable to my IP or “generic” would be asked for help, as I have wondered but have no way of knowing. Rayne, you’re smart that way, do you know?

    • Troutwaxer says:

      I’ve got some IT knowledge, and I’m not sure I understand your question about YouTube coding. If you’re asking whether YouTube’s software knows the name/address/other details of whoever looks at their videos, the answer is ‘Yes’ unless the viewer is using very good security, including a truly-anonymous VPN and has not logged into any Google service.

    • Termagant says:

      “whether the YouTube coding is identifiable to my IP”: Not sure what you’re asking here (viewing? commenting? posting?). Also not clear if you mean “by random people” or “by the government” (meaning subpoenas to YouTube/Google, and/or some very scary computer and programming abilities).

      If anonymity is a concern, I’d suggest either A) subscribe to a decent VPN service which can route your activity out through a number of difficult-to-trace exit systems, or B) go to your local (or not so local if you’re really paranoid) library and use one of their computers (might want to use a disposable USB stick – don’t want to bring any viruses home).

      That said, it’s difficult to know exactly what capabilities the NSA (for example) might be able to muster (or what they would be willing to muster them for) in any given situation. It’s also difficult to know exactly how far a VPN service will go to fight for your privacy (despite what their marketing may say). Gauging the proper level of paranoia is hard.

    • P J Evans says:

      In the video, the only sign that their vehicles were official was the flashing red and blue lights – and they were small. Two pairs on the grille, and two on the front edge of the roof, IIRC. I’d have to guess that they had some on the back end, for safety. No signs on the side – they were effectively unmarked until the flashies went on. You still couldn’t tell who they were or if they were official.

      • Super Nintendo Chalmers says:

        I presume it’s POSSIBLE that someone uses surplus or stolen equipment to have blue or red lights. Fake ICEstappo could pull over random women and then abduct and rape them.

        • Anomalous Cowherd says:

          Old news. They eventually caught a creep raping women with that trick in southern NH about twenty years ago. Cops HATE amateurs trying to muscle in on their game.

    • Error Prone says:

      The thing is a YouTube link has generic ID and then at the end something which might be a hash code. My question if I click a video link and get a YouTube video URL, and you do if from your device, would the latter part of the link be the same hash or whatever it is.

      In effect, if I post a link, and that link is clicked, by you, does Google social networking software link you to me where the only thing might be your following a link I post. I.e., is a link I give here for example, uniquely linking me to the person who opens it, and perhaps reposting. Thus tracking me, not so bad, linking you to me by your following a link allowing that, in the tail end of youTube link and in turn you post a youtube link and I follow, is it then a directed social network tracking. The tail of a youTube link could simply be to distinguish one file from another without following linker-link follower in a social network. In effect, what’s the technology, how particularized is the link tail? I hit a link, sure Google tracks it, but if you follow a unique link Google gave me and I posted it online, does Google then link you to me? That should concern you as much as me, or more.

      • Rayne says:

        YouTube link has generic ID” — no. A YouTube link is unique and specific to a particular video.

        This is last week’s emptywheel Friday with Nicole Sandler: https://www.youtube.com/watch?v=U7JS9mAIp1Y
        This is this week’s emptywheel Friday with Nicole Sandler: https://www.youtube.com/watch?v=FT7WUQ1tXuE

        Note the video numbers are different. If the video is shared, an additional identifier appends the video number which tells YouTube what session shared the link. By session I mean information identifying the Google account, device, browser which shared it. When the sharer opens YouTube to obtain the video number, their account/device/browser is also linked to the ISP and IP address — that’s normal metadata for all users who traffic into/out of a web server. A reader opening that link can be associated to the sharer through these digital bed crumbs.

        This is why posting links including YouTube links before stripping out the tracking information is discouraged.

        Here’s a link a regular commenter shared without stripping:
        ht tps: //m. youtube. com/watch ?v=pom5yY-TTfU &pp=ugUHEgVlbi1VUw%3D%3D

        I’ve inserted blank spaces to deactivate the link. Note that the link was shared from a mobile device indicated by the m. instead of www. before youtube. The identifier begins with the ampersand. When the link is read by a user on a desktop/non-mobile device, the URL will change from m. to www. while indicating the link has been opened on a desktop, like so:
        ht tps: //www. youtube. com/watch?app=desktop&v=pom5yY-TTfU

        And of course opening the link tells YouTube the opener’s IP address (indicates network and physical location of ISP), timestamp (when opened), method and URL (what browser, version, and to what exact link the browser went), and whether the request succeeded (referrer code like 404).

