Kansas ICAC Task Force Child Exploitation Investigations

1. Detective Shawn M. Bostick Wichita Kansas Police Department Kansas ICAC Kansas ICAC Task ForceChild Exploitation Investigations

2. Challenges to Law Enforcement • Identify and apprehend predators operating in a constantly changing technically complex environment. • Facilitate a successful prosecution with a thorough investigation to prevent further victimization. • Identify children who have been sexually exploited by predators. • Serve as a conduit to a variety of resources to aid victims and their families with their recovery.

3. Goals and Objectives • Reactive Investigations – Knock and Talks, Search Warrants, victim outcry and other agency referrals. • Review Officer Safety - The importance of identifying your suspect before the interview. • Suspect Interviews - Technical aspects to enhance your interview / interrogation. • Considerations when conducting victim interviews.

4. These are NOT Victimless Crimes! • Never lose sight of the fact that these are violent crimes involving real children. • The abuse suffered by these children will live within them every day of their lives and is repeated every time an image of their victimization is distributed.

5. These Are Not Your Typical Criminals! Frequently well educated, have established ties to the community and have had little or no interaction with police. Overcome with shame. Face intense scrutiny by friends, neighbors, co-workers and members of their community. Reputations are destroyed. Not only do the children suffer…so does the suspect’s family.

6. Offenders: Who are they? There is no one “profile” of a child predator. They could be: Youth coach Electrician Lawyer Reporter Law enforcement Businessman Actor Salesman Teacher Clergy

7. First and Foremost ConsiderationsOfficer Safety! Find out everything you can about your suspect and their associates before conducting an interview or making an arrest. Assess the risk and determine how you will respond to decrease the possibility of injury or death to yourself and fellow officers. It is not uncommon for suspects to react in an irrational manner.

8. July 14, 2006ByDana WillhoitThe Ledger LAKELAND -- A Lakeland man was found dead at his home Wednesday afternoon, possibly from suicide, several days after police searched his home for child pornography.Police served a search warrant on the home of Harry Weber, 68, on Monday. The investigation started after a female acquaintance of Weber contacted police.She told them that Weber, whom she barely knew, had made an odd comment to her about how a man "could fall under the spider bite of a young boy's kiss.“ He then contacted her minor son, which alarmed her. She then talked to Weber's roommate, who told her that Weber was obsessed with child pornography, which he downloaded from the Internet, and that he might be stalking young boys.When police interviewed Weber, he told them that he had pictures of young boys, which he described as "child erotica," but denied having child pornography, the report said.Police later spoke to his roommate, who told them that he had seen Weber download numerous child pornography images from the Internet, and that he would print many of the images and post them on foam board to display them around the home.The roommate said that after the police visited, Weber told him he had gotten rid of some of his "collections" in trash bins around the city, and asked the roommate to help delete the images from Weber's computer. The roommate refused, and instead moved out of the house.Police searched the house Monday, but Weber was not arrested at the time pending a forensic examination of the computer.Police were called to the house Wednesday afternoon to do a welfare check on Weber. Police found Weber dead. The cause of death will be determined by the medical examiner. Child Porn Suspect Found Dead at HomeSuicide

9. Deputy is killed, another wounded August 20, 2004 FORT LAUDERDALE - One Broward County sheriff's deputy was killed and another was injured when a child pornography suspect opened fire on them with a high-powered weapon as they served a search warrant. Detective Todd Fatta, 33, was killed when shots allegedly fired by Kenneth Wilk, 42, hit him in the chest, penetrating his bullet-resistant vest. Sgt. Angelo Cedeno, 36, was shot in the hand and shoulder. Other officers returned fire at Wilk, but he was not injured and was taken into custody at the scene. Wilk was held on charges of conspiracy to possess child porn and conspiracy to obstruct justice. The deputies were part of a multi-agency task force which combats child porn. Twice before, task force members had been to the house. Last year, Wilk was arrested after he threatened officers serving a child porn warrant. Last month, another warrant was served and Wilk's partner, Kelly Ray Jones, a registered sex offender, was arrested on charges of using the Internet to send illicit images of children to an undercover detective. He remains jailed. After Jones' arrest, Wilk was bragging police had not found all of the child pornography. Officers returned to search for additional material. When the deputies entered the house and rounded a corner, Wilk fired at them. Mr. Wilk had several weapons, several high-caliber weapons around the house.

