9-16-16 National:Let me Google that for you: EXIF data and public Internet used to crack open case.
In 2013, federal agents investigating the child pornography collection of one David S. Engle—who was later sentenced in Washington state to 25 years in prison—came across a new set of eight images. The pictures showed five boys, ranging in age from around seven to 15, urinating outdoors, shaving their pubic hair, and posing naked in bathtubs.
According to an affidavit from Postal Inspector Maureen O'Sullivan, who helped investigate the images, the photo set was "emerging and being widely distributed and traded by child pornography collectors on a national and international scale." Being new and uncatalogued, the images were forwarded to the National Center for Missing and Exploited Children (NCMEC), which maintains a vast database on prohibited images for use in investigations and image blacklists.
While law enforcement generally focuses on finding those who create and/or trade child pornography, a simultaneous effort is made to identify—and if necessary to secure—the victims. At the federal level, this task is centralized within NCMEC at the Child Victim Identification Program (CVIP)—and this new image set wound up at CVIP accordingly. The investigation of the pictures, which took three years to complete, opens a rare window into the world of digital detectives who specialize in tracing some of the world's most horrific imagery.
An Embassy Suites hotel room—but which one?
It turns out that federal agents largely run an investigation the way most of us would: on the public Internet.
CVIP took the obvious first step and pulled all the Exchangeable Image File (EXIF) (inside this link is a wealth of info about photos and the hidden info within them, esp LOCATION info) metadata from the photos. Amazingly, this data had never been scrubbed (even Facebook scrubs EXIF metadata from uploaded photos for security and privacy reasons). Though the images were not tagged with GPS locations, they did have dates attached. This would become a crucial clue. Without names and dates, finding the photos' creator would be difficult. Even if one could identify a particular hotel used in a photo, the huge number of possible dates would make guest check-in registries nearly worthless. But with a date, identifying a particular hotel might solve the case immediately.
To that end, CVIP agents looked through a subset of the pictures that had been taken in a hotel room on August 20, 2010. Background items suggested a location in Colorado, while the décor of the room hinted at an Embassy Suites hotel. To find out which hotel, CVIP "compared rooms in the images to online photos of hotel rooms in all of the Embassy Suites in the area." (This sounds like either a Google image search or a careful look at the Embassy Suites website.) The team decided that the location was the Embassy Suites in Denver.
The information was sent back to the postal inspectors, who fired off a subpoena to Embassy Suites for everyone registered at a "small subset of the hotel's rooms" on the date in question. However, the registry turned up no clear leads. The trail went cold.
Let me Google that for you
In February 2015, CVIP came back to the postal inspectors with new data. Unrelated investigations around the country had turned up additional images from the set, showing the same boys in Western locations, many of them outdoors.
EXIF data revealed that these photos were taken two days earlier than the others, and one additional boy was now pictured. More importantly, "a particular landmark" in the new photos offered a specific location: a cabin within the Antero Hot Springs cabins in Salida, Colorado.
In March 2015, the owner of the cabins sent postal inspectors information on guest rentals from the time. On the day the photos there had been taken, the cabin in question had been rented to "James Parkhurst" and three guests.
Rather than delving into some super-secret law enforcement database, agents turned to Google and Facebook to ID Parkhurst. Quick searches revealed a 55-year-old man with the same name who lived in Portland and was working as the Executive Director of Camp and Retreat Ministries for the United Methodist Church's Oregon-Idaho Conference.
A search of Facebook pages belonging to Parkhurst and his family members showed conversations about trips to national parks—along with names and (non-sexual) photos of the five boys in the prohibited image series.
Three of the boys, it turned out, were sons of Parkhurst's cousin. The other two were twins, both adopted from Vietnam by Parkhurst's brother.
The full Facebook
This discovery led to an August 2015 search warrant for the Facebook accounts of Parkhurst, the five boys, and their parents. Cross-referencing the conversations and pictures returned by the social network with the prohibited images and their EXIF data, investigators sketched out specific dates and times during which Parkhurst appeared to be on trips alone with the boys in locations matching those in the prohibited photos.
