How 9 Months of Camera Footage became 8 Years

Even while Trump’s attorneys argued that he should be permitted to discuss classified information on private property that was already targeted by foreign spies before it became clear he was hoarding boxes of classified records there and may not have turned everything back, they argued that to investigate what happened with the stolen classified documents while in Trump’s custody, the FBI had to get 8 years worth of camera footage.

Actually, more than that. Trump’s response claimed that three-quarters of the total surveillance video turned over to date makes up 8 years, meaning the total would amount to around 128 months of surveillance footage.

To be sure, this is part of competing efforts to inflate (Trump) or understate (DOJ) the amount of discovery in this case.

I’m tracking those competing claims about what has been turned over in this table.

The latest claims — that would suggest that DOJ had turned over around 128 months worth of surveillance footage — reflect an evolving methodology on Trump’s part. On July 10, Trump’s lawyers described the initial batch of surveillance footage to be “approximately nine months of CCTV footage.”

The initial production also included some 57 terabytes of compressed raw CCTV footage (so far there is approximately nine months of CCTV footage, but the final number is not yet certain).

On July 18, Todd Blanche described that the footage Trump’s discovery vendor had uploaded as of that morning amounted to 1,186 days — or “over three years” worth of video.

Your Honor, just starting with a question you asked Mr. Bratt a while ago about just one part of the discovery, which is the CCTV footage, which is extraordinarily significant to this case, not only as what’s obvious from the indictment, but it also in part gave rise to the search warrant, the affidavit, and the probable cause to search Mar-a-Lago. As of this morning, there’s 1,186 days of footage that we have uploaded so far, and our vendor is not finished uploading it. And again, I’m not questioning Mr. Bratt’s position about the time period, but there’s multiple cameras that were subpoenaed and that have been produced to us as Rule 16 discovery; and as of today, it’s over three years’ worth of video.

Now, I’m not suggesting to the Court that we’re going to sit for three years and watch three years’ worth of video, but it’s a tremendous amount of data and information, and we’re just — I’m just talking right now about the CCTV footage. While the Government is correct that they have pointed us to the few days that they believe are the most significant to them as it relates to the charges in the indictment and presumably the search warrant, they’re not the most significant to us. I mean, the movement of boxes and where boxes were on given days is extraordinarily significant not only to the justification for the search warrant of the President’s residence but also to the defense of the case. And so the CCTV footage alone, over 1,186 days, makes the schedule the Government proposed pretty disingenuous, Your Honor.

Yesterday’s filing describes that when Trump’s vendor finished uploading that first batch of surveillance footage — which was 57 terabytes out of 76 total — it amounted to 8 years of footage.

Furthermore, the government has produced approximately 76 terabytes of compressed raw CCTV footage, which is itself an incredible volume of material. Last week defense counsel finally finished processing the intake of CCTV footage that the government produced on June 21—the 57 terabytes of CCTV footage produced on June 21 totals nearly eight years of video. On July 31, the government produced an additional 19 terabytes of CCTV footage, including, according to the government’s production letter, “footage that was produced to the government in May that was not included in the government’s first discovery production.” Counsel recently received a hard drive with CCTV footage referenced in the government’s July 31 letter, and we are still processing that discovery to assess the total length of additional video the government produced.

That’s where my 128 months estimate comes from: if 57 terabytes amounted to eight years, then 76 might amount to 10.66.

To be sure, this effort to maximize the scope of the surveillance footage is just meant to impress Judge Cannon and it might well work.

But it also provides some way to reverse engineer what the scope of the surveillance footage really is.

For example, if the scope of this includes footage spanning 9 months of time, as Trump originally claimed, then 10.66 years of footage might suggest 10 cameras were ultimately obtained; according to the search affidavit, there were 4 cameras — from the hallway outside the storage room — covered by the initial production, and by counting using Trump’s new method, 2 months of footage from four cameras would amount to eight months of surveillance footage.

It’s funny math, but now there’s more than 16 times that.

Note that in July, Bratt confirmed the unsurprising detail that some of the footage is from Bedminster (which is probably why DOJ hasn’t done a search on Bedminster — because they could validate the thoroughness of the search done in November or December).

MR. BRATT: So it covers a nine-month period, but not all the cameras were — but it is not all the cameras at Mar-a-Lago or Bedminster; not all the cameras were always running. And the retention period that the Trump organization had varied from camera to camera, so it is not a solid nine months of video footage.

Now, I’m interested in the scale of the footage for several reasons. Yesterday’s motion pointed to the 8 years of footage as proof that nothing ever got deleted.

