20.4 Investigating Online Sexual Offenders


20.4 Investigating Online Sexual Offenders

In some cases, it is relatively straightforward to apprehend the offender and prove the crime, particularly when the offender does not conceal his activities because of weak technical skills or because he does not believe what he is doing is wrong.

CASE EXAMPLE (WISCONSIN v. MICHAEL L. MORRIS 2002):

start example

Morris, a 44-year-old man, met the victim, a 14-year-old girl, in an Internet chat room. Morris admitted that, in pursuing what he considered a romantic and consensual relationship, he came to Wisconsin four times to see the girl, bought her an entire outfit (including underwear), gave her a ring, took her to restaurants, accepted collect calls from her and gave her telephone cards, took her to a hotel where he photographed her in the nude, and took her to his home in Indiana. He estimated that he had had contact with her on about 20 days during the 30 days preceding the date of the state-charged offense.

end example

In another case, a 42-year-old man in San Diego used his AT&T dial-up account to post photographs on Usenet of himself having sex with his daughter. The FBI obtained his name and address from AT&T, compared his driver's license photo with the pictures posted on the Internet, and arrested him at his home (Associated Press 1998). Even when an offense can be established with relative ease, investigating online sexual offenders can be among the most difficult to deal with. These investigations are often emotionally stressful, particularly when dealing with young victims or severe sexual abuse. These investigations can also be technically challenging, particularly when the offender conceals or destroys digital evidence. An added challenge can arise when victims do not cooperate because they are in denial or actively protect the offender because of the relationship that has developed between them.

Investigators and prosecutors must understand and learn to deal with the incomplete and contradictory statements of many seduced victims. The dynamics of their victimization must be considered. They are embarrassed and ashamed of their behaviors and rightfully believe that society will not understand their victimizations. Many adolescent victims are most concerned about the responses of their peers. Investigators must be especially careful in computer cases where easily recovered chat logs, records of communication, and visual images may directly contradict the socially acceptable version of events that the victims give. (Lanning 2001)

Failure to handle victims appropriately can make them less willing to assist in an investigation, making it more difficult to build a case. Additionally, attempts to force the victim to cooperate by confronting them with evidence of their abuse further victimizes them.

In light of the technical complexities and emotional pressures in this type of case, investigators and examiners have to be particularly wary of developing preconceived theories. Carefully implementing the investigative process detailed in Chapter 4 will help investigators and examiners consider possible explanations for a given piece of evidence and will discourage them from jumping to a conclusion based on personal bias or past experience. For instance, digital evidence on the suspect's computer might suggest that he was accessing Internet resources intended for teenagers when it was, in fact, the suspect's young daughter using her father's computer and Internet account. Similarly, the presence of pornographic material on a computer might suggest that the suspect downloaded the materials when, in fact, a computer intruder broke in and placed the images on the computer.

In these early days of digital evidence and digital investigation there are many mistakes to be made. The most effective approach to minimizing errors is to acknowledge gaps in one's knowledge, to consult peers for assistance, and to perform research and receive training when time allows. Also, good investigators and examiners have the mental discipline to question assumptions, objectively consider possibilities, account for evidence dynamics, and ultimately clarify what the evidence does and does not tell us.

The initial stage of any investigation is to determine if a crime has actually occurred. Even if investigators are convinced that the defendant committed a crime, it can be difficult to prove. For instance, unless there is digital evidence establishing the continuity of offense, it can be difficult to show that a suspect disseminated child pornography to others via the Internet. For instance, Bart Henriques was sentenced to 42 months in prison for possession of child pornography in violation of 18 U.S.C. 2252A(a)(5)(B) but his conviction was overturned on appeal because there was insufficient evidence to support a finding that the images were transported in interstate commerce (United States v. Henriques 1999). In some cases, it can even be a challenge to demonstrate that an individual knowingly possessed child pornography.

CASE EXAMPLE (CONNECTICUT 2003):

start example

A man was suspected of stalking a 14-year-old girl. When police executed a search warrant at his home, they found a computer. Initially, investigators submitted the computer for examination to determine if the suspect had any digital pictures or maintained diaries or logs of his activities related to the girl. Digital evidence examiners found 30 pictures in unallocated space that appeared to meet the jurisdiction's statutory definition of child pornography. The prosecution decided to charge the man with possession of child pornography to spare the 14-year-old victim the trauma of testifying. She was afraid of him, and the prosecution wanted to shield her from having to see him again.

