Authorities have released security footage showing a person approaching Nancy Guthrie’s front door the morning she disappeared. NBC’s Today host Savannah Guthrie’s 84-year-old mother has been missing since February 1st.
FBI Director Kash Patel posted on X that an image had been recovered showing “an armed individual who appears to have tampered with the camera.” Patels asked anyone with information about this incident to call 1-800-CALL-FBI or visit http://tips.fbi.gov.
Let’s take a closer look at what we know so far.
The video contains a Nest watermark. An empty mount was later seen attached to the door frame and appears to match one designed for Google products. It was previously reported that Guthrie did not have access to the footage because he did not have a subscription.
In a social media post, Patel said the video footage was discovered following an ongoing effort with “private sector partners” to “recover images from within the home that may have been lost, corrupted or otherwise inaccessible due to a variety of factors, including the removal of recording devices. The video was recovered from residual data on back-end systems.”
Authorities said the doorbell camera was disconnected at 1:47 a.m.
He announced that he had discovered “new, previously inaccessible images showing an armed individual who appears to have tampered with Nancy Guthrie’s front door camera the morning she disappeared.”
Google, the maker of Nest cameras, did not respond to a request for comment. Google Nest’s help page explains how to record video with different plans.
The suspect, wearing disposable gloves and a backpack, can be seen fiddling with the camera before walking away.
Kelly Bergin, dean of cybersecurity at Montreat University in North Carolina, said the images and videos released by the FBI were likely part of a recording caused by the move that was temporarily uploaded to Google’s servers.
“Often the camera is triggered by movement and only records snippets. Unless there is further movement, the camera will not continue recording,” she said.
For users to access such cameras, data is sent to a Nest Google cloud server via a WiFi connection, she said. “If you have a (storage) plan, it will be stored and categorized for users to access,” she said.
Even if a user doesn’t have a storage plan (authorities say Guthrie didn’t have one), they can watch the live stream on the phone app, which requires the data to be sent to a cloud server first. However, they are typically overwritten after a certain period of time and are “not stored or categorized by subscriber, so they are considered inaccessible.”
He said Patel’s statement that the video was on a “back-end system” was likely referring to a cloud server rather than on a phone or device.
Eric O’Neill, a former FBI counterintelligence officer, cybersecurity expert, and author of the book “Spies, Lies, and Cybercrime,” said that even without a subscription, doorbell videos can reside temporarily on a company’s servers in so-called temporary storage for processing, behavioral analysis, and distribution to apps.
Cloud systems are also built for reliability, which means data is frequently replicated, recorded and buffered to avoid accidental loss, he said. When a company says a video has been “deleted,” it usually means that the video is no longer visible to users, rather than immediately deleted. The underlying data may continue to exist until it is overwritten, and that short period of time is often sufficient for investigators working with the provider to recover or reconstruct the footage.
Kyungsik Choi, director of cybercrime and cybersecurity at Boston University Metropolitan College, said this residual data can still remain on server systems that store, process, or temporarily cache video files and metadata.
“With the appropriate legal authority, law enforcement can recover this residual data from these back-end systems, and that’s what appears to have happened here,” Choi said.
That it took the FBI more than a week to identify the footage comes as no surprise to Morgan Wright, a senior fellow at the Digital Government Center who previously worked in law enforcement. He said scrutinizing data using digital tools takes time.
“It’s not as easy as people think,” he says.
Still, Bergin said digital forensic tools can find data even after it has been deleted. She said she once recovered data from a hard drive that was accidentally formatted.
“Digital information typically remains there, even if it’s deleted or temporarily stored, because it’s there until it’s overwritten,” she says. “That’s something that a lot of people don’t understand. And with the right forensic tools, you can recover large amounts of data from hard drives and servers that aren’t necessarily accessible through normal routes.”
Wright, who previously worked as a detective, said the video contains obvious facial features, such as a mustache, and investigators should be able to calculate his height, shoe size and clothing brand.
Police say there are multiple cameras in the home, so additional video may be discovered, Bergin said.
“I hope that by putting that video out there, they get a break and maybe somebody realizes something,” Bergin said.
Pima County Sheriff Chris Nanos told reporters at a Feb. 5 press conference that doorbell cameras helped authorities piece together a new sequence of events in Guthrie’s kidnapping. Guthrie was first reported missing on Sunday, February 1, after concerned church officials called her family to let them know she was not attending morning services.
Nanos said it was working with a technology company to recover the video but was unsuccessful. “We know that the technology company has run out of ways to restore that video,” he said. Asked if police had a doorbell camera in their possession, Nanos said: “We don’t have it and we couldn’t find it.”
The full timeline provided by authorities is below.
January 31st 5:32pm Guthrie traveled to his family’s home for the night of the game.
January 31st 9:48pm When her family dropped her off at home, the garage door opened.
January 31st 9:50pm The garage door is closed.
February 1st 1:47am The doorbell camera in front of Guthrie’s home was disconnected.
February 1st 2:12am The smart home software has detected a person on the camera, but video is not available.
February 1st 2:28am Guthrie’s pacemaker app shows it has been disconnected from her phone.
February 1st 11:56am Her family is checking on her.
February 1st 12:03pm Her family called 9-1-1 to report her missing.
February 1st 12:15pm A police car arrives.
Video analysis of Nancy Guthrie reveals new details
The FBI has released new security camera footage from the night Nancy Guthrie went missing. Let’s take a closer look at what the video shows here.