As relevant here, the charges allege various obstruction-related conduct arising out of false claims of efforts to destroy certain video tapes. No videotapes were deleted or destroyed and the government does not so allege; indeed, President Trump has produced to the Special Counsel’s Office what amounts to more than eight years of CCTV footage.

It’s certainly possible that when DOJ started the investigation that led to multiple obstruction charges, they were just trying to figure out why Trump totally blew off the part of the initial subpoena that asked for locations in addition to the hallway outside the storage room (which I laid out here).

Particularly given that the claim accompanied the suggestion that the alleged attempt to delete footage in June 2022 was “false,” I certainly wouldn’t credit the amount of footage eventually obtained by the government as proof that nothing was deleted. It’s not even clear that all the footage comes from Trump Organization, much less the guy who used to be President.

But the other reason I remain obsessed about the amount and types of surveillance footage here (besides, perhaps, my PhD in literature), has to do with the types of questions investigators may have been trying to answer.

Take, for example, the claim by Bratt on July 18 that the movement of boxes key to the initial obstruction conspiracy happened on May 24 through June 2.

With respect to the closed circuit television and the movement of boxes, I would just note that the movement of boxes occurred between May 24th and June 2nd. So it’s not years’ worth of video with respect to the movement of boxes.

If so, that would suggest Nauta’s movement of a single box on May 22 was something besides an attempt to obstruct the subpoena response.

Or consider the way Trump’s lawyers boast about what an unusual place Mar-a-Lago is.

We similarly reminded the government of the uniqueness of President Trump’s residence, including that it is in a highly protected location guarded by federal agents that previously housed a secure facility approved for not only the discussion, but also the retention, of classified information. The government’s Motion suggesting we anticipated discussing classified information in an unsecure area is wrong, and they are fully cognizant of that fact. Similarly, the government’s statement to the court in its Motion that President Trump’s personal residence should be compared to the residence of “any private citizen” is misleading. This is especially true given the necessary protections afforded to our nation’s leaders after they leave office and the uniqueness of the location of President Trump’s residence, coupled with the fact that a secure location already existed for the relief sought herein and can be re-established with appropriate safeguards.6

6The statement comparing President Trump’s personal residence at Mar-a-Lago to that of “any private citizen” is all the more disingenuous considering a member of the prosecution’s trial team has visited the Mar-a-Lago property during the course of the investigation and is therefore personally aware of the differences between President Trump’s residence and that of “any private citizen.”

This neglects to explain why no sane person would want to restore a SCIF at Mar-a-Lago as explained very easily in the indictment.

The Mar-a-Lago Club was located on South Ocean Boulevard in Palm Beach, Florida, and included TRUMP’s residence, more than 25 guest rooms, two ballrooms, a spa, a gift store, exercise facilities, office space, and an outdoor pool and patio. As of January 2021, The Mar-a-Lago Club had hundreds of members and was staffed by more than 150 full-time, part-time, and temporary employees.

Between January 2021 and August 2022, The Mar-a-Lago Club hosted more than 150 social events, including weddings, movie premieres, and fundraisers that together drew tens of thousands of guests.

Mar-a-Lago shouldn’t be compared to the residence of “any private citizen,” sure, but for entirely different reasons than Trump’s lawyers want to admit: it’s a counterintelligence nightmare, and was long before Trump started hoarding classified documents in the gaudy shower, and was even ignoring the known targeting of the compound by foreign spy services.

One thing those surveillance videos are going to show is people besides Walt Nauta who got into the storage closet, perhaps to stash their guitar there, and in the process knocking over and discovering classified records that as a result have to be burned.

If there really is over 10 years worth of video surveillance, spread across a bunch of cameras and two properties, it’s likely some of the surveillance will show stuff Trump didn’t control, but stuff for which he should be held accountable.

Update: Added the quote about Bedminster bc as coalesced notes, Bratt’s comment about retention period is also worth noting.

image_print
47 replies
  1. SaltinWound says:

    Any chance they got footage from neighbors’ security cameras? I’m thinking of the account of Nauta and DeOliveira leaving the property to speak privately.

  2. coalesced says:

    This statement from Bratt on page 10 struck me as interesting; “The retention period the Trump Organization had varied from camera to camera.”

      • jecojeco says:

        Hi Marcy, Thanks for the work adding these intersting points. I’m not surprised by differing retention periods, trump org isn’t large, sophisticated or consistent, the retention periods for individual cameras is probably dictated by retention capacity of individual camera set ups – no organization-wide protocols.