Shortly before the trial, the digital evidence examiner received a request from the prosecutor to identify the children portrayed in the images. Children in child pornography images may be identified through the National Center for Missing and Exploited Children in the United States and using Europol's Excalibur image database. Although only four of the images extracted from unallocated space on the defendant's computer depicted identified minors, the prosecutor decided to pursue the possession of child pornography charges. However, the prosecution only called on the digital evidence examiner to testify as to the content and character of the 30 recovered images. The examiner stated that he was not qualified to determine the ages of the unidentified children or whether the images depicted actual children or were computer rendered. After extensive voir dire of the examiner, the prosecution conceded that the state was unable to prove all of the elements of the crime of possessing child pornography beyond a reasonable doubt.

Notably, the defendant maintained that he never intended to possess the images. He claimed that he had been "mouse-trapped" - referring to the phenomena of clicking on a link and being taken from one website or advertisement to another and another, opening up so many Web pages that it may be necessary to shut the system down to end it swiftly. In this case, if the prosecution had survived the initial motion to dismiss, the defendant very well may have prevailed because, given the scant number of images and their location on the hard drive - in unallocated space - it is at least plausible, if not enough to raise a reasonable doubt, that the defendant did not knowingly possess the child pornography.

end example

In addition to establishing that a crime was committed, establishing continuity of offense, and overcoming preconceived theories, digital evidence examiners must objectively and carefully analyze evidence and present findings to decision makers. Any inaccuracies in their findings can have a negative impact on a case and must not overstate findings or suggest guilt of a particular individual. For instance, a digital evidence examiner may be able to demonstrate that a series of photographs on a suspect's computer are consistent with a specific digital camera found in the suspect's home. However, a digital evidence examiner is rarely qualified to assert that such images show the suspect raping the victim. Similarly, a digital evidence examiner may be able to differentiate between real child pornography and virtual child pornography, but is rarely qualified to determine the age of a child in such an image.

Interpreting digital evidence in an objective manner can require great effort, particularly when there is a strong desire to attribute activities on a computer or network to a specific individual. For instance, in one case it might be tempting to assert that, "On July 23 between 17:14 and 18:23, the suspect was connected to IRC from his home computer and was communicating with the victim." However, if the suspect's computer does not contain corroborating data, his Internet Service Provider (ISP) does not retain Automatic Number Identification (ANI) information, and his telephone records do not show a call to his ISP at the time, it is difficult to establish continuity of offense and the digital evidence may only support a weaker assertion such as, "On July 23 between 17:14 and 18:23, an individual using the nickname 'Daddybear23' was connected to IRC via the suspect's Internet dial-up account and was communicating with the victim."

Even if an abundance of corroborating digital evidence exists, the following interpretation may be more accurate and compelling. "The combination of IRC chat logs found on the suspect's computer (Exhibits #232 and #233, C1 on the Certainty Scale in Chapter 7), ANI records obtained from the suspect's ISP (Exhibit #532, C-value C4), and telephone records obtained from the suspect's telephone provider (Exhibit #662, C-value C4) together indicate that, on July 23 between 17:14 and 20:23, an individual in the suspect's home was connected to the Internet using the suspect's dial-up account, was connected to IRC using the nickname 'Daddybear23', and was communicating with the victim. Notably, in Exhibit #233 the person using screen name 'Daddybear23' identifies himself as John Smith and provides his address and telephone number."

Even apparently minor details can make a major difference in the interpretation of digital evidence. Overlooking a well-known vulnerability in a Web browser has led to the false conclusion that a given individual intentionally downloaded pornographic files and added bookmarks when, in fact, they were created by a malicious Web site. Misinterpreting the date-time stamps in a Web browser's history database as coming from the system clock on the Web server rather than that of the client has caused questionable Web browsing activities to be attributed to the wrong computer user. The Candyman case provides a stark example of the consequences of misinterpreting digital evidence in this type of investigation.

