Overview of The Megyn Kelly Show — Ep. 1247
This episode centers on new developments and unanswered questions in the disappearance of Nancy Guthrie (Savannah Guthrie’s 84‑year‑old mother). Megyn Kelly interviews crime reporter Ashley Banfield about her exclusive reporting (including a top‑law‑enforcement source telling her the son‑in‑law may be a prime suspect), discusses confusing changes in the official timeline, and convenes a panel of former law‑enforcement experts to unpack forensic details (doorbell/Nest cameras, pacemaker data, DNA, an impounded car) and evaluate the authenticity and implications of ransom emails sent to media outlets.
Key developments covered
- Ashley Banfield’s reporting: a “top law‑enforcement” source told her the son‑in‑law (Tommaso) may be the prime suspect and that a car was towed and put in evidence (reported as Annie Guthrie’s car).
- Authorities (FBI) confirmed the ransom emails sent to three outlets (TMZ and two Arizona TV stations) are identical.
- Harvey Levin (TMZ) reports the ransom email mentioned an Apple Watch placement and damaged floodlights — details that could be known only to someone who’d been inside the house, increasing FBI interest.
- A separate alleged fraudster (reported as Derek Calella) was arrested in California for sending ransom‑type demands and is believed unrelated to the main notes.
- The sheriff’s public statements contained several inconsistencies (timing of discovery, who dropped Nancy off, description of cameras), prompting media scrutiny.
Timeline and major discrepancies
- Saturday ~9:30 PM — Nancy reportedly dropped off at home (sources differ whether Annie, Tommaso, or “family” did this).
- 1:47 AM — Doorbell/Nest camera(s) reportedly disconnected/removed (law enforcement confirmed disconnect but was initially vague about whether cameras were smashed/taken).
- 2:12 AM — A camera alert registers “person on cam” (no archived video available publicly).
- 2:28 AM — Pacemaker app on Nancy’s phone shows disconnection (approximate point when device left Bluetooth range of the phone).
- Sunday 11:56 AM — Sheriff later said the family discovered Nancy missing and called 911 at ~12:03 PM (this contradicts earlier press briefings that said the family was notified by a church congregant around 11:00 AM and there was an hour delay before calling police).
- Discrepancies: sheriff’s varying descriptions of who dropped Nancy off, the change in the “discovery” time, and unclear phrasing about where/when a car was towed.
Why the 41‑minute window matters
- From 1:47 AM (camera disconnect) to 2:28 AM (pacemaker disconnect) is about 41 minutes. Panel experts noted that:
- 41 minutes is long for a quick abduction; it could indicate searching the house, an argument, a struggle, attempts to clean or stage the scene, or other activity beyond a simple grab‑and‑go.
- Pacemaker telemetry could narrow the moment of bodily injury/medical event (if the device recorded a cardiac event, investigators would know).
Ransom emails — what’s known and why investigators care
- All three emails sent to media outlets are reportedly identical (FBI confirmed).
- Levin says the note:
- Claims Nancy is alive but “scared.”
- Includes specific references to an Apple Watch and floodlight(s) and the placement of the watch — potentially knowledge that only someone inside the home would have.
- Sets deadlines (Thursday and a more consequential Monday deadline) and demands millions in Bitcoin.
- Two main possibilities discussed:
- The notes are authentic and from the perpetrator(s).
- They are a hoax/extortion attempt from opportunistic criminals (possibly abroad and using crypto) trying to exploit the case — or a “post‑offense manipulation” intended to mislead investigators.
Reporting controversy and law‑enforcement messaging
- Sheriff repeatedly said “no suspects” publicly and urged caution about naming suspects; he also pressed media to avoid harming the investigation or individuals.
- Ashley Banfield says she stands by her source (who told her the son‑in‑law may be the prime suspect and that a car was seized) and described pushback and public criticism for running that exclusive.
- Panelists and Kelly discussed the balance between investigative reporting and law enforcement’s need to withhold tactical information — and the public confusion created when official statements change.
Forensic/technical evidence highlighted
- Cameras: multiple cameras (Nest/Ring types) at the Guthrie property — sheriff said some were disconnected/removed; one or more other cameras still produced an “alert” after the disconnects.
- Important note: many doorbell cameras only retain video if the owner pays for a subscription; otherwise clips may not be archived.
- Pacemaker/phone telemetry: the pacemaker app stopped communicating at ~2:28 AM — investigators are reportedly reviewing telemetry and app data for events.