    • Tech Support says:

      On a purely technical level, this part seems trivial. If you’re using digital recording and each camera is an independent device on the network and all the data is being uploaded to a remote storage location (even if the content is staged on local servers for some period), then it seems almost inevitable that the security provider is going to offer device-level configuration of various parameters (constant or motion-activated, retention period, etc.) as a feature.

      It’s likely that the client chooses (or inherits from the vendor) a default retention period for all devices when the system is deployed and then can update parameters at any time via some sort of administrative UI (either web based or some type of installed client software). There’s no telling what the business logic is that will drive some cameras to have a longer retention period vs a shorter one, but it does lead to some interesting questions:

      1. Does dramatically shortening the retention period of a given camera constitute “deletion”?
      2. Does the vendor have a “no backsies” policy of purging data as soon as retention periods are shortened, or does so fairly quickly as a periodically maintenance job?
      2.a. Alternatively, does the vendor have a grace period as a hedge against deletions that are accidental or are quickly reconsidered?
      3. Does the vendor have a backup strategy which leads to “purged” data being unavailable in the live system but is still retained somewhere in long-term storage?

      There’s a lot of moving parts here but it seems to me there is a strong possibility that DOJ had little trouble getting whatever footage that Trump’s team refused to turn over by issuing a subpoena to the vendor.

      Last thought:

      “No videotapes were deleted or destroyed and the government does not so allege”

      Given that it sounds like none of this footage was EVER recorded or stored on literal videotape, how much of this statement is just some weird form of trolling the defense for using imprecise language?

      • StevenL says:

        That rather odd language caught my eye also, though the part about no government allegations to date is true for video information writ large.

    • CaptMike says:

      Local retention can be space rather than time based (keep xx gigabytes, start writing over old footage when allocated space is full). Combined with motion detection this can result in high traffic areas having shorter retention periods than low traffic areas. Offsite could be streaming backups with time, space, or hybrid retention, or it could be archival backups of the local storage. The archival storage approach is less likely unless the system was built in-house.

      • WhisperRD says:

        This is a more realistic explanation than Tech Support’s. In theory, security people could micromanage retention time to vary it from camera to camera. But that hardly seems likely. Who would bother? And why? Having a fixed amount of disk space dedicated to this purpose sounds not only likely, but more likely than not.

        • misnomer bjet says:

          With space-based retention & displacement, beefing up surveillance in high traffic areas (adding cameras, motion detection or sensitivity, & time a motion-triggered camera stays on) would bump data from low traffic areas off quicker.

          [Thanks for updating your username to meet the 8 letter minimum. Please be sure to use the same username and email address each time you comment. /~Rayne]

  3. David F. Snyder says:

    Trump inflates sizes: his wealth, his IQ, his video footage, his mushroom.

    I can well imagine that if Cannon falls for this SCIF bluff, Bratt appeals. This is serious stuff.

    And thanks for the chuckle re obsessive tendencies of PhDs.

  4. ChicagoDD says:

    “No videotapes were deleted or destroyed”. (We edited the bejusus out of them but did not DELETE them…”). CYA verbiage?

    • ToldainDarkwater says:

      As far as I can see no videotapes are involved whatsoever. It’s all digital. I would read that sentence as void of any meaning or assurance.

      • ChicagoDD says:

        Bingo, realized that as soon as I hit post. Man, would either of those possibilities be (A. didn’t “delete” but blithely edited, or B. “no physical vid tapes even used…. due to all data digital) disingenuous, almost insulting, or what? Gratuitously so. I’d like to see someone pose that clarifying Q to DJT attorneys.

      • Ken Muldrew says:

        I think that sentence was meant to poke fun at Trump’s tirade on TRUTH Social from about a week ago where he wrote, “MAR-A-LAGO SECURITY TAPES WERE NOT DELETED. THEY WERE VOLUNTARILY HANDED OVER TO THE THUGS…”

      • vigetnovus says:

        I am so proud of myself that this was the very first thought I had after reading this too. Emptywheel has trained my mind well…..

    • Rayne says:

      That, right there — this is like Trump’s demand for the mythological “single server” after the DNC had been hacked by Russia in 2016.

      There were *never* videotapes. Only digital video which was streamed to storage.

      The use of the term “footage” by either the government or Team Trump exacerbates this problem as the term is now archaic when used in reference to electronic video surveillance streamed to hard drives.

      • ChicagoDD says:

        Right. And pls lmk if you figure out how to “delete a server”. Unless it’s firing one of his Mara-Lago waitstaff it’s beyond me.