CASE EXAMPLE (UNITED STATES v. PEREZ 2003):

start example

Thousands of individuals have been accused of receiving child pornography through a Yahoo E-group named Candyman (created by Mark Bates) that was operational from December 6, 2000 to February 6, 2001. Like all Yahoo groups, the Candyman site included: a "Files" section, which provided a means for members to post images or video files of child pornography for others to download; a "Polls" section, which facilitated surveying among group members concerning child exploitation; a "Links" section, which allowed users to post the URLs for other websites containing child pornography and child erotica; and a "Chat" section, which allowed members to engage in real-time Internet conversations among themselves. However, in obtaining search warrants investigators incorrectly asserted that every e-mail sent to the group was automatically distributed to every member of the group. In actuality, members could choose not to receive e-mail sent to the group. As a result of this misunderstanding of how Yahoo e-groups function, it is not clear how many of the 7,000 unique e-mail addresses actually received child pornography, and many search warrants that were issued based on this assertion are being challenged. In United States v. Harvey Perez, for instance, the court held that the FBI acted recklessly when drafting the search warrant affidavit.

end example

If an offender's computer reveals a large number of online contacts, some agencies send a letter to each individual to determine their involvement. A simple form letter summarizing the investigation and listing the suspect's online nicknames and e-mail addresses can encourage other victims to come forward or alert parents of a potential problem. However, some parents may not be aware of a problem so, in the letter, it is advisable to ask if they have children, how old they are, and what online nicknames they use.

A digital evidence examiner who carefully applies the scientific method as described in Chapter 4 is less likely to overlook or misinterpret important details. By actively seeking ways to disprove one's own theory (a practice known as falsification), one has a greater chance of developing a factual reconstruction of what occurred. The role of a forensic computer examiner is to objectively and thoroughly examine all available digital evidence, identify details that may be relevant, and present the findings objectively, without overstating their significance. The forensic examiner's role is not as an advocate for one side in a case, regardless of how convinced the examiner may be of a suspect's guilt or innocence. The evidence should speak for itself - personal or moral agendas have no place in the performance of the objective examiner's duties. It is up to the judicial system, not the forensic examiner, to weigh the evidence and come to a determination of an individual's guilt or innocence. The digital evidence examiner must be cognizant of the fact that justice and legal truth do not always coincide with scientific truth.

20.4.1 Undercover Investigation

In some cases, particularly when dealing with concealment behavior, it may be necessary to communicate with an offender on the Internet to attribute a crime. This course of action is only recommended for law enforcement personnel with explicit authorization and backing from their agency. In some instances, private citizens have taken the law into their own hands, posed as children on the Internet, and made contact with possible offenders.

CASE EXAMPLE (WISCONSIN v. KOENCK 2001):

start example

Police received information relating to Koenck from an individual identified as Nancy A.C., a 46-year-old private citizen who co-founded a group called Internetwatch that monitors the Internet, mostly for child pornography. Nancy had communicated with Koenck (nicknamed dirtboy69) through an online profile named teddie_bear_11 of fictitious 12-year-old twin girls named Teddie and Georgie. In some of the communications, Koenck expressed an interest in having sexual intercourse and contact with the twins. Nancy informed Koenck that Teddie and Georgie would be visiting a relative in Wisconsin and Koenck decided to travel from Iowa to meet them. Members of the Division of Criminal Investigation who had taken over the case arranged to meet Koenck at a McDonald's restaurant where he was arrested. Koenck admitted that he had traveled from Iowa to Wisconsin to meet and have sex with Teddie and Georgie, whom he believed to be 12 years old and whom he had met on the Internet. Koenck was convicted of child enticement.

end example

While it can be successful in identifying and apprehending criminals, this practice of private citizens luring offenders is not recommended for a number of reasons. First, it puts private citizens at risk - the offender may target them in retaliation. Second, private citizens may inadvertently violate the law. When the subject of the investigation is child pornography, seeking it out and possessing it as part of a vigilante action can lead not only to the arrest of the offender, but also the well-intentioned citizen, regardless of proffered intent. Also, the defense will likely attempt to portray the vigilante as an agent of law enforcement and retrospectively assign law enforcement standards (entrapment, warrants, etc.) to the "investigation" of the private citizen.

