Skip to main content
Skip to content
Evidence

THE 4CHAN PARAMEDIC LEAK & DEATH NIGHT EVIDENCE TRAIL

38 EFTA citations5,307 words9 persons referenced

On August 10, 2019, someone posted details about Jeffrey Epstein's death on 4chan a full 45 minutes before ABC News first reported it. BuzzFeed reporter Jane Lytvynenko flagged this to SDNY the same day, suspecting a paramedic leak. The FBI collected the 4chan posts as evidence, bates-stamped them as SDNY_00006978-00006979, and produced them as discovery in the guards' criminal trial (US v. Noel and Thomas, 19 Cr. 830). Defense attorneys for Tova Noel explicitly demanded to know the author's ide

THE 4CHAN PARAMEDIC LEAK & DEATH NIGHT EVIDENCE TRAIL

Forensic Investigation Report - Epstein FBI Files


EXECUTIVE SUMMARY

On August 10, 2019, someone posted details about Jeffrey Epstein's death on 4chan a full 45 minutes before ABC News first reported it. BuzzFeed reporter Jane Lytvynenko flagged this to SDNY the same day, suspecting a paramedic leak. The FBI collected the 4chan posts as evidence, bates-stamped them as SDNY_00006978-00006979, and produced them as discovery in the guards' criminal trial (US v. Noel and Thomas, 19 Cr. 830). Defense attorneys for Tova Noel explicitly demanded to know the author's identity. The government's response revealed a critical dead end: "The poster used a dynamic IP, and therefore the records obtained did not disclose the author of the post."

This investigation reconstructs the complete evidence trail across 1.8 million redaction records, 38,000 OCR records, and 20,000 analyzed images, mapping the 4chan leak alongside the broader digital evidence the FBI collected -- including an alleged Epstein employee's YouTube/4chan confession, Reddit's r/maxwellhill account screenshot, screenshots from kidsquest.com, an Imgur capture, a viral video, and Jean Francois Gariepy's YouTube connection.


PART I: THE 4CHAN PARAMEDIC LEAK

A. The BuzzFeed Alert -- August 10, 2019

Within hours of Epstein's death, BuzzFeed News reporter Jane Lytvynenko contacted SDNY with an urgent tip. Three separate EFTA documents capture this communication chain:

EFTA00034513 (earliest version, timestamped 6:03 PM on 8/10/2019):
"I'm a reporter with BuzzFeed News. I'm reaching out because we suspect one of the paramedics involved in responding the Jeffrey Epstein call posted information online before it was reported in the mainstream media. We were able to view posts on the website 4chan, frequented by far-right trolls, that were published a full 45 minutes before ABC news first reported Epstein's death. I'd like to send you the posts to verify whether the information in them is correct and whether it could have come to your team but in addition to that, do you have any statement on the situation?"
EFTA00034116 (forwarded version, timestamped 10:10:37 PM on 8/10/2019):

The email was forwarded internally at MCC/BOP with the subject line: "Fwd: Urgent request -- Potential leak in hospital regarding Epstein's death". The sender field shows "NYM/Exec Assistant" -- indicating the Metropolitan Correctional Center's executive office forwarded it.

EFTA00035482 (additional copy):

Same content, sent at 22:10:36 UTC on August 10, 2019, with attachment "TEXT_L.htm".

EFTA00019947 (Lytvynenko's initial inquiry, 1:25 PM on 8/10/2019):

Earlier the same day, before the 4chan tip, Lytvynenko had reached out broadly:

"I'm a reporter with BuzzFeed News. We're seeking reports that Jeffrey Epstein has died. Could you please confirm?"

All emails bear SDNY confidential bates stamps (SDNY_00010223, SDNY_00011231), confirming they were collected as evidence.

B. What the 4chan Posts Contained

DS9 documents now make the actual post content visible. Lytvynenko's second email (EFTA00040963, dated August 12, 2019) pastes the full text of post No.222520442:

"worked asystole arrest for 40 minutes, als intubated in the field/epi/2 liters NS infused. Telemetry advised bicarb and D50 in field. Pt transported to Lower Manhattan ER and worked for 20 minutes and called. Hospital administrator was alerted, preparing statements"

Lytvynenko specified: "The first post was made at 8:15 AM and the subsequent posts described in detail the first responders' actions. The first news report about Epstein's death was at roughly 9 AM." The 45-minute gap refers to the time between the first 4chan post (8:15 AM) and the first media reports (~9 AM), not the 11:12 AM press release.

