9-16-16 National:Let me Google that for you: EXIF data and public Internet used to crack open case.
In 2013, federal agents investigating the child pornography collection of one David S. Engle—who was later sentenced in Washington state to 25 years in prison—came across a new set of eight images. The pictures showed five boys, ranging in age from around seven to 15, urinating outdoors, shaving their pubic hair, and posing naked in bathtubs.
According to an affidavit from Postal Inspector Maureen O'Sullivan, who helped investigate the images, the photo set was "emerging and being widely distributed and traded by child pornography collectors on a national and international scale." Being new and uncatalogued, the images were forwarded to the National Center for Missing and Exploited Children (NCMEC), which maintains a vast database on prohibited images for use in investigations and image blacklists.
While law enforcement generally focuses on finding those who create and/or trade child pornography, a simultaneous effort is made to identify—and if necessary to secure—the victims. At the federal level, this task is centralized within NCMEC at the Child Victim Identification Program (CVIP)—and this new image set wound up at CVIP accordingly. The investigation of the pictures, which took three years to complete, opens a rare window into the world of digital detectives who specialize in tracing some of the world's most horrific imagery.
An Embassy Suites hotel room—but which one?
It turns out that federal agents largely run an investigation the way most of us would: on the public Internet.
CVIP took the obvious first step and pulled all the Exchangeable Image File (EXIF) (inside this link is a wealth of info about photos and the hidden info within them, esp LOCATION info) metadata from the photos. Amazingly, this data had never been scrubbed (even Facebook scrubs EXIF metadata from uploaded photos for security and privacy reasons). Though the images were not tagged with GPS locations, they did have dates attached. This would become a crucial clue. Without names and dates, finding the photos' creator would be difficult. Even if one could identify a particular hotel used in a photo, the huge number of possible dates would make guest check-in registries nearly worthless. But with a date, identifying a particular hotel might solve the case immediately.