Recall that the federal law and many state laws contain exceptions for law enforcement and judicial uses of child pornography, and for the inadvertent possession when promptly reported to police. However, purposely seeking out the contraband without the blessing of law enforcement, and acting as its unsanctioned agent, invokes the criminal law and meets most statutory definitions of possession of child pornography. This is so because most laws require only that possession is "knowing." Well-meaning citizens searching the Internet for child pornography so that they may report it to police know the content and the character of the material and, when they successfully find it, they possess it, as it will be copied to their RAM and/or hard drive by the very act of viewing it onscreen.

Given the difficulty in distinguishing between an overly zealous, helpful citizen and someone trying retrospectively to justify their interest in children, courts generally err on the side of caution in child exploitation cases. For instance, world-famous rock star, Pete Townsend, was arrested for possessing child pornography as a result of the Avalanche Operation in late 2002. Townsend claimed that he only accessed the child pornography Web sites three or four times, and then only for research he was conducting in order to combat the crime. Eventually, he was cleared of possessing child pornography, but his name will still be listed in Britain's sex offender registry for the next 15 years (O'Hanlon 2003). Even police officers have been convicted of possessing child pornography despite their claims that they were conducting undercover investigations on their own time.

Third, private citizens rarely have the training and experience necessary to conduct a successful undercover investigation, including the collection of digital evidence. The complexity and controversy surrounding child pornography cases even makes it difficult for law enforcement to build a solid case, let alone technically uninformed citizens. Mistakes by overzealous private citizens can make matters worse as demonstrated in the case against Superior Court Judge Ronald C. Kline.

CASE EXAMPLE (CANADA 2001):

start example

Canadian vigilante, Bradley Willman, sent a Trojan horse program to a California judge Ronald Kline, gained unauthorized access to his computer, and found a diary detailing his sexual fantasies involving children and about 100 images alleged to be child pornography. Although the defense initially suggested that the evidence may have been planted by the intruder, Kline later admitted downloading pornography from the Internet, stating "There may be a picture or two on that computer that's illegal. ... It's not because I meant to keep it." At the time of this writing, the case remains in litigation. The defense argued that all evidence obtained by Willman should be suppressed because his actions were criminal and that he was acting as an agent of law enforcement when he broke into Kline's computer. Prosecutors denied that Willman was acting as a police agent, but was a cooperative suspect in the case and noted that he was a "potential suspect" in at least three US Customs Service investigations of child pornographers. However, a Federal judge ruled that Willman was acting as a police informant, which could taint all of the evidence he obtained from Kline's computer. The outcome of this case will have implications for both vigilante citizens and law enforcement dealing with online informants (Associated Press 2003).

end example

Prior to conducting an undercover investigation, investigators must take steps to protect their identity as discussed in the anonymity section of Chapter 19. Furthermore, investigators should use specially designated computers to conduct undercover investigations to avoid commingling of evidence and possible allegations of personal pedophilic interests. As an example, suppose you encounter a potential target while you are online at home. Sitting in your living room, while your spouse and three children watch the television and talk on the telephone, you engage the target in chat. You use solid documentation principles, logging your chat, printing it out, and dating and signing the page. The next day, you chat with the target online from work, using your home screen name. The target sends child pornography to your screen name during the course of your online relationship and asks you to meet him for sex. You agree and instead of the 13-year-old he thought would be greeting him, you and several of your colleagues arrest him for transmitting child pornography and for attempting to entice a minor into sexual activity. When it comes time for discovery, things can begin to become uncomfortable. The defense requests your Internet account transactions and content of e-mails. They also request an independent examination of your personal home computer's hard drive. The defense puts your spouse and children on the witness list because they were present when you were corresponding with the defendant online. To make matters even more uncomfortable, the defense attorney advances the argument that you turned an online chat from your home into a law enforcement sting only because you feared that you had been caught engaged in illicit online behavior and used the law enforcement angle as a means of avoiding prosecution yourself.

One final caveat regarding undercover investigations is that using a minor, particularly the victim, is an unsafe practice.

