Man detained for questioning in Guthrie investigation, person familiar says

NBC News - A man has been detained by law enforcement for questioning in the investigation into Nancy Guthrie's disappearance, a person familiar with the matter told NBC News tonight.

The development comes after the FBI released black-and-white surveillance photos of a potential subject outside the 84-year-old woman's home on the morning she went missing in Tucson, Arizona.

It was not immediately clear whether the man detained for questioning was the same person seen in the doorbell camera images.

The FBI did not comment. The Pima County Sheriff’s Office said it is not releasing any information at this time.

What we know

• Authorities tonight detained for questioning a person in the investigation into Nancy Guthrie’s disappearance.
• The FBI released security photos and videos of a potential subject in the investigation into the disappearance of “TODAY” co-anchor Savannah Guthrie’s mother.
• Four images depict a person wearing gloves, a mask and a backpack appearing to tamper with the camera at Nancy Guthrie’s front door the morning she disappeared.
• FBI Director Kash Patel said the potential subject is armed.
• The FBI said yesterday that it had not identified any suspects or persons of interest.
• Guthrie, 84, was dropped off at her home outside Tucson, Arizona, the night of Jan. 31 and was reported missing about noon Feb. 1.
• The FBI said yesterday that it is “not aware of any continued communication between the Guthrie family and suspected kidnappers.”

Shortly after Nancy Guthrie disappeared, Pima County, Arizona, Sheriff Chris Nanos said that a camera affixed to her door had been disconnected, that she did not have a subscription that would have saved video and that investigators were trying to work with a tech company on the difficult forensic task of recovering any video.

Against those odds, they were successful. More than a week after her reported disappearance, that video was revealed, marking the most significant public development in a case that has captured the nation.

An internet-connected Google Nest camera captured an unidentified person in a mask and gloves and carrying a backpack and a gun approaching Guthrie’s home just before she disappeared. FBI Director Kash Patel said the bureau was able to collect the video from “backend systems.”

It’s not yet clear how the FBI was able to collect the video. Experts told NBC News it is in some cases possible to collect data from the complex infrastructure that has enabled cloud-based cameras to become a common household feature.

“Over the last eight days, the FBI and Pima County Sheriff’s Department have been working closely with our private sector partners to continue to recover any images or video footage from Nancy Guthrie’s home that may have been lost, corrupted, or inaccessible due to a variety of factors — including the removal of recording devices. The video was recovered from residual data located in backend systems,” Patel wrote on X.

Google’s Nest devices are part of the company’s smart home products, which include cameras, camera-equipped doorbells, thermostats and more. Nest cameras and doorbells are meant to record video and send it to the company’s cloud computing system, meaning it uses the internet to send the content to remote servers. People can then view video and other content on their Nest apps.

NBC News asked Google for more information about how the Google Nest system works and how it worked with law enforcement. A Google spokesperson acknowledged a request for comment but did not provide any additional details.

It’s not clear which model of Google’s Nest doorbell Guthrie had outside her door. Newer models include backup batteries and local storage that automatically optimize to record what the company calls “events,” such as someone approaching the door.

Nest offers two tiers for its system: Standard, which tracks “event-based history” on a rolling 30-day basis, and Advanced, a subscription to which records 24/7 and stores the video for 10 days, with event-based storage for 60 days.

Timothy Gallagher, a retired FBI agent who was in charge of the Newark, New Jersey, field office and also worked in cyber investigations, said that even if Guthrie had not been paying for a subscription, the device could still have been transmitting images to Google.

“The data is being transmitted to the cloud, but even if it had not gotten there, there are many stops in between where data will reside, and the FBI prides itself on being able to tear into these data streams and pull out bits and pieces of data and piece together an image like we see here today,” Gallagher said.

Former FBI cybercrime agent E.J. Hilbert said that it can be challenging for Google to find recordings and that it takes time for legal processes to play out.

“Nest/Google deletes billions of data points every hour,” Hilbert said in an email. “To find this data set means that they are finding a single needle in a 10K ft by 10Kft haystack.”

Guthrie, 84, was last known to have visited family members on Jan. 31 and returned home that evening. She was reported missing after she did not arrive at her friend’s house for church the next morning.

Pima County Sheriff Chris Nanos previously said Guthrie’s doorbell camera was disconnected at 1:47 a.m. local time. He said last week that the doorbell camera had not been located and noted that there were multiple cameras at the home.

“The cameras we’re working with, they’re not on a cloud, so the data has to go through a server, has to take some time to get to the company that has that and get them warrants and services,” Nanos said in a Feb. 3 interview on MSNOW about the delay in reviewing the video.

In the case of the video from Guthrie’s door, it is not clear whether Google had been recording, collecting and storing that media despite the lack of a subscription.

“There’s some legal, legalese you’ve got to work with, but everybody’s working with us on this,” he said. “I can’t even tell you how many different corporate America, Google, Apple, Meta, all these companies have said, ‘Whatever you need, Sheriff, they’re there,’ and we’re utilizing that leverage to get things done as quickly as we can.”

Google previously told NBC News that it was assisting with the Guthrie investigation and could not provide further details.

The advent of internet-connected cameras has been a boon for law enforcement. Many tech companies, including Amazon and Roku, now offer such devices. Authorities regularly work with the companies to recover video relevant to investigations, sometimes using subpoenas to gain access to sensitive or private images.

In a transparency report, Google Nest said that it does work with law enforcement but that it also works to maintain user privacy and notifies users about legal demands.

“For example, if a US government agency presented us with a search warrant to investigate a crime they think was captured on a Nest Cam, we wouldn’t just hand over user data. We’d analyze the request to be sure the warrant wasn’t overly broad, then we’d make sure the information they requested was within the scope of the warrant,” the company wrote.

Josh Brunty, a professor of cyber forensics and cybersecurity at Marshall University, said law enforcement seeking Google data, like Nest video, has to enter a legal request through its Law Enforcement Request System.

When Google receives a legitimate legal request for data, the response is “usually handled fairly quickly, in many cases just a few days,” he said in a text message.

“If it’s an emergency disclosure request then it goes through quicker,” he added.