The Private Network: Inside Epstein's Closed Communications System

In a deposition from the case L.M. v. Jeffrey Epstein and Sarah Kellen, a former house manager named Alfredo Banasiak was asked about the computers in Epstein's properties. The exchange, preserved in DOJ document 24402695, is matter-of-fact:

Q: Were you aware that Mr. Epstein used a Citrix program to link various computers? Did you know that? A: Yeah. I use Citrix too in my computer for exchanging e-mails and get through Internet. Q: You weren't in the loop of the sharing of information in the house in terms of the computers being connected through any server? A: I don't really know how to answer your question because Citrix is for the whole organization to exchange e-mail between employees. So, even my computer is connected to Citrix. I can receive mail and I can e-mail information to employees.

For the whole organization. Not Gmail. Not Yahoo. A private, server-based system running Citrix software, linking employees across Epstein's properties in New York, Palm Beach, and the U.S. Virgin Islands. A system built by a Columbus, Ohio technology contractor listed in Epstein's black book as a "Citrix Systems Programmer." A system whose parent company was subpoenaed as a records custodian. A system that, on a single day in April 2011, was shut down on Epstein's direct orders.

No major publication has investigated this infrastructure. The depositions are public. The black book entries are public. The emails about the system's operation and shutdown are sitting in the EFTA release. This is what the documents show.

The Architecture

Jeffrey Epstein's communications ran on two layers. The outer layer was conventional: a Gmail account ([email protected]) that generated more than 350,000 emails in the EFTA release, a Yahoo address ([email protected]) used for roughly 2,600 messages, and a handful of other accounts. These lived on commercial servers operated by Google and Yahoo, subject to standard legal process and, in principle, searchable by law enforcement with a warrant.

The inner layer was different. Epstein's organization maintained a private Citrix server, almost certainly running Citrix MetaFrame, the dominant remote-desktop product of the early 2000s. MetaFrame allowed users at different locations to log into a single central machine and access shared applications: email clients, contact databases, scheduling tools. All the data lived on the server, not on individual computers. The system was accessible from any property with an internet connection, but the data never left the host machine unless someone moved it.

This distinction matters. A Gmail subpoena goes to Google. A Citrix server subpoena goes to whoever controls the hardware. In Epstein's case, that was Epstein.

A separate email ecosystem existed on MindSpring, an Atlanta-based internet service provider that merged with EarthLink in February 2000. MindSpring offered consumer and business email hosting, and multiple members of Epstein's inner circle held accounts on its servers. Ghislaine Maxwell used [email protected], the account from which she emailed Doug Band, then an aide to President Clinton, offering to arrange a dinner with "the sluty Spanish girl which will be nicely counter balanced by the cool poised Swedish type." Mark Epstein, Jeffrey's brother, used [email protected] for years of personal correspondence. Sarah Kellen, Epstein's primary scheduler, used [email protected] on the post-merger EarthLink platform. A federal subpoena demanded "subscriber records, order history, billing/shipping information, and means and source of payment from January 1, 1994 until January 1, 2005" for Maxwell's MindSpring and EarthLink accounts.

A deposition witness described the MindSpring system as "a message system that would come from the office," distinguishing it from ordinary telephone communication. Messages would arrive at a property, be printed or relayed, and delivered to Epstein or his staff. Former house manager Juan Alessi testified that Epstein used this convoluted process to send routine instructions like "Jeffrey wants a cup of coffee" rather than speaking to staff directly. The indirection was deliberate. Email headers in the EFTA files show traffic routed through the cable IP address user-121dmv2.cable.mindspring.com, indicating a physical cable modem connection tied to the MindSpring/EarthLink network.

When Lesley Groff needed to look up a phone number, she used the Citrix directory. When Bella Klein was locked out of Citrix, she could not access the organizational contact list. When the system went down, the entire staff scheduling apparatus went with it. This was not a convenience tool. It was the nervous system.

The Programmer

Tim Newcombe appears twice in Epstein's black book. On page 77, he is listed as "Timothy W. (Tim) Newcombe" with his company, "Newcombe Electronic Systems," and two addresses in Columbus, Ohio: 2328 Arlington Avenue and 9005 Antares Avenue. Six phone numbers follow, all with the 614 area code. On page 95, he appears again, this time with a single designation: "Citrix Systems Programmer."