        To provide maximum protection to the video sharer, this website emptywheel, and the reader/video viewer, the reader/viewer should copy the base link removing any additional tracking, and then open it in a browser that masks the reader/viewer using a VPN or Tor to mask the reader/viewer’s IP address. But that’s a lot of effort — simply copying and pasting the base video link into browser through which one has not signed into Google may be enough effort for the average person’s personal threat matrix.

      • Termagant says:

        “if I post a link, and that link is clicked, by you, does Google social networking software link you to me”? Google may not be able to do that directly, but in combination with government subpoenas, it’s possible.

        When someone clicks on a link, their browser sends a “request” to the URL (meaning the computer system named in the URL) of the link. Part of that request is called the “referrer” field which contains the URL of the page the click came from (where the link is embedded) – in this case, the page at emptywheel.net. So if Google/YouTube stores that referrer field (my guess: they do), and the government subpoenas it, they will see that the link came from a comment on that referrer page. Now the government subpoenas emptywheel for their database of commenter-names to IP addresses, and the government can make connections between emptywheel.net, the clicker’s IP, and your IP.

        I have confidence that emptywheel would do everything they could to protect our information, but the government is in the business of getting information from difficult sources. And with this regime, normal first amendment protections may not be sufficient.

  6. Amateur Lawyer at Work says:

    How is this not classic spoilation? How are judges not asking attorneys for instructions on telling juries *how* damaging the missing information is?

    • Peterr says:

      I think we’ll get there, once cases proceed to trial and ultimately to a jury.

      But more than spoilation, how is this not obstruction of justice? “Don’t worry about using proper cell phones . . . Don’t worry about archiving work-related texts and videos . . . Don’t worry about preserving evidence . . .”

      Once is a goof. Having a department-wide policy that amounts to hiding evidence goes well beyond a goof.

      • grizebard says:

        It looks like they really don’t care. The whole point is increasingly violent and unrestrained intimidation, and evidence go hang. Brownshirt bully theatre, with intent. Aiming either to shut all effective public opposition down, or alternatively create such scenes of confused mayhem for the cameras as to conjure up the Insurrection Act Excuse forTrump that he so evidently desires and needs for the mid-terms. An evil win-win whatever.

        If court cases fall apart in the fullness of time, so what? These brownshirts are now so drunk on unfettered power they’ve lost all sight of consequences.

  7. Savage Librarian says:

    MAGA’s Party

    MAGA’s Party
    and they’ll lie if they want to
    Lie if they want to
    Lie if they want to
    Would you lie too
    if the Big Guy asked you?

    Nobody knows
    where hush money has gone
    Duty left the same time
    Who was it hiding their hand
    when they’re deposed
    for a crime?

    MAGA’s Party
    and they’ll lie if they want to
    Lie if they want to
    Lie if they want to
    Would you lie too
    if the Big Guy asked you?

    Playing with records,
    Keep chances staged right
    But leave them alone about files
    Their crummy chances will be
    exposed when this goes to trial

    MAGA’s Party
    and they’ll lie if they want to
    Lie if they want to
    Lie if they want to
    Would you lie too
    if the Big Guy asked you?

    Duty and money
    that’s hawked on the floor
    Laundered clean for this thing
    Oh, what a MAGA surprise
    Duty’s gone second-string

    MAGA’s Party
    and they’ll lie if they want to
    Lie if they want to
    Lie if they want to
    Would you lie too
    if the Big Guy asked you?

    https://www.youtube.com/watch?v=VzVJdhuAxrk

    “It’s My Party – Lesley Gore {Stereo} 1963”

    • Ginevra diBenci says:

      I’m hearing your words sung in Lesley Gore’s voice because I am *that* old–old enough to remember dancing to that song on the radio as a very young child. The way you conjure nostalgia and use it to cloak your arrows of social and political commentary never fails to astound me.

      As always, thanks from a fangirl!

  8. Bugboy321 says:

    At least according to legal staff at my county government employer, public employees using personal phones to record video while on the clock by definition makes that record a public record, subject to documents request under the FOI Act.

    Not that breaking the law is any sort of obstacle to this clown posse.

    • Error Prone says:

      Rather than an obstacle, it could be an objective. How do you heat up protest to where you can say the protesters are being illegal? You follow an ICE agent’s car, okay, you block it in somewhere, you arguably are obstructing. Luring a bystander into an illegality can be a part of the plan, as there might be propaganda value to inflaming hate, then criticizing it as stepping over a line between lawful or unlawful reaction. In Minnesota the Gov and mayor are explicit, don’t get drawn into overreacting, but do video-phone documentation, as it’s your right and not illegal. The post here seems to be a tactic to make discovery harder, and sandbag away some evidence. But there also is intentional provocation which is ICE conduct in Minnesota.

Comments are closed.