11. Preferential Child Molesters 1. Sexual preference is children. 2. Sexual fantasies focus on children. 3. Will use Internet to groom and molest children. Situational Molester 1. Preference is not children but will molest them. 2. May/can be violent. 3. Act mat be a result of another crime.

12. Knock & Talks,Search Warrantsand Suspect Interviews

13. WHO’S BEHIND THE COMPUTER OR ELECTRONIC DEVICE? SUSPECT IDENTIFICATION

14. Internet Service Provider Subpoena subscriber information including screen names, e-mail addresses, specific and/or recent online activity from suspect’s ISP. This may identify the subscriber but not necessarily the offender (AOL). Yahoo! does not verify subscriber information but does capture and retain the suspect’s IP address at the time the account was created. “Online Activity” or “IP History” Logs may confirm if a suspect was online on a specific date and time but are retained by ISP’s for varying limited periods of time.

15. Suspect Identification Include in your search any other occupants of the household and /or any known associates of the suspect. Consider non-traditional sources of information. Any information extracted by suspect during chat information to include such things as his name, description, location, telephone number, vehicle description, etc.

16. Suspect Identification Criminal History (NCIC) Local Law Enforcement NCMEC FBI Innocent Images / ICE Sex Offender Registries Search Engines (Google, Yahoo!, etc.) Online Profiles, Brief Cases, Photo Albums (AOL, Yahoo, MySpace, etc.) Web Logs “Blogs” (MySpace, Facebook, etc.) Employment Weapons Permits

17. So You Think You’re Prepared for Anything and Everything…Maybe Not…

21. Seizing the Computer is Not Enough! Whether you access your suspect’s computer through consent or a Search Warrant… It’s your responsibility to place the suspect behind the computer or electronic device! You must be prepared to conduct a thorough interview.

22. The Investigation Typically this is accomplished through the suspect’s own admissions during an interview. Through a telephone call conducted by a victim or an undercover officer with the suspect. The suspect’s use of a web camera. Through a ruse at the suspect’s residence while he is online.

23. Executing a Search Warrant Determine an appropriate approach to include the presence of a uniformed officer…will it be a knock at the door, a dynamic entry or something else? Prepare a written “Operational Plan” that has been reviewedand approved by your supervisor. Delegate responsibilities – you can’t conduct a thorough interview and search at the same time. Consider utilizing ICAC task force members from neighboring agencies. Contact your ICAC if non-sworn or private sector employees who possess technical expertise are used in Network investigations.

24. Planning for Safety Schedule a briefing to include all of the participating officers…encourage their feedback. Distribute a copy of the “Ops Plan” to all of the participating investigators. Make certain that participating investigators understand both the risk and their roles. Are you confident that you have done everything to prevent serious harm to your fellow officers?

25. In the Absence of Probable Cause…Knock & Talks The objective is to obtain consent to conduct an on-site search of the suspect’s computer. Be prepared to conduct an on-site search of the suspect’s computer. Once again, keep officer safety in mind…know who your suspect is, plan your approach. Should take place where you most likely believe the suspect and his computer will be located (i.e., home or office).

26. The Interview – Your Approach(some ideas) Your approach will probably include an element of deception… We received a complaint from a child’s parent regarding your online activities. We are investigating a runaway and found links to you on the child’s computer. Seek written consent to conduct an on-site search of your suspect’s computer.