For instance, the earliest photos dated to August 2008, when Parkhurst allegedly took all five boys on a trip to Las Vegas, the Hoover Dam, and Yosemite National Park. As part of that trip, the group stopped at Travertine Hot Springs and Buckeye Hot Springs. Inspectors found references to both places on a public website devoted to naturism ("nudity is commonplace"). Another stop, at El Dorado Hot Springs, was listed on a separate site as one of the "best places for nude camping in Arizona."
With another prohibited image, investigators used "public search engines" to identify a particular hotel in Mariposa, California. As confirmation of the location, traveler pictures on a "hotel review website" matched the bathroom amenities and décor in the prohibited photo. Still more images were identified based on "landmarks that are searchable on Google" or by matching one pond to "an online image of the Olympic Hot Springs in Olympic Park, Washington."
Revenge of the thumbnail
Several of the photos from the set were circulating among child pornography collectors in cropped versions, with the pictures usually altered to remove an adult or to focus attention on the genitals.
But the crops didn't hide the original image completely. Investigators found that several of the image files still held thumbnail versions of the original image. One of these smaller but un-cropped images showed, in O'Sullivan's words, "Parkhurst nude next to [one of the boys]."
Secret databases
Assembling the case against Parkhurst eventually moved beyond open source information. Law enforcement periodically busts allegedly "legitimate" businesses selling things like "naturist films from around the world" that are actually child pornography. When that happens, investigators seize and archive all sales records for future investigations.
For instance, in 2006, postal inspectors and the Los Angeles police raided Insider Video Club, which dealt in "DVDs, VHS tapes, and still images of nude men and boys;" the company's database was then seized. And in October 2010, Toronto police shut down Azov Films, which specialized in this material, and they sent a copy of the sales database to the US.
As part of the Parkhurst investigation, postal inspectors ran his name against these kinds of sales databases—and found hits at both Azov and Insider Video Club. Parkhurst had allegedly ordered Swim Party for $24.95 back in 1997 and Boys in the Mud in 2005 for $45.95. Each video showed nude young boys and contained "no meaningful dialogue or storyline." Each video had been sent directly to Parkhurst's address.
But it was a third "ping" against a sensitive database that appears to have kicked the investigation into urgent mode.
Postal inspectors plugged away on the Parkhurst case all the way through to July 2016, when they realized that Parkhurst had ongoing contact with the boys in the images—he had another trip coming up.
A law enforcement sensitive database revealed that Parkhurst had booked tickets for himself and one of the boys—a senior in high school living near Chicago—to Greece, Italy, and Sweden. The trip would begin on August 3.
On August 1, Postal Inspector O'Sullivan took a search warrant to Federal Judge Youlee Yim You in Portland, had it signed, and assembled her team. They raided Parkhurst's home the next morning, one day before the trip.
According to O'Sullivan, the search team found some of the prohibited images on "one or more" of Parkhurst's digital devices. Parkhurst then agreed to speak to investigators. He allegedly admitted that he had taken the photos, acknowledged masturbating to at least some of them, but denied that he engaged in sexual activity with the boys. Parkhurst also suggested that his collection of nude images would not "qualify as child pornography." (US child pornography law actually includes a clause banning "lascivious exhibition of the genitals or pubic area" as a way to short-circuit any "but I didn't actually touch them!" defense.)
Parkhurst was arrested. According to the Oregonian, he resigned from his job and surrendered his ministerial credentials a few days later. He was eventually transferred to Denver, where he will stand trial. He had his first court appearance there this week.
Creative searching
While the Internet has enabled an explosion in child pornography—an issue that was largely under control in the analog era, thanks to the difficulty and expense of finding, creating, printing, and distributing it—it at least makes investigations simpler, too.
Even though law enforcement has access to expensive or secret databases, many of the Parkhurst investigation leads were based on EXIF data and publicly available Internet pages. Google, Facebook, hotel review and naturist websites, online maps, and image searches—it's all grist for the mill. Once a hotel or cabin has been located, once a person has been ID'd on Facebook, once a trip is suspected, then it's time for the subpoena, the warrant, or the secret database.
Still, with all of the tech, search, and monitoring tools available to authorities today, one of the most useful investigative skills remains the ability to use the public Internet creatively. ..Source.. by Nate Anderson -
No comments:
Post a Comment