        • ChicagoDD says:

          I got you: if its’s a virtual disk on a hard drive it can of course be deleted, bye bye to that volume – I was tacitly thinking of “deletion” of a physical rackmount item (?) and consequently what would have been the strange verbal (mis)usage.. I kinda wouldn’t think DJT would be that hip but you are correct.

        • WhisperRD says:

          A server is more likely to be “wiped” than “deleted.”

          Data is deleted. Drives are wiped (or reformatted, or….)

          Servers? It’s not really the correct verb. (Or noun.)

          The gap between the legal community and the IT world is enormous.

        • Rayne says:

          Nah. See ChicagoDD’s response re virtual disk as it’s much closer to what would happen in a data farm environment.

          Only time I ever wiped a server’s drives was during a decommission of a lone box serving an entire facility, or decommission of individual drives from a rack-mounted server in a data farm. The content was already copied to a new virtual server in new drive(s) and possibly in new physical server(s) while mirror images and clones of data remained intact and undisturbed at remotely located data farms.

          Be careful with the broad brush. I won’t disagree with the gap in knowledge in general between IT and legal communities, but I’ve worked for legal and IT departments in the same corporation which had a Legal IT department to bridge that gap. Some of this gap is fucking deliberate.

        • ToldainDarkwater says:

          As a software/game developer, I once was employed at a company that, in the end, went chapter 11. We operated LBEs around the US that ran on extensive physical equipment along with elaborate simulation software. At least one of these sites had a lien posted against the physical equipment. But not the software. So on the last night of operation before Chap 11, at the direction of management, I sent out a command that deleted all files on all the hard drives at that site (there were maybe 100 of them (for some that’s small potatos) and then ran a program that opened a file on that same hard drive and started writing nonsense data on it, continuing to write forever (or at least until we were out of space). The nonsense data, in hexadecimal notation, was 0xdeadbeef This is a popular designation of garbage, since hexdumps are common and that sequence of bits is otherwise very unlikely.

          This was done to prevent easy recovery of the files that had been deleted, since “deletion” of a file doesn’t actually make the data go away, as you may know. It just removes any normal way to find that data, and marks that space as available to be written on. So it can be recovered.

          I hope this tale at least amuses you, since it is a bit OT.

        • Baltimark says:

          As Rayne notes, life is different in a virtualized environment. If you are running VMware or utilizing any of the many cloud services like Amazon or Azure, you have lots of use cases for quite regularly — or irregularly — creating or removing entire virtualized servers from your pool of virtualized tools (oftening referred to as “spinning up” and “spinning down”. In AWS at least, such virtualized servers are more commonly referred to as “instances,” but I have heard folks say “server.”

          As with others here, the phrase raised a flag with me when I first read it. It does sound like clumsy non-techspeak. But only barely. Replace “server” with “instance” and it would be a normal thing to say in AWS. That said…

          My gut finds it hard to imagine Mar a Lago was running heavily virtualized systems, though that question is complicated by the parameters required by the surveilance vendor (and THAT is not a realm in which I’m conversant). Proactively moving to aggressive virtualization — especially cloud-based (as opposed to local VMware) — just doesn’t seem like the Trump Way. First because it would have been smart, second because the mgt talent is a little pricier, and third because keeping all the dirty laundry off premises (again, aside from third-party vendor stuff like say the video) doesn’t seem vibe consistent with their mafioso ways.

          As a side note (maybe), virtualized environments are more likely to separate data storage from servers qua servers. So for instance in a simple case in AWS, a stock server is an “EC2 instance” while a conventional storage repository is “an S3 bucket.” The latter is not PART OF the former. And the persistence of the latter in the absence of the former can depend on a number of architectural details.

          “Delete a server” was still, I think, very likely a naive non-technical misstatement. But am I sure? Not necessarily.

      • ExRacerX says:

        Their weaselly use of “videotape footage” puts me in mind of the the (nonexistent) “Hunter Biden Laptop” meme.

  5. Ichibod Crane says:

    One possible explanation is that they took the duration of requested time and multiplied it by the number of cameras. So two cameras operating for 100 hours would generate 200 hours of video.

      • ChicagoDD says:

        If the actual num hours recorded is so huge, (and the cameras are only on when motion activated?), either that seems to say that the most active cameras were the ones that had a broader view of the grounds, else the storage room had a lot more going on inside than anything DJT can claim as a secured/safe location.

  6. WilliamOckham says:

    I find the whole “8 years of footage” infuriating. A minute of footage represents the amount of data necessary to fill one minute when played back at normal speed. Eight years would be over 42 million times that much.