27. Knock & Talks Non-custodial interview – Miranda warning not required. Fine line between custodial and non-custodial. Can’t go wrong with Miranda. Limit the number of investigators initially present to avoid the impression of a custodial atmosphere. Document your suspect’s consent with a “Consent to Search” form signed by your suspect. Consider having your examiner wait outside until after you have obtained consent.

28. CONSENT TO SEARCH COMPUTER(S), COMPUTER PERIPHERALS, & RELATED MEDIA I, ________________________________________, do hereby authorize and give my permission to_____________________________ , who has identified himself/herself to me as a sworn law enforcement officer, with the necessary assistance of a computer forensic examiner, to make a full and complete search of my computer (s), computer peripherals and related media located at ___________________________________. I have been advised by the above law enforcement officer that law enforcement officers are engaged in an investigation concerning an alleged violation of federal and/or state laws pertaining to Internet crimes against children, including child pornography. I do further authorize and give permission to take from my___________________________ located at __________________________, any computer (s), computer peripherals and related media which may have or might have connection, value or relevance as evidence in said investigation. The above law enforcement officer has fully and fairly advised me of my rights as follows: That I have a right to refuse consent to this search of my property. That I have a right to consult with an attorney or any other person of my choice prior to giving this consent and permission to search the above described property. That any computer (s), computer peripherals and related media found by said officers in the course of their search can be used as evidence against me or others in a court of law. I fully understand and appreciate these rights and wish that it be specifically understood that I am hereby giving consent and permission to conduct the search of the computer (s), related peripherals and related media solely because of my desire to freely and voluntarily cooperate and assist in this investigation. I have not been promised anything or been threatened or coerced in any way; nor has any inducement of any kind been held out to me in return for this consent and permission to search. Have suspect & witnesses sign with date, time and location.

29. Knock & Talks Consider who else may be at the residence when you plan to do this… wife, children, friends, other relatives. Need to interview them also. Once again, work to narrow your focus by identifying who uses the screen name in question. Don’t be confrontational…give your suspect an opportunity to explain...to rationalize or minimize his behavior. What are you going to say…

30. To Arrest or Not to Arrest Based upon individual circumstances. Is a child at immediate risk? – may include suspect’s own children, step children or children in the neighborhood. Does the suspect work or volunteer in an environment with children? Keep in mind does “speedy trial” begin at the time of arrest. Consult with your prosecutor. Forensic examination of computers may take days, weeks or months.

31. The Lead In… Have you experienced any unauthorized charges on your credit card? Has anyone else recently had access to your computer? Family members? Friends? Have you been directed to “offensive” or “inappropriate” websites? Have you received any unsolicited “offensive” or “inappropriate” material?

32. Debriefing Guides will Help You Remember to… Determine the source of your suspect’s child pornography. How your suspect obtains child pornography (casual trading in chat rooms, private groups, file sharing software, commercial websites). Determine the frequency / volume of child pornography sent and received by your suspect. Identify online associates of your suspect that may form the basis for “spin-off” investigations.

33. “Knock & Talk” Considerations Do you have the technical expertise present to conduct an on-site search of the computer. Preview software is not a “one size fits all” product. Consider having several varieties in your toolkit such as Knoppix, ImageScan or using EnCase with a Fastblock device. Do you anticipate an immediate arrest if child pornography is found?

34. How In-Depth is the On-Site Search? Document all steps taken while conducting the search. Does the Search stops when the first image of child pornography is found if it is for another reason. Computer should then be seized pending the issuance of a Search Warrant seeking authorization for a comprehensive off-site forensic analysis. What about storage media (diskettes, thumb drives, CD’s and DVD’s)?

35. SUSPECT INTERVIEWS

36. Interview Should Include… Who lives at the residence? How many computers are located within the residence? Who uses the computers, are they password protected? Are any folders/files password protected? Consider referring to a debriefing guide.

