On the menu today: The disappearance of Nancy Guthrie took a disturbing turn yesterday when the FBI released images and short videos from the doorbell camera at Guthrie’s home, showing frightening images of a masked individual. The details are unnerving, the authorities appear to have no suspects, and because of Guthrie’s age and required daily medication, the clock is ticking. Read on.
The Mask of a Kidnapper, Revealed
Nancy Guthrie is an 84‑year‑old mother of three, including Today Show host Savannah Guthrie.
Nancy Guthrie was last seen at her home in the Catalina Foothills, just north of Tucson, Ariz., on the evening of Saturday, January 31.
According to a timeline laid out by Pima County Sheriff Chris Nanos, at 5:32 p.m., Nancy took an Uber to a family member’s home for dinner. At approximately 9:50 p.m., her son‑in‑law, Tommaso Cioni, who is married to Guthrie’s daughter Annie, dropped off Nancy Guthrie at her home. At 9:48 p.m., her garage door opens; at 9:50 p.m., her garage door closes.
At 1:47 a.m. February 1, the doorbell camera at Guthrie’s house disconnects.
Yesterday, FBI Director Kash Patel released new images and short videos that were recovered from the camera, showing a masked individual with a backpack and what appears to be a gun in a holster at the middle of his front waist. In the short videos, the masked individual is seemingly attempting to cover the camera with branches or otherwise disable it.
If you’re wondering why, in a case involving a disappearance ten days earlier, the footage wasn’t immediately released, it’s because the authorities didn’t know that footage still existed and could be recovered:
Pima County Sheriff Chris Nanos initially said there was “no video available” because Guthrie “had no subscription” to Google’s video recording service, which keeps videos from Nest cameras accessible in Google’s cloud.
Investigators had sent a search warrant to Google for the Nest cameras at the Guthrie residence last week, the source added. Such a move is common in a criminal investigation.
Adam Malone, the top cyber crisis expert at cybersecurity advisory firm Kroll and a former cyber-focused FBI special agent, told CNN that video recorded by cloud-based systems goes through “layers and layers” of components to make the application work.
For example, “there might be one that just processes the data into a new compressed format,” Malone said. “There might be one that renders it a certain visual format.”
The footage and its underlying data could go through hundreds of thousands of servers and systems all over the world — increasing the chance of residual data being left behind.
“They would have all looked at their development pipelines to say, ‘Hey, do we process any data? Do we have any historical data that’s still sitting here waiting to be purged?” Malone said. “It could be that this one, just for some reason, was in a queue that hadn’t been processed and it just still existed.”
At Thursday’s press conference, Sheriff Nanos said, “whether it’s forced entry or not forced entry, that is something we’re just not discussing.”
At 2:28 a.m., Nancy Guthrie’s pacemaker app indicates that it was disconnected from the phone.
On Sunday morning, Nancy Guthrie had been expected to join friends at a neighbor’s house to watch an online church service of Good Shepherd New York. When she did not appear, the neighbor called Guthrie’s family, who then went to Guthrie’s home. When they did not find her there, they called 911; police responded within about ten minutes.
Bloodstains found at the scene were confirmed to be Guthrie’s. One theory from the pattern is that her abductors hit her and gave her a bloody nose:
Paulette Sutton, who is retired from the Shelby County Medical Examiner’s Office with more than 40 years of experience in bloodstain pattern analysis, told Newsweek that “the first thing that comes to mind would actually be like a bloody nose.”
“It’s what we call a drip trail, which means it’s a continuous source of blood dripping from an object or from a person,” Sutton said. “I would advise the police that this is continuous enough to indicate a bleeding individual.”
In the following days, at least one alleged ransom note was sent to at least two local media outlets and TMZ.
One note was sent to KOLD-TV, the CBS affiliate in Tucson, Ariz.:
The note, which the station received Monday and agreed not to report on, contained specific details about the home and what Nancy Guthrie was wearing that night, Pima County Sheriff Chris Nanos said, although he would not confirm the accuracy of that information or the legitimacy of the note.
A similar note was sent to KGUN, the Scripps station in Tucson, Ariz.:
KGUN received a ransom note Tuesday that demanded $6 million by Monday evening. KGUN staff sent the email to law enforcement, who have not indicated if the ransom letter is legitimate. No other communication regarding ransom demands were sent to the station.
The tabloid news site TMZ reported, “The note, which was sent to us Tuesday morning, demands a specific substantial amount of Bitcoin. . . . The amount is in the millions, and the note demands the cryptocurrency be sent to a specific Bitcoin address. The alleged ransom note also describes another item the sender says was damaged at her Tucson-area home.”
TMZ said they forwarded the alleged ransom demand to the Pima County Sheriff’s Department.
Heath Yonke, the special agent in charge of the FBI’s Phoenix Division, said at a press conference Thursday, “We are aware of a ransom letter that was sent to the local media and then to national outlets. As with every lead, we are taking it seriously. We are in communication with the family. And while we advise and recommend from a law enforcement perspective, any action taken on any ransom is ultimately decided by the family.”