The 4chan Report #2093 (EFTA00129268, DS9) reveals there were two distinct posters from two different IP addresses:

Poster 1 (IP: 107.77.223.177) -- 3 posts:
  • /pol/222518349 at 08:16:36 EDT -- Thread-starting post
  • /pol/222518664 at 08:21:58 EDT -- Follow-up
  • /pol/222520442 at 08:47:56 EDT -- Detailed paramedic medical post
Poster 2 (IP: 172.58.139.162) -- 1 post:
  • /pol/222520257 at 08:44:55 EDT -- A conspiracy post claiming MCC guard status, describing a "trip van," a "guy in a green dress military outfit," and "they switched him out." This post was attempted-deleted at 09:46:22 EDT but 4chan retained the content.

Both IPs are T-Mobile CGNAT (Carrier-Grade NAT) ranges, meaning both posters were using T-Mobile mobile devices. The paramedic poster used medical terminology consistent with EMS training; the conspiracy poster used corrections terminology ("0415 count," "trip van," "single man cell").

C. The Discovery Trail -- US v. Noel and Thomas (19 Cr. 830)

The 4chan materials were formally produced as discovery evidence in the criminal case against guards Tova Noel and Michael Thomas:

EFTA00025239 (Discovery Index, page 3):

``

Materials returned from 4Chan | SDNY_00006978-SDNY_00006979 | Protected Materials

Apple, Inc. subscriber records | SDNY_00006980-SDNY_00006984 | Protected Materials

AT&T telephone records | SDNY_00006985-SDNY_00007079 | Protected Materials

Comcast telephone records | SDNY_00007080-SDNY_00007084 | Protected Materials

Sprint telephone records | SDNY_00007085-SDNY_00007103 | Protected Materials

Verizon telephone records | SDNY_00007104-SDNY_00007108 | Protected Materials

`

EFTA00027732 (duplicate discovery index, same content):

Same table listing "Materials returned from 4Chan" at SDNY_00006978-SDNY_00006979.

CRITICAL OBSERVATION: The 4chan materials (2 pages) sit immediately BEFORE Apple Inc. subscriber records and phone company records (AT&T, Comcast, Sprint, Verizon) in the evidence sequence. DS9 UPDATE -- Full Subpoena Chain Recovered: EFTA00123462 (DS9) is the actual Grand Jury subpoena to 4chan Community Support LLC, dated August 13, 2019, signed by Geoffrey Berman, listing 4 specific post numbers (222520442, 222518349, 222520257, 222518664). 4chan responded the next day with Report #2093 (EFTA00129268) revealing the two IPs. The FBI subpoena tracking log (EFTA00133182) confirms T-Mobile and AT&T were separately subpoenaed for "IP addresses from 4chan" on August 14, 2019. The IPs (107.77.x.x and 172.58.x.x) are T-Mobile CGNAT ranges shared among thousands of mobile subscribers, explaining the "dynamic IP" dead end.

D. The Defense Attorney's Demand for the 4chan Author

EFTA00023768 -- This is the complete defense discovery request from Foy & Seplowitz LLC, attorneys for defendant Tova Noel, dated June 5, 2020:

The letter makes 31 specific discovery requests. Request No. 30 is the critical one:

"30. Who is the author of the 4Chan message produced as bates number SDNY_00006978?"

This demand is buried among requests for surveillance camera records (#23), suicide reconstruction reports (#28), After Action Internal Reports (#27), and investigation records related to other deaths at BOP facilities (#31). The positioning suggests the defense viewed the 4chan leak as potentially relevant to their case -- possibly because it could demonstrate that others besides the guards had knowledge of events that night.

The full letter also requested:

  • Request #5: Internal memorandums addressing the death of Jeffrey Epstein
  • Request #23: All surveillance camera records, logs, and orders since June 26, 2019, including records of broken or malfunctioning surveillance cameras
  • Request #27: After Action Internal Report and Board of Inquiry Report
  • Request #28: Suicide Reconstruction Report
  • Request #31: Investigation records related to the suicide of Kenneth Houck at MDC, death of inmate Jamel Floyd at MDC, and smuggling of a firearm into MCC

E. The Government's Response -- The Dead End

EFTA00023756 (Government response dated July 20, 2020):

The SDNY responded to Request No. 30 with this critical admission:

"Request No. 30. Who is the author of the 4Chan message produced as bates number SDNY_00006978?"