37. Use the Interview to… Identify children who may have been exploited by your suspect. Identify other offenders known to the suspect. Give your suspect the opportunity to write a note to the “child’s” parent. Determine what age and sex they preferred.

38. Themes Give your suspect an opportunity to confess in a manner that… Is psychologically acceptable to him Makes behavior appear less reprehensible Minimizes the gravity of the crime Transfers some or all of the blame to others Allows them to be seen as the “victim” GET THEM OUT OF DENIAL STAGE

39. Rationalization “I just wanted to tell the child how unsafe it was to meet a stranger…” “I would never hurt a child…” “I didn’t create it…I just downloaded it” “I gave the child attention he /she was not getting at home.”

40. Your Suspect May Want to Blame… The Child – “She said she was eighteen” The Victim’s “Uncaring” Parents Their Own Spouse Alcohol / Drugs Depression / Anxiety Their Own Victimization Ignorance - “I didn’t know chatting was against the law.”

41. Or Technology… Computers, digital images, video clips The Internet Web cameras Unsolicited sexually explicit e-mail “Instant Messaging” Wireless communications – PDA’s cellular phones etc.

42. Preparing for Your Interview • Review the records you subpoenaed from the suspect’s ISP – know who you’re dealing with. • Verify through online activity or IP history logs that someone was “signed on” at the time the image was transmitted or the chat occurred. • Determine where the suspect’s account was being accessed from…home, office, library? • Dial-up account information, DSL connections, and IP address information may link the computer to a specific location at a specific time.

43. Videotaping the Interview • Considerations include your agency policy, your preference and the opinion of your prosecutor. • Videotape captures the unspoken word…the suspect’s body language. • They can also be a dual edged sword. • Videotape also allows for scrutiny from the defense.

44. If You Plan to Show the Suspect Images • Submit the images to NCMEC for comparison with their Child Victim Identification Program (CVIP) database. • Your submission should include all images of children including both child erotica and child pornography. • CVIP’s report to you will also identify those children who have been identified during previous investigations and a law enforcement point of contact for each child. • Have a pediatrician view the images and offer an opinion as to the child’s age if the child has not been previously identified.

45. Determining Who Your Suspect Is • Body Language. • Ask the occupants who uses the computer • Ask them to identify their ISP and the screen names / e-mail addresses that they use to narrow the focus of your investigation. • What if multiple users share the same screen name? • Does anyone utilize file sharing (Peer to Peer) programs?

46. The Interview • Surprisingly, most suspects will be willing to talk to you if only to deflect the focus of your investigation away from other family members. Interview family members now! • Advise the suspect of his Constitutional Rights as per the Miranda decision from a written Rights/Rights Waiver form. Have your suspect sign the form. • Utilize a “Debriefing Guide” only after establishing a rapport with your suspect to insure a thorough interview. • Be prepared to tape record a statement.

47. The Interview • Most people are more than willing to expound upon their computer / electronic device skills without suspicion while being questioned. • Confirm through questioning that your suspect possesses the computer skills required to commit what you suspect him of doing…Let him teach you! • The information you gather may be extremely important to the forensic examiner. This will probably be your only opportunity to obtain encryption keys.

48. Debriefing Guides will Help You Remember to… • Establish your suspect’s level of computer skills. • Identify all computers used by your suspect. (home, work, friend’s house, library) • Identify past / present screen names and e-mail addresses used by the suspect. • Identify places frequented by your suspect on the Internet (chat rooms, public and groups, peer to peer networks)

49. Guide for Computer Crime Related Interview Date / Time of Interview: Others Present: Who resides at the residence: Formal Education: Computer Training: (formal, informal, self taught) (In your book)

50. Guide for Computer Crime Related Interview Screen Names and Passwords for each user: E-Mail Addresses for each user: Storage Media utilized by each user? (hard drive, diskettes, CD’s, thumb drives) Has anyone else used the screen name under investigation? Who? Was the password for this screen name shared with anyone? Who?