People magazine reported that the notes included deadlines that have since passed:
The letter, sent to Arizona television stations KOLD and KGUN, specified two separate sums: $4 million in bitcoin due Thursday, Feb. 5, and if that was not met, an increased demand of $6 million by Monday, Feb. 9, the sources say.
A source confirmed with PEOPLE that as of 2:30 p.m. local time Monday, no payments have been made toward the bitcoin account provided in the note.
Late last week, authorities determined one separate ransom demand was fraudulent and arrested the perpetrator:
The man accused of sending a fake ransom to the family of Nancy Guthrie made his first court appearance Friday.
Derrick Callella, 42, of Hawthorne, appeared at the U.S. District Court in Santa Ana in front of Judge Karen E. Scott for his initial appearance on two federal charges.
Callella faces a count of intent to transmit a ransom demand and one count of utilizing a telecommunications device to anonymously abuse, threaten or harass a person.
Court paperwork showed that on Wednesday, the Guthrie family members got a text from a VOIP (internet) phone line.
The text read: “Did you get the bitcoin we’re waiting on our end for the transaction.”
According to investigators, the messages were sent moments after the family released a video message asking for proof of life.
Law enforcement traced the phone line and found it was registered to Callella’s Gmail account and determined the call was made from his California home.
Federal authorities said the texts have not been linked to the first ransom demand reported by multiple outlets.
So, as far as we know, the first three ransom demands sent to the two local stations and TMZ were genuine; this separate text was a fake one.
On Tuesday evening, TMZ founder Harvey Levin told NewsNation that in the past 90 minutes, there had been activity for the first time in the bitcoin account listed in the ransom note, but refused to elaborate further.
In Thursday’s press conference, Agent Yonke laid out the facts for the kidnapper:
To anyone that may be involved, do the right thing. This is an 84-year-old grandma. This is an 84-year-old grandma that needs vital medication for her well-being. You still have the time to do the right thing before this becomes a worse, much worse scenario for you. Please return Nancy home.
When asked what the medication was, Yonke elaborated:
I’ve got to be careful for HIPPA, but I would say this. We know she is in need of medication, daily medication. And we also know that this is day four or five and still we don’t we don’t know that she’s getting her medication. That could, in itself, prove fatal.
The FBI is offering a $50,000 reward for information leading to the recovery of Nancy Guthrie and or the arrest and conviction of anyone involved in her disappearance.
As of this writing, investigators have not identified any suspects, persons of interest, or vehicles connected to Nancy Guthrie. Last night, police detained a man in Rio Rico, Ariz., for questioning, but released him after several hours. “A spokeswoman for the Pima County Sheriff’s Department, which is leading the investigation along with the F.B.I., said only that investigators had finished searching a property in Rio Rico, which is near the U.S.-Mexico border.”
Rio Rico is a bit more than hour’s drive south of Catalina Foothills. It is less than 20 minutes away from the Nogales-Mariposa border crossing.
Anyone who believes they have information that may assist investigators is asked to contact 1-800-CALL-FBI or the PCSD non-emergency line at 520-351-4900, or 88-CRIME.
Yesterday afternoon, I observed that something about this story feels like the 1990s — perhaps the golden era of bizarre crimes connected to celebrities: O. J. Simpson, the assault on Nancy Kerrigan, the murder of Gianni Versace.
For starters, the kidnapping of adults for ransom in the United States is extremely rare. (Thankfully, the kidnapping of children by a stranger is also much rarer than the public believes.) Mexico’s drug cartels and organized gangs are involved in various kidnapping schemes, but those are generally of migrants. A kidnapping of an elderly person connected to a celebrity, with ransom demands delivered through media organizations, does not fit past patterns of drug cartel activity, at least in this country.
Presuming the ransom demands are authentic, the kidnapper had to know who Nancy Guthrie is, where she lives, and have reason to believe her family could and would pay a ransom of millions of dollars. Guthrie is described as mentally sound but with limited mobility; this would make her extremely unlikely to fight back against her attackers or attempt to escape. The kidnapper may not have known about her need for daily medication.
The choice of media organizations for sending the ransom notes also indicates the person is familiar with the Tucson area. TMZ’s Levin has speculated that the kidnapper’s claim that he will return Guthrie to Tucson within twelve hours means that the kidnapper is within, at maximum, a roughly 700-mile radius of Tucson.
If you’re looking for a reason for hope, the kidnapper’s motive is money. Killing Guthrie doesn’t get him what he wants; it just upgrades the potential penalty from life in prison to lethal injection.
ADDENDUM: Over in that other Washington publication, something completely different — reviewing Raiford Guins’s new book King PONG: How Atari Bounced Across Markets to Make Millions, and a look at the humble beginnings of today’s massive and lucrative video game industry.