From Facebook, from TikTok, from Instagram and other online platforms, scores of leads land in a secure inbox monitored by the Maine State Police computer crimes unit. Many of them contain images or video of children being sexually abused, the disturbing, illegal keepsakes of child abusers who may live thousands of miles away.
They are the start of a laborious investigative process for a team of about two dozen detectives and analysts who pursue people who trade online in the illegal material. Every day, the tips pour in.
All come from a national nonprofit that last year routed 1.9 million such messages to 61 specialized police units across the United States. In the last two years, the volume of disturbing material they have found has skyrocketed, an increase that coincided with the worldwide coronavirus pandemic. In 2021, Maine’s unit alone fielded 1,236 leads. Sophisticated computer algorithms generate the tips automatically, and they all pass through the National Center for Missing and Exploited Children.
Eliot Cutler Hancock County Jail
One of the tips received last year led police to Eliot Cutler, the twice-defeated gubernatorial candidate. Cutler was charged last Friday with four counts of possession of sexually explicit material of a minor under 12, said Hancock County District Attorney Matt J. Foster.
Cutler has since been released on $50,000 cash bail, and his attorney, Walt McKee, filed a motion that persuaded a judge to seal the arrest affidavit describing the probable cause for the charges. Also sealed at McKee’s request were two separate affidavits connected to the search warrants police executed March 23 on homes Cutler owns in Portland and Brooklin.
Though 2021 set a high-water mark for leads, up from 551 in 2018, the rate of new ones coming in has accelerated. Through Thursday, the unit had received 600 cyber tips and has assigned 413 for investigation. If the deluge continues apace, the unit is on track to handle about 2,300 tips this year, the most it has ever received, risking an inundation investigators cannot control or predict.
“The volume is large enough that we’re doing the best we can,” said acting Lt. Tom Pickering, the unit’s leader. “You can only do so much work in a day, and those guys are working very hard.”
To help keep up with the numbers, starting last year, state police formalized an affiliate program that distributes the computer crimes cases to 20 police agencies statewide, including the Department of Homeland Security Investigations division, encompassing roughly 50 additional investigators. With an authorized strength of only 10 police detectives, nine computer forensic examiners and two intelligence analysts, the state police unit alone would be overwhelmed without the extra help.
“It’s a shoulder-to-shoulder partnership,” Pickering said. “Whatever they need for support from us they would get, but for the most part they would be the lead investigator on that case. So we certainly all work together.”
Already there is a backlog of 95 cases that have not yet been assigned, and 92 others were closed out because they did not actually involve a person in Maine, did not describe a crime or did not contain enough information to proceed. Counting open cases that are older is more difficult, and anecdotally some open cases date to 2020, but state police could not provide a precise number.
“Our goal is to provide enough training, guidance and process assistance to the affiliates so that when they become proficient in these cases, we will be able to reduce our role to more of an oversight and peer-review type relationship,” Pickering said.
While every case handled by the computer crimes unit is unique, examining how the unit performs its work using other examples gives an insight into some of the steps that may have been involved in a case like Cutler’s.
In Cutler’s instance, the investigation began with a single image the national center reported to Maine police. But not every tip the agency receives becomes a case, and some don’t even describe illegal activity. Yet the mountain of work for the police investigating them continues to grow, and every single one must be evaluated by hand.
“We don’t have anything that’s automated for us,” Pickering said. “When the cyber tips come in, each is reviewed by a person. There’s no other way to triage it. I’ve worked in the state police for a long time, it’s very difficult to really grasp what goes into these cases and the amount of time it takes.”
TIME-CONSUMING PROCESS
The first evaluation is performed by a civilian analyst, who helps search the open web to add information to the file or start a subpoena process to get more information.
Some tips contain urgent information and are flagged as a priority. For instance, if a child is believed to be in ongoing danger of abuse, or where there are signs that a perpetrator is actively producing new exploitation material, the case will be bumped to the front.
The analysts often use subscription-based services that help them trace an IP address to a geographic area, or deploy a high-powered people-finder called TLOxp, a service run by TransUnion, one of the nation’s big three credit bureaus, that can find recent phone numbers, addresses, employment information and other facts.
Sometimes analysts will assemble images found online of the person they believe is connected to an online account, a process made easier as millions of people upload images of themselves for profile photos that are visible to anyone with an internet connection, a tactic described in search warrants filed in court.
Whether the number of prosecutions for possession of child exploitation material also has increased statewide is not yet clear. A data request filed Monday with the state court system for conviction statistics was not yet fulfilled on Thursday afternoon.
Under federal law, technology companies such as Facebook, Google and Instagram have a duty to report illegal material that flows through their servers, and many use an automated system to check if an image, file or video matches a known depiction of child sexual abuse. The national center maintains a database of the contraband photos and videos, and helps triage and prioritize the worst of the worst.