Newcombe Electronic Systems is a real company. It was founded in 1978 and remains in operation at 9005 Antares Avenue, Columbus, Ohio 43240. The firm describes itself as a provider of voice and data infrastructure, commercial audio/video systems, and advanced technology installations. Its clients include pharmaceutical companies, data centers, hospitals, and educational institutions. It has been ranked among the fastest-growing companies in Central Ohio.

The black book does not list Newcombe as a social contact, a financial adviser, or a dinner guest. It lists him as the person who programmed the Citrix system. His role was technical and specific: he built the private communications infrastructure that the entire organization used.

Handwritten annotations in the back pages of the black book include the word "Citrix" at the top of several pages, suggesting the system was significant enough to merit its own section in Epstein's contact records. In August 2025, a Freedom of Information Act request was filed with the FBI seeking records on Timothy W. Newcome. An independent researcher reported that the FBI's response cited concerns about potential harm to national security and declined to release any records. The FBI has not publicly commented on Newcombe's role or on the disposition of any Citrix-related evidence.

The System in Action

The EFTA emails reveal the Citrix system not through technical documentation but through the moments when it failed.

On February 10, 2011, Lesley Groff emailed Epstein with a problem. Scott Denett, the IT manager, and a technician named Jermaine had both tried to fix Citrix remotely and could not. Groff wrote, preserved in EFTA01834857:

"Scott and Jermaine both have tried to fix Citrix remotely and cannot do it. Scott is speaking to Rich Barnett on it to see if he can guide him through to bring us back up. BUT, if Rich Barnett and Scott can't get it up and running he is suggesting he get a PC tech in to help... or Scott could come back and put his own 2 hands on the system."

The next day, Denett reported that Jermaine Ruan, the IT administrator at Epstein's Financial Trust Company in the Virgin Islands, was having connectivity issues. In EFTA00904059, Denett wrote:

"Spoke with Jermaine. FTC is logging into citrix but is slow. I have asked him to please send a blast out to all FTC users to not use Internet services today for anything but business, as bandwidth and connectivity to NYC is slow."

FTC: Financial Trust Company, Epstein's USVI entity. "Logging into citrix": connecting remotely from St. Thomas to the central server in New York. "Connectivity to NYC is slow": the physical limitations of routing island traffic to a Manhattan server over consumer-grade internet. The entire USVI office depended on a persistent connection to New York to access their scheduling and communication tools.

When the system was down, the consequences were immediate. On that same day, Groff sent another email, EFTA01834892:

"I do not have access to our directory with Citrix down so I do not have Ramsey's phone number."

She could not call Ramsey Elkholy because his contact information existed only inside the Citrix directory. Without the system, she was cut off from the organization's own records.

A separate deposition captures the same dependency from a different employee, documented in EFTA00310278:

Q: Did you also send each other e-mails that way or did you use a different program for e-mails? A: [She] didn't send direct e-mails to me but she will call me on her cell. But I was supposed to send through Citrix to other employees. Q: E-mail them through Citrix? A: Yes, ma'am. Q: And who would those other employees be? A: Mrs. Maxwell, Bella in New York, mostly the main people.

The Citrix system was how employees communicated with Ghislaine Maxwell, with Bella Klein, with each other. It was the internal channel.

The Kill Switch

On April 17, 2011, roughly two months after the connectivity crisis, Scott Denett sent an email to Richard Kahn, CC'ing Lesley Groff. The message, preserved in EFTA02190185, consisted of a single directive:

"Per JE CITRIX IS DEAD ANY ISSUES LET ME KNOW"

Per JE. Per Jeffrey Epstein. The decision to shut down the system came from the top. Groff's response was immediate and telling:

"I want to see the song from the wizard of oz: the wicked witch is dead!"

The staff celebrated. Whatever the Citrix system had been, the people who used it daily were glad to see it go. The question the EFTA files do not answer is what happened to the server. A Citrix MetaFrame installation stores all user sessions, application data, email archives, and scheduling records on the host machine. When Epstein ordered the system killed, did someone also kill the data? Citrix Systems, Inc. was subpoenaed as records custodian #144 in the case, suggesting investigators understood what the server might contain.