  7. timbozone says:

    Is it possible that there are multiple copies of the same time covered? It’s not clear yet whether some video data was deleted or altered by the conspirators. If the government is going to use comparison between video data obtained from Trump and that obtained from the security company’s cloud servers (and possibly other archival sources), there could well be a lot of video data to wade through. The beauty is though that is, if the video formatted data hasn’t been altered significantly, it should be easy enough to do content compares with modern software between video that purports to show the same content. If the government was able to find the discrepencies between copies then it shouldn’t be too hard for defense counsel to also find those discrepencies, particularly if the government highlights the inconsistencies between copies in advance of trial.

    • vigetnovus says:

      I don’t think the Trump Org derived video was “deleted” so much as it was selectively produced. Like, say for the motion activated cameras, they could have just produced video that was not inculpatory and claim that’s all they had. I’m not sure if the DOJ would have also gotten logs of when the recordings should have been as well to compare, or maybe, that’s what was altered, who knows.

      Another possibility is if DOJ had location data from say Nauta’s phone, and it was granular enough, they might know exactly when he was in the storage room and make sure they had timestamped video that corresponded to that. Any missing video would be suspect obviously.

      In any case, DOJ almost certainly got this video from any archival sources which may only be overwritten infrequently, something I am sure the geniuses at the Trump Organization may have realized too late they had no control over (and I’m guessing the DOJ anticipating this had already gotten preservation orders for these companies from the judge overseeing the GJ investigation as soon as they subpoenaed the Trump Org for video). Indeed that could be something that Taveras might’ve been investigated over and used as a point of leverage.

      In a semi-related way, I wonder if Jeffrey Clark wasn’t the key to breaking open the J6 fake electors plot because as a former DOJ employee, the OIG would be able to obtain evidence from his work computer, cell phone, emails, Teams chat, etc. without having to get a warrant (it’s all government property and not subject to 4th amendment concerns, nor is there an expectation of privacy). IP logs from his work computer or work phone, if he was dumb enough to use these devices, could have also demonstrated when (and with what service) he composed emails or DMs, or what have you to co-conspirators, which would greatly assist DOJ in knowing what sorts of materials to ask for from service providers in a content warrant. This info could have been obtained covertly by OIG and shared with the FBI.

  8. montysep says:

    DEFENDANT’S RESPONSE TO COURT’S AUGUST 3, 2023 MINUTE ORDER

    “Mr Trump would like to avoid trial for he and both his attorneys for the foreseeable future. However, since we lost 2024 as an option, we would respectfully request a setting for late 2025 (after July) or 2026 (all year). Respectfully submitted”

    • bmaz says:

      If that is real, and I do not think it is, please never do that here. If it is real, do you have a link? Pretty sure you do not. Don’t gaslight people on this blog.

    • earlofhuntingdon says:

      You’ll find that snark tags are essential. A simple [snark] at the end will do. Otherwise, your stay might be cut short.

    • ChicagoDD says:

      Ha, unless Nauta/whomever has a side hustle playing baroque music (viola d’amore), looks pretty much like a Gibson padded gig bag to me (guitar inside). Can’t really imagine the fmr Prez laying down anything too heavy musically, tho.

  9. jecojeco says:

    I assume all MAL sec cams are motion activated. Interesting to know if cams have been added or removed over the years and who decided where and why cams were located where they were.

    Has Sec Svc placed security cams in MAL as part of their protective service? Did US place cams or other electronic security devices in MAL to help secure the SCIF or generally improve security of a location certain to attract spies. (Ms DeRothschild and Chinese interloper loaded with electronics as two known interesting visitors.)

  10. Knowatall says:

    Slightly related: one presumes everyone entering MAL would be “id’d” in some fashion, and their whereabouts within the club could be monitored via the CCTV. Presumably DOJ/SS is aware of non-citizens/non-US residents who had access to the area(s) with documents.

  11. thorvold says:

    4 sealed docket entries have been added to the Mar-a-Lago court case. I don’t recognize the initials of the posters to be able to derive any info (I’m guessing that they are people in the clerk’s office).
    #115 and #116 posted Aug 11 by “kpe”
    #117 and #118 posted Aug 14 by “scn”
    Possibly it could be the Nauta reply to the Garcia motion that is due 8/17 (required by Order #100) and the government reply, but I kind of doubt that Nauta’s counsel would file anything early if they have a chance to take more time. If Nauta actually did reply on Friday, the govt working over the weekend and filing on Monday would not surprise me. They want a rocket docket.

Comments are closed.