Computers do the hard work of examining the millions and millions of files users upload and looking for matches.
In some cases, police can develop probable cause quickly, but no two cases are alike and often require extensive work to bring to trial.
“Sometimes it can be weeks worth of work, or even months at times,” Pickering said. “It certainly is not a simple process.”
A review of public search warrants filed in Cumberland County Unified Court offers a glimpse at what goes into developing a case. Between Jan. 1 and March 30, eight computer crimes unit search warrants were filed publicly by two local detectives affiliated with the unit.
Most of them were for the earliest possible step in the process, where police requested permission from the courts to view the alleged obscene material forwarded by an internet company.
That step has not always been necessary, however, but the federal conviction of a Kentucky man was overturned on appeal last year because local police did not seek or receive a warrant before examining the material forwarded by the National Center for Missing and Exploited Children, and no one at Google, which first discovered the image, personally examined the material to confirm it was illegal.
Since the Supreme Court declined to review that case, no precedent was set. Still, police in Maine took notice and adapted their procedures. Five of the eight search warrants filed so far in Cumberland County sought permission for this preliminary search, and all were granted.
It’s unknown whether police had sought and received a preliminary search warrant to open and examine the single image at the root of Cutler’s case, and Cutler’s attorney did not respond to a question about whether police had taken that step.
RECENT CASE HIGHLIGHTS COMPLEXITY
In November, the computer crimes unit received three cyber tips from the national center that were linked to two accounts on SnapChat and Kik, each messaging apps. The tip showed that the accounts had been accessed from the same internet connection, which was identified by a unique IP address. The tips were received in Maine in November, and two of the tips related to the same conduct, when someone used a SnapChat account to uploaded two sexually explicit images.
In the third cyber tip, someone using the same IP address as the user identified in the first two tips uploaded 152 sexually explicit files to the messaging app Kik.
IP addresses are a string of numbers that tie any connection to the internet with a physical place.
The computer crimes unit opened a case on the tips on Dec. 20, 2021. To link a real person to a digital account, police often begin with the IP addresses supplied by the national center. If the national center’s tip does not already include a geographic area linked to the IP address, analysts in Maine use a subscription service, MaxMind, to trace the origin of the internet connection, sometimes down to the postal code.
The IP-identification services also link the specific internet connection to an internet service provider such as Spectrum or Verizon, who keep records that link every internet connection they provide to a real person or business account responsible for the bill.
To obtain the name on the account of the internet subscription, police obtain a subpoena with the help of a prosecutor, Assistant Attorney General Paul Rucha, who is assigned to work with the computer crimes unit on an ongoing basis. The subpoena directs the ISP to confidentially hand over their customer’s information.
In the case of the three linked cyber tips, Detective Eric Johnson of the Portland Police Department, one of the affiliate investigators, was assigned the case in January, the court records show, about six weeks after work began on the tip.
After reviewing the records assembled by the civilian analysts, Johnson or staff at the computer crimes unit – it’s unclear who – sent a preservation letter to Kik, to instruct its staff not to destroy or overwrite data associated with a particular account or event.
SEARCH WARRANTS FOR MORE INFORMATION
Johnson then wrote two search warrants to seek more information. Both were approved in late February and released publicly in early March.
The first search warrant was directed at Google, and sought user information for two email addresses that were used to register the SnapChat and Kik accounts. One of the email addresses appeared to contain the full name of the user who filed it. SnapChat also gave police the birthday that the user provided at registration, and indicated the user was born in 2005, making the person 17 years old.
In the case of the files sent over SnapChat, Johnson opened one to determine if it was illegal. It depicted a girl under age 5 engaging in a sex act with an adult man. Johnson opened one of the 152 files sent over Kik, and found a short video clip showing a girl around 8 or 9 years old engage in sex acts with an adult man.
The investigators had traced the IP address to a residential street in Portland’s North Deering neighborhood. But it’s still not clear whether the person responsible for uploading the images lives there or was simply visiting, or may have commandeered an internet connection that was not theirs.
It all means that the work in that case will continue. If they are able to link the account to a person, police will have to show that a suspect actually meant to engage with the illegal material, and that it was not someone else who had commandeered a computer or borrowed or stolen the chat app accounts when the illegal files were sent or received.
To do so means determining who lives at an address, interviewing them and sometimes surveilling the property to understand who comes and goes.
Although he spent years as a major crimes detective working murder, rape and child molestation cases, Pickering said was unprepared for exposure to child exploitation material that his job now requires.
“The most impactful thing that drives all of us is a picture of a child,” he said. “It’s not something that you’re ever prepared for at all. Regardless of where the underlying crime happened, whether the child is this country or another one or this state, or another one, they’re a victim.”
Copy the Story LinkComments are not available on this story.
Send questions/comments to the editors.