>

"The Government has produced all records we have obtained regarding the 4Chan post. The poster used a dynamic IP, and therefore the records obtained did not disclose the author of the post."

This reveals:

  • The government investigated the 4chan post -- they obtained records
  • They traced the IP address associated with the post
  • The poster used a dynamic IP (specifically T-Mobile CGNAT ranges making individual identification impossible without T-Mobile's internal NAT logs)
  • The investigation hit a dead end -- the author was never identified
  • DS9 UPDATE -- BOP Suppression and AUSA Deprioritization: EFTA00056410 (DS9) documents that BOP official Justin B. Long emailed "Do not reply to the reporter" at 7:19 PM on August 10, 2019, within hours of receiving Lytvynenko's forwarded email. Separately, EFTA00129264 reveals an AUSA emailed on August 19, 2019: "Don't worry about the 4chan records or the subpoenas related to IP information" -- suggesting the government deprioritized the 4chan investigation within 9 days.

    The government's response to other requests was notably obstructive -- claiming they were "not in possession" of the After Action Report (#27), that the Suicide Reconstruction Report was not in "final version" (#28), and that surveillance camera records were outside their obligation (#23).


    PART II: THE DEATH NIGHT TIMELINE

    A. Official Suicide Timeline

    Multiple EFTA documents reconstruct the minute-by-minute timeline. EFTA00033799 provides the most detailed version:

    Friday, August 9, 2019:
    • 8:00 AM: Cellmate Reyes Efrain (Reg. No. 85993-054) departs for court
    • 8:30 AM: Epstein arrives at Attorney Conference, visited by several attorneys throughout the day
    • 6:45 PM: Epstein departs attorney conference, returns to SHU
    • 7:00 PM: IDO provides social call; reports Epstein "in good spirits, nothing unusual"
    • Inmate Reyes released from court and does NOT return to institution -- Epstein is now ALONE in his cell
    Saturday, August 10, 2019:
    • 6:33 AM: Body alarm activated in SHU
    • 6:35 AM: Medical staff on site, CPR in progress, AED applied
    • 6:40 AM: Captain notified
    • 6:45 AM: EMS arrives, paramedics continue CPR, intubation, three rounds of Epinephrine, IV access, IO initiated -- no pulse, no shock advised
    • 7:10 AM: EMS departs for Beekman Hospital
    • 7:19 AM: USMS notified
    • 7:20 AM: SIS Lt notified
    • 7:30 AM: Warden arrives
    • 7:32 AM: PIO notified by Warden
    • 7:36 AM: OFFICIAL TIME OF DEATH reported by ER physician
    • 8:10 AM: SIS Lt arrives
    • 8:34 AM: FBI notified
    • 9:00 AM: AUSA notified; SIS Lt. reports to SHU for inmate interviews
    • 10:00 AM: Judge Berman notified
    • 11:00 AM: Next of kin (brother) notified
    • 11:12 AM: Press Release released to media
    • 12:15 PM: Body released to Medical Examiner
    • 12:19 PM: FBI arrives
    • 1:35 PM: FBI arrives in SHU
    • 1:40 PM: OIG notified by Warden
    • 2:45 PM: OIG arrives in SHU
    • 5:05 PM: OIG/FBI depart MCC
    • 10:15 PM: Computer Services Manager arrives to REMOVE HARD DRIVES from SHU computers and REPLACE with new ones
    Sunday, August 11, 2019:
    • 12:15 AM: Computer Services Manager departs
    • 11:15 AM: OIG agent departs with two computers (FPS 021407270 and FPS 0214207268)

    B. The 4chan Timeline Problem

    The official press release went out at 11:12 AM on August 10. ABC News is referenced by Lytvynenko as the first major outlet to report. If the 4chan post appeared 45 minutes before ABC's report, this places the 4chan post approximately in the mid-morning window -- after the 7:36 AM time of death but potentially before the 11:12 AM press release. The poster knew details before the media did.

    C. Medical Records -- The Paramedic Response

    EFTA00033611 (BOP Clinical Encounter, Encounter Date 08/10/2019 07:25):

    `

    Emergency Code - Resuscitation Event performed at Special Housing Unit.

