The National Center for Missing and Exploited Children (NCMEC) CyberTipline is a centralized reporting system for the online exploitation of children. Facebook/Meta, Google, Instagram, Snapchat, Yahoo, Microsoft, X, etc are required to report suspected CSAM detected on their platforms. These providers make reports of suspected online sex crimes issues and NCMEC reviews each report, and then forwards it to law enforcement for investigation. The report typically includes a description of the images, cryptographic hash values assigned to each file, and the Internet Protocol (IP) address linked to the account in question.

Cases can also occur when computer repair technicians encounter suspected CSAM on a device, or if a family member or peer sees something and informs law enforcement. Additionally, if an allegation of child molestation is made against a suspect, that suspect’s devices may be seized and contraband files discovered.

II. How is the Dark Net involved in These Cases?

In a recent case, the DOJ arrested 18 defendants and dismantled four dark web sites dedicated to images and videos containing CSAM in “Operation Grayskull”.

Bitcoin is the most popular dark web currency. Litecoin comes in second as the most popular currency. Administrators of dark web sites use multiple websites under multiple pseudonyms, employing cryptocurrency mixers, numerous cryptocurrency wallets, and intermediary accounts to move the funds in an attempt to evade detection.

When a dark web site is dismantled, the users are tracked and ultimately arrested along with the administrators.

III. What are Some Ways to Defend These Types of Cases?

Conaway & Strickler, PC always advises seeking digital forensic experts in these types of cases. They can mirror image the devices seized and analyze them. They help decipher some of the more technical aspects of the discovery we receive. Their expertise can pinpoint precise steps the government may have missed in their investigation. They can also determine whether files were intentionally accessed, whether timestamps were manipulated, and whether malware or remote-access software could have created the material without the accused’s knowledge.

We also employ forensic psychologists to do a psychosexual evaluation to help provide mitigation and/or to provide a defense to the charges.

Conaway & Strickler, PC represents clients charged with Child Sex Abuse Material at the state and federal level. For further information, please see here or contact us. We are here to help.

Early on, Conaway & Strickler defended cases that stemmed from activity on classic peer-to-peer applications like Limewire.  These type of networks were simply software applications that provided a central hub for various computers to connect.  Napster, for example, was a peer-to-peer (P2P) file-sharing service that allowed users to share and download music files from other users’ computers.  These types of programs were utilized to distribute music, movies and child pornography.  Law enforcement was able to track those cases more easily.

Today, however, the government has also become well versed in programs like BitTorrent, Limewire and e-Donkey, among others.  When a hard drive or device is analyzed by the government, they now will produce a report detailing their forensic examination.  They will detail all of the evidence found on the device showing evidence of P2P Networking, search history, bookmarks  and they even cite images or image fragments found in cache locations.  Here is a recent example of a federal criminal prosecution of someone who downloaded images from the BitTorrent Network.

The P2P software programs allow the P2P networks to break large files into smaller segments that are then shared independently. The original purpose of this was to only optimize the download process by balancing the load among multiple users but it also increased the overall download speeds, as users can simultaneously download multiple segments from different sources.  BUT, in early prosecutions of federal child pornography cases using P2P applications, the government was unable to show the actual images on the devices anymore.   But, as described above, it is rare for a sophisticated user to have any actual images of CSAM on their devices.  So, today, the government’s forensic report will draws a picture of all activities on the device to show that the user intentionally downloaded child pornography.  We, at Conaway & Strickler, are well versed on the technicalities of defending a complex case like this and have years of experience of defending federal child pornography cases nationwide.  We also have a variety of top notch experts ready to assist us to mirror images these devices in order to do our forensics to mount the proper defense to any federal criminal charges lodged.

Contact us anytime if you have any questions. We are here to help.