First and foremost, child pornography investigations almost always start online. Remember the good ole’ days of Napster? Remember how it was taken down? Remember when Metallica and Dr. Dre sued Napster?
Well, Napster may be gone, but there are thousands of copycat websites out there – and they are still in business. However, these sites not only provide users with bootleg copies of movies, software, music, and the like, but they are also home to some of the seediest, low down and dirty parts of the internet. It is these dark neighborhoods where child pornography lives.
These Napster copycats are also places where pedophiles go to acquire and trade child pornography. They do so by downloading file-sharing software and creating an anonymous account.
However, law enforcement is privy to these activities. This is the part where the Internet Crimes Against Children task force comes into play… referred to in law enforcement and legal circles as “ICAC”.
Step One
To nab those who peddle in child pornography, ICAC will typically launch an investigation in one of two ways. The first is to assume a known child pornographer’s profile. This happens when someone is caught and ICAC gains access to their profile following a prosecution. The second occurs when ICAC acts in an undercover capacity by assuming the identity of someone trying to obtain child pornography – much like the DEA does with drugs.
Step Two
Regardless of the method used, the next step involves interacting with other child pornographers. Whether these are people who are downloading child pornography or sharing it from their own libraries, ICAC will identify which profiles are downloading known child pornography files.
But how do they know what files are child porn and what are not?
Good question – the answer lies in the pervasiveness of child pornography on the internet. I hate that my career has educated me about this topic to this level, but the reality is that there are literally thousands of child pornography files that circulate around and around the internet. The same images and videos of the same exploited childen pop up all over the world. There are so many of these same images and videos circulating, that ICAC is able to identify them by their file name or key words associated with their search.
Just how drug dealers and drug users have street names for certain types of drugs… molly, mary jane, X, H, smack, china white, snow, trees, etc… pedophiles have code and lingo that they use to identify certain types of child pornography. ICAC takes advantage of these terms, lingos, and known file names to identify when a user downloads or shares child pornography.
Step Three
Once a profile has been identified as either downloading or sharing child pornography, ICAC will use commercially available software to identify the IP address of that user’s profile… and YES this is 100% legal and they lawfully do it in EVERY case.
Once an IP address has been identified, ICAC will issue a subpeona to the internet service provider who owns that IP to obtain account information. This will include the name, address, phone number, and other information of the person or entity whose account was associated with that particular IP address on the specific date in question.
Step Four
Once an suspect profile has been identified as downloading or sharing child pornography, an IP address has been ascertained, and customer biographical data obtained, the next step is to get a search warrant from a judge. However, this is where a little more investigating is necessary.
The primary question that needs to be answered is whether or not the internet account holder is likely the same person who is downloading or sharing the child pornography. In many cases, a mom or dad or roommate may be the account holder for a residence where many people use the same internet service. There are other possibilities as well – maybe a pedophile is using a corporate internet account at work or maybe he is accessing a wifi network that isn’t password protected. There are a few possibilities.
Before a search warrant is applied for, ICAC has to do a little homework. They usually start with pulling driver license issue of the name on the account and cross referencing it with the address on the account. Hopefully there is a match. Next, they will run a criminal history… has this person been in trouble before, does he have a history of sex offenses, does he have a violent background, or is he a first time offender?
Depending on what comes back, ICAC has a few options. The first is always surveillance – especially in the case of a single guy, living alone, whose driver license address and name match that on the internet service provider account. ICAC puts “eyes on target” to confirm what they already suspect.
If they feel they have enough to go to a judge, ICAC will then apply for a search warrant. In this application, ICAC will detail what they have done in their investigation and why they have probable cause to believe that there is contraband in the target location. A judge will review the application and decide whether or not their suspicion is justified. If the judge agrees that there is enough evidence to support a search, he/she will issue a search warrant for the target location.
In the alternative, if ICAC cannot develop enough evidence to get a search warrant, they may do a “knock and talk” to see if the residents at the target location will consent to a search without a warrant. Unbelievably, people agree to this all the time.
Step Five
Regardless of whether they get a search warrant or obtain consent to search from a resident, the next step is to get their hands on all the electronic devices. Especially in cases like Jared Fogle’s, where they are executing a search warrant, ICAC will show up with its digital forensics people.
These folks will use specialized electronic equipment to take a mirror image of electronic devices. When that is not possible, law enforcement may seize any object they suspect may have evidence in it – such as cd’s, sim cards, usb sticks, laptops, desktops, iPads, cell phones, whatever. The name of the game is to collect evidence.
Step Six
In this stage of an ICAC investigation, digital forensic experts will evaluate the seized items to determine if they have any child pornography on them. This will also include recovery of deleted items. If child pornography is found, the next step is for prosecutors to start putting a case together. This can include a single charge for every image or video or it can be one comprehensive charge that covers all. Prosecutors will often times file enough charges to expose the defendant to a lifetime in prison, but hold back on ALL the charges to see if the suspect actually wants to go to trial or take a plea bargain. If its trial, then the gloves come off and prosecutors go for the maximum number of convictions possible.