    CPR Compressions 08/10/2019 06:35

    EKG/Monitor Lifepak 08/10/2019 06:39 - No shock advised

    CPR Compressions 08/10/2019 06:40

    Oxygen 15L 08/10/2019 06:47

    IV Access Peripheral IV 08/10/2019 06:48 (18g Left AC)

    Airway Endotracheal Tube 08/10/2019 07:08

    ET Tube 7.5 24CM to L Lip line Placed by Paramedics

    Medications Epinephrine 1mg IV 08/10/2019 07:10

    Epinephrine 3 doses and Sodium bicarb 2 doses administered by paramedics

    `

    The clinical encounter notes:

    "Responded to a body alarm at 0635 for medical emergency on 9S, Upon arrival inmate was received on the floor of his cell unresponsive with CPR in progress by correctional officers, Inmate was Cold, with circumferential Bruising around the neck and posterior mottling, Pupils Fixed and dilated, No Palpable pulses, Call placed for EMS, CPR Continued, AED Placed No shock advised... EMS and Paramedics arrived 0656, Placed on cardiac monitor asystole Resumed CPR, Inmate was intubated by Medics, 3 Rounds of Epinephrine administered, Pulse Check asystole, Inmate was transported to Local ER with CPR in progress."
    EFTA00033613 (Medical Emergency Memorandum):
    "On Saturday, Aug 10, 2019, at approximately 0633 a.m., I responded to a medical emergency 9S, upon arrival Inmate (EPSTEIN, J. Reg #: 76318-054) was received on the floor of his cell unresponsive with CPR in progress by correctional officers, Inmate was Cold, with circumferential Bruising around the neck and posterior mottling, Pupils Fixed and dilated, No Palpable pulses were felt... EMS and Paramedics arrived 0656... Inmate was transported to Local ER with CPR in progress at approximately 0710."
    EFTA00035018 (Senior Officer Body Alarm Response):
    "On August 10, 2019 Saturday morning approximately at 6:33am body alarm was activated from unit 9.South. I S.O.S respond to the body alarm on 9.South tier #11 cell # 220, medical staff on the unit performing CPR on inmate Epstein, Jeffrey Edward # 76318-054. With additional staff inmate Epstein was removed from 9.South unit to medical room on the second floor, performing CPR on inmate Epstein until the paramedics took over. We transported inmate Epstein down to the rear gate placed him into the EMS vehicles and I followed in a secure government vehicle to the hospital where I stayed on post until I was relieved."

    This confirms paramedics were present at the scene from approximately 6:56 AM, handling the body and accompanying it to Beekman Hospital. Any of these paramedics had firsthand knowledge of the scene conditions.

    D. Inmate Witness Accounts

    EFTA00039025 (OIG Report, page 82):
    "Inmate 7, who was two cells down from Epstein's cell and on the other side of the tier, told the OIG that he could not see into Epstein's cell but he could see the cell door. Inmate 7 said that after dinner was brought to Epstein's cell on the evening of August 9, 2019, Inmate 7 did not recall seeing anyone going in or out of Epstein's cell until the following morning at around 6 a.m. He further stated that he did not hear any door 'pop open' that evening. Inmate 7 said he remembered waking up around 6 a.m. on August 10, 2019, and hearing a voice, possibly male, saying 'Breathe.' Inmate 7 said he saw Epstein removed from his cell..."
    "Inmate 6 did not see marks on Epstein's neck but did see bruising on his face and observed earphones that were still in place on Epstein's ears."

    PART III: THE GUARDS' TRIAL AND RESOLUTION

    A. Indictment -- US v. Tova Noel and Michael Thomas (19 Cr. 830)

    EFTA00009747 (Indictment filed 11/19/2019):

    The 20-page indictment charged both guards with conspiracy and falsification of records. Key facts from the indictment:

    • Noel had been employed at MCC since approximately 2016
    • Thomas was a materials handler supervisor who regularly worked overtime as a correctional officer
    • From 12 AM to 8 AM on August 10, Noel and Thomas were the ONLY two officers on duty in the SHU
    • Video surveillance confirmed they did not perform the 10 PM, 12 AM, 3 AM, or 5 AM counts
    • They "sat at their desk, browsed the internet, and moved around the common area of the SHU"
    • Noel browsed the internet periodically throughout the night; Thomas searched furniture sales and motorcycle websites
    • "No correctional officer conducted any count or round... for approximately eight hours"
    • "As confirmed by video surveillance, no one else entered the SHU, no one conducted any counts or rounds throughout the night, and no one entered the tier in which Epstein was housed"
    • At approximately 6:30 AM, Noel and Thomas entered the tier to serve breakfast and discovered Epstein's body at 6:33 AM

    B. Deferred Prosecution Agreements

    EFTA00009786 (Michael Thomas DPA, filed 05/25/2021):

    Thomas admitted he "willfully and knowingly completed materially false count and round slips regarding required counts and rounds in the Special Housing Unit of the Metropolitan Correctional Center on August 9, 2019 and August 10, 2019."