23,094 Emails During Incarceration

On June 30, 2008, Jeffrey Epstein pleaded guilty to state prostitution charges in Palm Beach County. He was sentenced to 18 months in the Palm Beach County Stockade, serving from July 2008 to July 2009 under a controversial work-release arrangement that allowed him to leave the facility for up to 12 hours per day, six days per week.

The email records in the EFTA release tell a specific story about what that work-release period looked like from the inside. Between July 2008 and August 2009, the jmail database contains 23,094 emails associated with Epstein's accounts. The monthly breakdown:

The volume never dropped to zero. During the months of strictest confinement, August through December 2008, the accounts were still generating between 166 and 247 emails per month. By April 2009, the volume exploded to nearly 4,000, and by July it exceeded 6,000. The infrastructure did not stop because its operator was in custody. It kept running.

For context, the overall jmail corpus shows 4,614 emails in all of 2008 and 57,831 in 2009. By 2011, the annual volume had reached 180,181. By 2012, it exceeded 200,000. By 2017, it was above 202,000. The digital footprint of the operation grew continuously, year over year, regardless of legal proceedings.

The pattern repeated in 2019. On July 6, Epstein was arrested at Teterboro Airport. The jmail database shows 70 emails on the day of his arrest and 319 on July 8, the first business day after. Email activity continued daily through his detention at the Metropolitan Correctional Center until his death on August 10. The infrastructure, once again, kept running after the principal was in custody.

The Island Technician

The person who maintained the technology on Little Saint James was Jermaine Ruan. He served as MIS Administrator at Southern Trust Company, the renamed successor to Epstein's Financial Trust Company in the U.S. Virgin Islands.

Ruan's responsibilities went beyond Citrix connectivity. In December 2017, he contacted Ubiquiti Networks for equipment recommendations. By January 2018, Epstein responded to a procurement list of Ubiquiti products with two words: "order today." FBI photographs taken after Epstein's 2019 arrest confirmed Ubiquiti UniFi Video G3 cameras installed across the island. Ruan had also configured a Logitech cloud-based recording system, with login credentials referencing "lsj" (Little Saint James) and a password that read "#1island."

Two days before his death on August 10, 2019, Epstein signed a final trust document that named 36 beneficiaries. Beneficiary number 25 was Jermaine Ruan. The amount: one million dollars.

Ruan now works for the U.S. Virgin Islands Bureau of Corrections as an MIS Administrator, earning $69,890 per year. The person who installed and maintained surveillance cameras on Jeffrey Epstein's private island, who logged into the Citrix system from St. Thomas, who was named a million-dollar beneficiary of Epstein's estate, now administers information systems for the territory's prison system. No public reporting has addressed this career transition or what, if anything, Ruan disclosed to investigators about the digital infrastructure he maintained.

What Was on the Server

The EFTA files document the existence of Epstein's private communications infrastructure in granular detail. They record who built it, who maintained it, who used it, when it broke, and when it was shut down. They show the email traffic that continued through incarceration. They identify the programmer in Columbus, Ohio and the technician in the Virgin Islands.

What the files do not contain is the data that was on the server itself.

A Citrix installation from the early 2000s, running MetaFrame on a Windows server at 9 East 71st Street, would have stored years of internal emails, scheduling records, contact databases, and application logs. Every employee who testified about using "the Citrix system" was accessing a centralized record of the organization's daily operations: who was scheduled, when, where, and by whom.

The subpoena of Citrix Systems as records custodian #144 suggests that investigators at least asked the question. Whether the server hardware was preserved, whether the drives were imaged, whether the scheduling database survived the April 2011 shutdown order: those questions remain unanswered. An independent researcher who filed a FOIA request with the FBI for records on the system's programmer reported that the Bureau cited national security concerns in its refusal to release any documents. If accurate, that response suggests the answers may be more complicated than a simple yes or no.

The documents that describe this system are searchable. The depositions are public. The black book entries are readable. The emails about outages, shutdowns, and surveillance camera orders are in the EFTA release. The infrastructure was real. The question is what it recorded, and where those records are now.