- DNA: sheriff confirmed there is DNA evidence being processed (no public details on source/type).
- Car: reports (and Ashley’s source) say a car was towed and is in evidence; sheriff’s language at the presser was ambiguous about which car and where it was taken from.
- Neighbors: reports of an unmarked white van seen on the street in days prior — local canvass and camera review suggested.
- No confirmed proof of life has been publicly released.
Expert panel takeaways (Fitzgerald, Gilliam, Ayers)
- The 41‑minute interior window is atypical for a clean kidnap — may indicate:
- Searching for something (documents, items),
- An argument or struggle,
- Efforts to move a body or destroy evidence,
- Or more complicated staging (if the ransom is fraudulent).
- Ransom demands: a genuine kidnapper seeking ransom normally provides a proof‑of‑life; the absence of verifiable proof increases suspicion of a hoax/extortion component.
- Family involvement: investigations commonly examine close family and visitors early on (not as accusation but because statistics show many violent crimes are committed by known persons).
- Technical leads to pursue: pacemaker/telemetry logs, phone records, vehicle telematics, neighborhood CCTV/FBO logs, camera subscription histories, Bitcoin tracing and email provenance.
Likely scenarios discussed
- Genuine kidnapping-for-ransom: perpetrator(s) have Nancy and demand money. Expect proof of life if the ransom is real.
- Murder or death at the residence with a subsequent hoax ransom: person(s) kill or unintentionally cause Nancy’s death, then try to misdirect investigators with a ransom email (post‑offense manipulation).
- Opportunistic extortion: perpetrators with no connection to the crime attempt to monetize national attention (could be overseas fraudsters using crypto).
- Family/known‑person involvement: investigators routinely examine family and recent visitors; reporting of an impounded car and long house time raises that as one investigatory avenue (not proven).
Practical investigative and family recommendations (from discussion)
- Demand proof of life before any payment; coordinate any financial “escrow” or transfer via FBI guidance if ever considered.
- Consider offering a public reward (commentators suggested larger rewards could prompt actionable tips).
- Investigators should:
- Pull phone/pacemaker telemetry and phone tower pings,
- Acquire and forensically process the impounded car(s),
- Review local camera sources and traffic cams for vehicle ingress/egress,
- Trace email and crypto paths (specialized units may still be able to identify origin or patterns),
- Re‑interview family and recent visitors, consider targeted polygraphs or consensual deeper interviews (balanced with legal counsel and cooperation),
- Audit camera subscription logs for archived footage.
- Family messaging: specialists noted the family’s public videos may have been scripted with law‑enforcement input; public wording can be tactical and may include odd phrasing (some noticed language mirroring Silence of the Lambs).
Notable quotes & media beats
- Sheriff to media: “We don’t have anybody listed as a suspect” / “Everybody’s still a suspect in our eyes.”
- Ashley Banfield: stands by her top‑level source who told her Tommaso may be a prime suspect and that a car was towed.
- Harvey Levin: “The Apple Watch placement in the note is something that puts this letter on the FBI’s radar.”
- Family pleas (video excerpts): “Whoever is out there holding our mother, we want to hear from you… we need a way to communicate… we have to know that you have our mom.”
Main takeaways
- The case contains multiple concerning but unresolved elements: inconsistent public timelines, camera and pacemaker telemetry that pinpoint activity overnight, DNA processing, an impounded vehicle, and identical ransom emails with details that may be actionable.
- There are three competing investigative threads: (1) a real kidnapping with a serious ransom demand; (2) a murder/abduction by someone known or present with a subsequent deception; (3) opportunistic external extortion unconnected to the physical crime.
- Proof of life is the central hinge: if credible proof is produced, the ransom thread gains urgency; without it, investigators appear more likely to concentrate on local forensic and witness evidence to determine whether Nancy was killed or moved.
What to watch next
- Any FBI or sheriff updates on DNA results, pacemaker telemetry disclosures, and the car forensic processing.
- Whether the ransom email sender produces proof of life or additional contact methods (and whether Bitcoin tracing yields leads).
- Follow‑up interviews and whether law enforcement narrows suspects or confirms/denies Ashley Banfield’s reporting publicly.
- New neighborhood camera footage or other objective evidence (license plate reads, vehicle movement logs).
If you want, I can produce a one‑page timeline graphic or a short bullet checklist investigators/family might use to prioritize leads based on the items discussed in this episode.