    EFTA00023087 (Tova Noel DPA, filed 05/25/2021):

    Same admission from Noel.

    EFTA00013389 (SDNY UMR dated 05/20/2021):
    "The USAO-SDNY plans to offer deferred prosecution agreements to two correctional officers, Tova Noel and Michael Thomas... The USAO-SDNY has determined that deferring the defendants' prosecution is an outcome consistent with the interests of justice, the mitigating personal circumstances of the defendants, and the Department's practice in the overwhelming majority of other cases in which correctional officers have been investigated or charged with falsifying count or round forms."

    Conditions included: admitting guilt, cooperating with OIG, 100 hours community service.

    DS9 UPDATE -- Noel's EMT Certification: EFTA00089486 (DS9) reveals that Noel obtained New York State Emergency Medical Technician certification in 2013, adding context to the paramedic angle of the investigation. She also applied for SSA Claims Specialist and Contact Tracer positions while under indictment. DS9 UPDATE -- Shuliak Phone Records: The FBI subpoena tracking log (EFTA00133182) identifies "Katrina Shuliac" (likely misspelling of Karyna Shuliak, Epstein's girlfriend) as being subpoenaed via AT&T on August 11, 2019 -- the day after the death -- as part of the death investigation.

    C. Nolle Prosequi -- Case Dismissed

    EFTA00009791 (Nolle Prosequi filed 01/03/2022):

    All charges dropped. Filed by AUSA Nicolas Roos. Approved by Judge Analisa Torres.

    EFTA00014902 (FOIA release UMR):

    After the DPAs, SDNY released approximately 2,700 pages of BOP documents to the New York Times pursuant to FOIA litigation. These had been withheld during the criminal prosecution.


    PART IV: THE FBI'S DIGITAL EVIDENCE COLLECTION

    EFTA02730741)">A. FBI Case Serial -- Evidence Items (EFTA02730741)

    The FBI case serial (EFTA02730741, page 34) lists the following digital evidence items collected, revealing a much broader investigation into online activity:

  • "(U) Screenshot of Reddit post by user r/maxwellhill"
  • - The FBI captured a screenshot of the notorious Reddit account long speculated to belong to Ghislaine Maxwell. The account was one of the most prolific Reddit power users and mysteriously stopped posting on July 2, 2020 -- the day Maxwell was arrested.

  • "(U) Screenshots of Epstein's alleged employee's confession on YouTube and 4chan"
  • - A SEPARATE evidence item from the paramedic leak. This refers to someone claiming to be an Epstein employee who posted a "confession" on both YouTube and 4chan.

  • "(U) Website www.kidsquest.com" and "(U) Screenshots from kidsquest.com"
  • - The FBI captured the kidsquest.com website and took screenshots. The name is suggestive but the connection to the Epstein case is not specified in available records.

  • "(U) Graphic Capture of Viral Video"
  • - An unspecified viral video was captured as evidence.

  • "(U) screenshot of David McPhee's Quora page"
  • - The FBI screenshotted a specific Quora user's page as part of the investigation.

  • "(U) Screen shot of Imgur capture of the comment made by [REDACTED]"
  • - An Imgur-hosted screenshot of a comment by an unidentified person was collected.

  • "(U//FOUO) Aerial photos of 301 Summer Street Manchester by the Sea, Massachusetts 01944"
  • - A specific Massachusetts address was investigated via aerial surveillance.

    B. The Employee Confession -- YouTube Video

    EFTA00020501 (FBI Tip, Case ID 50D-NY-3027571, dated 08/25/2020):

    An FBI tip submitted through the online portal on August 24, 2020 from North Port, Florida:

    "This was on YouTube at https://www.youtube.com/watch?v=rD_3415Iatc&feature=share And the person talking is supposedly an employee of Jeff Epstein."

    >

    Violation: Human Trafficking
    Submitted via: fbi.gov/wanted/operation-legend
    Tipster location: North Port, FL 34287

    This is the tip that led to the FBI evidence item "Screenshots of Epstein's alleged employee's confession on YouTube and 4chan." The tipster used an iPhone running iOS 12.4.8.