CASE EXAMPLE (FLORIDA 1999):

start example

University of Central Florida professor Madjid Adam Belkerdid was arrested and charged with sexual battery and a lewd and lascivious act on a child. Investigators used a 12-year-old girl Belkerdid met on the Internet to arrange a meeting with the suspect. Despite the presumed safeguards taken to ensure the girl's safety, Belkerdid allegedly touched the child's breast during the meeting (Associated Press 1999).

end example

The two primary forms of accepted undercover investigation are: (1) investigators posing as a fictitious potential victim, and (2) investigators taking on the identity of a victim who has already been contacted.

CASE EXAMPLE (Investigators posing as a fictitious victim, Wisconsin v. Kenney 2002):

start example

On September 23, 1999, Eric Szatkowski, a special agent with the Wisconsin Department of Justice, posed as a 13-year-old boy from Milwaukee named Alex. Szatkowski logged into an America OnLine chat room on the Internet and engaged in an online conversation with Kenney. The two discussed erotic wrestling, and Kenney explained that he paid men $100 per hour for such activity. At Kenney's suggestion, they agreed to meet at a Denny's restaurant near the Milwaukee airport before going to a hotel to engage in erotic wrestling. Kenney indicated that after they met, either one could "call it off." Kenney then packed his wrestling bag and drove from his home in Chicago to Milwaukee. When he arrived at Denny's, he was arrested and was subsequently convicted of child enticement.

end example

CASE EXAMPLE (Investigators taking on the identity of a victim who has already been contacted):

start example

Police in Michigan received a complaint that a 48-year-old man had traveled from Connecticut to Michigan where he sexually assaulted a 13-year-old girl he met on the Internet. Police were informed of the crime after the man returned to Connecticut. When they had completed their investigation and were ready to have the suspect arrested in Connecticut, an undercover investigator in Michigan obtained the family's permission to assume the victim's online identity and communicate with the suspect. While the undercover investigator posed as the child victim and engaged the suspect in a conversation online, the Connecticut State Police went to his home and arrested him. Much to their surprise, not only was the suspect caught chatting with the undercover investigator, he was caught with his pants down - literally.

end example

Notably, the latter approach is only used when investigators are informed after it is too late to prevent the victim's exposure to the offender. Children are not used in undercover investigations because of concern for their welfare.

Some offenders have attempted to defend themselves by claiming that they knew the person they were communicating with was not a child and that they were role-playing with an adult. For instance, Patrick Naughton contended that he believed the "girl" (actually an FBI agent posing as a 13-year-old girl using the nickname "KrisLA") he met in a chat room called "dads&daughterssex" was really an adult woman, and that they were playing out a sexual fantasy. Ultimately, Naughton pled guilty to one count of interstate travel with intent to have sex with a minor (USDOJ 2000). In 2003, John J. Sorabella III, 51, of Massachusetts was convicted of attempting to set up a sex rendezvous with a New Britain officer posing as a 13-year-old girl (Connecticut v. Sorabella 2003). He claimed that he knew all along that he was corresponding with an adult, that such talk among adults is common, and is all part of a fantasy. Despite his defense, he was convicted of most of the charges, which included attempted second-degree sexual assault, attempted illegal sexual contact, attempting to entice a minor, attempted risk of injury, attempted obscenity to a minor, obscenity and the import of child pornography.

Other offenders have attempted to defend themselves by arguing that this form of enforcement violates the First Amendment. However, in Wisconsin v. Robins, the court held that the First Amendment is not involved, because the child enticement statute regulates conduct rather than speech or expression (Wisconsin v. Brian D. Robins 2002).

The process of preparing for and conducting an undercover investigation is very involved, requiring specialized training and tools. In spite of this, it is possible for an experienced undercover investigator to pose as a potential victim while avoiding the pitfalls of entrapment, demonstrate that the suspect is predisposed to committing a certain crime, and persuade the suspect to reveal his/her identity online or arrange a meeting, without raising the suspect's suspicions, while abiding within the law and maintaining complete documentation throughout.




Digital Evidence and Computer Crime
Digital Evidence and Computer Crime, Second Edition
ISBN: 0121631044
EAN: 2147483647
Year: 2003
Pages: 279

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net