    C. Jean Francois Gariepy -- Funded Associate

    EFTA02730741 (page 129, FBI case serial index):
    "(U) NTOC2019-MC3 189dec01 Possible Connection between YouTuber, Jean Francois Gariepy,"

    This NTOC tip, timestamped 07/08/2019, reports a "possible connection" between YouTuber Jean Francois Gariepy and the Epstein case.

    DS9 CORRECTION: Gariepy was not merely the subject of an anonymous tip -- he had a direct, funded relationship with Epstein spanning November 2013 to October 2014. DS9 contains 7+ email exchanges:
    • EFTA00675528: Initial outreach for NEURO.tv webseries seeking $25,000 funding
    • EFTA00685143: Payment chain -- Richard Kahn (Epstein accountant) forwarded to Epstein "please advise." Epstein replied: "Let's start at 25k." Check payable to "NEURO.tv Inc." at Durham, NC
    • EFTA00675880: Gariepy noted "Mr. Kahn has expressed some worries about NEURO.tv not being a 501(c)3"
    • EFTA00642599: Gariepy pitched Season 2 and a book company "The Moral Signal," listing 2 Nobel laureates as guests (October 2014)

    Gariepy was a Duke University postdoctoral researcher soliciting science patronage -- consistent with Epstein's broader science network (Brockman, Church, Lloyd). His later far-right media career postdates the Epstein funding relationship.

    D. FBI Case File Index -- "4chan8 PNG" and "Kid Q PNG"

    EFTA01731021 (FBI case file index, page 114):

    The index lists specific evidence files stored by the FBI:

    `

    (U) Kid Q PNG

    (U) Kid Q PNG

    (U) 4chan8 PNG

    (U) quora david mcphee.PNG

    (U) CAUTION- GRAPHIC Photo-- magnifying_glas[s]

    `

    The file naming convention is significant:

    • "4chan8 PNG" -- suggests this is the 8th screenshot from 4chan, indicating the FBI captured at least 8 separate 4chan images
    • "Kid Q PNG" -- possibly related to kidsquest.com screenshots or to QAnon-related "Kid Q" content
    • "quora david mcphee.PNG" -- matches the Quora screenshot reference in the case serial

    PART V: THE DEATH INVESTIGATION SUB-FILE

    A. FBI Death Investigation Case

    EFTA02730741 (page 202) lists a separate evidence category:
    "(U) UNSUB(S); JEFFREY EPSTEIN - VICTIM; DEATH INVESTIGATION"

    This confirms the FBI opened a formal death investigation with Epstein classified as the VICTIM and the subject(s) listed as UNSUB (Unknown Subject). Additional items in this sub-file include:

    • "(U) Submission of CART Derivative Evidence NYC033797" (Computer Analysis Response Team)
    • "(U) Evidence Chain of Custody for Items 1837 and 1838"
    • "(U) Release of Evidence to the Office of the Inspector General (OIG)"
    • "(U) Closing Communication" -- the investigation was formally closed
    • "(U) Deferred Prosecution Agreement"
    • "(U) Email threat to TOVA NOEL" (2 separate entries)
    • "(U) Open source and database information on SHAWN CHRISTOPHER CONE"
    • "(U) Interview of Hughwon Daniel"
    • "(U) Interview of Miguel Monge"
    • "(U) Interview of Darrius Dupree"
    • "(U) 2020-01577-1 Questioned Documents"
    • "(U) Response from FBI Laboratory Forensic Document Examiner"
    • "(U) Psychology report and interview notes"

    B. Threats Against Guard Tova Noel

    The case serial reveals that guard Tova Noel received email threats from Shawn Christopher Cone ([email protected]). The FBI ran open source and database searches on Cone and logged at least two separate threatening emails as evidence items.

    EFTA00037340 (page 8) lists the July 2019 search warrant execution team at 9 East 71st Street, revealing two paramedics were assigned to the FBI's search team:

    `

    Computer Forensics FBI

    Paramedic THRU Team FBI

    Paramedic Paramedic THRU Team FBI

    ``

    These are FBI-assigned paramedics for the search warrant, not the EMS paramedics who responded to Epstein's death -- but the presence of "Paramedic THRU Team" in the search team is notable.


    PART VI: THE HARD DRIVE REMOVAL

    One of the most striking details from the suicide timeline (EFTA00033799):

    "10:15 PM: Computer Services Manager arrives at institution to remove hard drives (Computers) from SHU. And replaced with new ones."
    "12:15 AM: Computer Services Manager departs the institution."
    "11:15 AM: OIG agent departs institution with two computers FPS 021407270 and FPS 0214207268."

    On the evening of Epstein's death -- approximately 15 hours after the body was found -- the MCC's Computer Services Manager arrived to physically remove and replace the hard drives from SHU computers. The next morning, an OIG agent departed with two separate computers. This chain of custody is relevant because the indictment confirms Noel and Thomas browsed the internet throughout the night -- the hard drives would contain records of their activity.


    PART VII: THE OIG REPORT FINDINGS

    EFTA00039025 (OIG Report):

    Key Medical Examiner Finding (page 4):

    "The cause of death was hanging and the manner of death was suicide. Blood toxicology tests did not reveal any medications or illegal substances in Epstein's system. The Medical Examiner who performed the autopsy told the OIG that Epstein's injuries were consistent with suicide by hanging and that there was no evidence of defensive wounds... Epstein did not have marks on his hands, broken fingernails or debris under them, contusions to his knuckles that would have evidenced a fight, or, other than an abrasion on his arm likely due to convulsing from hanging, bruising on his body."

    Video Evidence (page 4):

    "The Limited Available Video Evidence: Recorded video evidence for August 9 and 10 for the SHU area where Epstein was housed was only available from one prison sec[urity camera]..."

    Systemic Failures (page 101):

    "Our investigation and review of the Federal Bureau of Prisons' (BOP) custody, care, and supervision of Jeffrey Epstein identified numerous and serious failures by employees of the Metropolitan Correctional Center... including falsifying BOP records relating to inmate counts and rounds and multiple violations of MCC New York and BOP policies and procedures, which compromised Epstein's safety, the safety of other inmates, and the security of the institution."

    PART VIII: UNANSWERED QUESTIONS

    1. The Anonymous 4chan Posters -- PARTIALLY RESOLVED

    DS9 resolved several questions: the government did subpoena 4chan (Grand Jury subpoena EFTA00123462, dated 8/13/2019). There were two posters from two different T-Mobile IPs: Poster 1 (107.77.223.177) wrote 3 posts with medical terminology; Poster 2 (172.58.139.162) wrote a conspiracy post claiming guard status. T-Mobile and AT&T were subpoenaed for the IPs but the CGNAT architecture prevented identification. The AUSA deprioritized the investigation within 9 days. The actual post content is now visible. Remaining question: the identities of both posters remain unknown.

    2. The Employee Confession

    The FBI collected "Screenshots of Epstein's alleged employee's confession on YouTube and 4chan" as a separate evidence item from the paramedic leak 4chan post. The YouTube video (ID: rD_3415Iatc) was flagged by a tipster in North Port, Florida. Was this person ever identified or interviewed?

    3. The r/maxwellhill Screenshot

    The FBI captured a screenshot of the Reddit account r/maxwellhill. This account stopped posting on July 2, 2020, the day of Maxwell's arrest. Did the FBI investigate this account further? Was Reddit subpoenaed?

    4. The Imgur Comment

    A "Screen shot of Imgur capture of the comment made by [REDACTED]" was collected. Who was the commenter? What did they claim?

    5. The kidsquest.com Investigation

    Both the website and screenshots from kidsquest.com were collected as FBI evidence. What was the connection to the Epstein case?

    6. Jean Francois Gariepy -- RESOLVED

    DS9 reveals Gariepy had a direct funded relationship with Epstein: 7+ emails spanning November 2013-October 2014, Epstein committed $25K for NEURO.tv, and Richard Kahn processed the payment. Gariepy was a Duke University neuroscience postdoc, not merely the subject of an anonymous tip.

    7. The David McPhee Quora Page

    A screenshot of "David McPhee's Quora page" was collected. What claims did McPhee make on Quora?

    8. Why the Defense Wanted the 4chan Author

    Noel's attorney specifically asked "Who is the author of the 4Chan message produced as bates number SDNY_00006978?" -- suggesting the defense believed the poster's identity could be relevant to their case. If the poster was a first responder, their account could corroborate or contradict the timeline of events.


    DOCUMENT INDEX

    EFTA NumberDescriptionKey Content
    ---------
    EFTA00034513Lytvynenko email (6:03 PM version)Full 4chan tip to SDNY, 45 min before ABC
    EFTA00034116Forwarded version (10:10 PM)"Potential leak in hospital regarding Epstein's death"
    EFTA00035482Third copy of Lytvynenko emailSame content, different routing
    EFTA00019947Lytvynenko initial inquiry (1:25 PM)Death confirmation request before 4chan tip
    EFTA00025239Discovery index (version 1)"Materials returned from 4Chan" SDNY_00006978-79
    EFTA00027732Discovery index (version 2)Duplicate listing of 4chan materials
    EFTA00023768Foy & Seplowitz defense request"Who is the author of the 4Chan message?"
    EFTA00023756Government response"Poster used a dynamic IP... did not disclose the author"
    EFTA00009747Guards indictment (19 Cr. 830)20-page indictment of Noel and Thomas
    EFTA00009786Michael Thomas DPADeferred prosecution agreement 05/25/2021
    EFTA00023087Tova Noel DPADeferred prosecution agreement 05/25/2021
    EFTA00009791Nolle ProsequiCharges dismissed 01/03/2022
    EFTA00013389DPA UMR to DOJ"Deferred prosecution agreements to two BOP MCC NY Officers"
    EFTA00020501FBI tip re YouTube videoEmployee confession video rD_3415Iatc
    EFTA02730741FBI case serial (unredacted)All digital evidence: 4chan, Reddit, YouTube, Imgur, kidsquest
    EFTA02730486FBI case serial (redacted version)Same serial with names redacted
    EFTA01731021FBI case file index (p.114)"4chan8 PNG", "Kid Q PNG", "quora david mcphee.PNG"
    EFTA00033611BOP Clinical EncounterResuscitation timeline, "placed by Paramedics"
    EFTA00033613Medical Emergency Memo"circumferential Bruising around the neck and posterior mottling"
    EFTA00033799Suicide TimelineMinute-by-minute Aug 9-11, hard drive removal at 10:15 PM
    EFTA00035018Senior Officer body alarm memo"paramedics took over... transported to EMS vehicles"
    EFTA00039025OIG ReportFull investigation, ME findings, video evidence limitations
    EFTA00037340Search warrant team listFBI "Paramedic THRU Team" assigned
    EFTA00035986BOP internal reviewGuards admitted to pre-filling count slips

    CONCLUSIONS

  • The 4chan paramedic leak was real and investigated. The government obtained records, traced the IP, and hit a dead end with a dynamic IP address. The poster was never identified.
  • The FBI collected at least 8 separate 4chan screenshots (evidenced by the file "4chan8 PNG"), suggesting a broader monitoring of 4chan activity related to Epstein beyond the single paramedic leak post.
  • The "employee confession" on YouTube and 4chan is a separate evidence thread from the paramedic leak, involving someone who claimed to be an Epstein employee posting confessional content on both platforms.
  • The FBI conducted a comprehensive digital evidence sweep, capturing screenshots from Reddit (r/maxwellhill), Imgur, Quora (David McPhee), YouTube, Twitter, Facebook, kidsquest.com, and 4chan. This represents a systematic effort to document and preserve online claims about Epstein.
  • The 4chan materials became legally significant when they were produced as discovery evidence in the guards' trial and the defense demanded to know the author's identity -- a demand the government could not fulfill.
  • The paramedic response timeline creates a narrow window for the leak. EMS/paramedics arrived at 6:56 AM, Epstein was transported at 7:10 AM, and pronounced dead at 7:36 AM. The press release did not go out until 11:12 AM. Anyone in the response chain had approximately 4+ hours of exclusive knowledge before media reporting.
  • The investigation into the leak source appears to have been closed without resolution, joining the broader pattern of unresolved investigative threads in the Epstein case files.
  • DS9 reveals two distinct posters, not one. The paramedic poster (Poster 1) and the conspiracy poster (Poster 2) were different individuals posting from different T-Mobile mobile devices. The deleted conspiracy post claiming "they switched him out" went viral on Facebook by August 11, 2019 (per NTOC Serial 242, EFTA01249740).
  • BOP suppression and prosecutorial deprioritization are documented: Justin B. Long's "Do not reply to the reporter" order within hours, and an AUSA's "Don't worry about the 4chan records" email within 9 days.

  • Report compiled from forensic analysis of 4 databases containing 1.8M+ redaction records, 38K OCR records, 20K analyzed images, and 532MB of supplemental redaction data. Investigation date: February 6, 2026