DEN,T ,AiGE'NCY
2,01 .. 12111 :8TR,EET IQU'TH., .SUI'TE 1712:
,ARLINGT:ON, 'VlRG'INIA ,22202-5401 ~
(In vestigaticn 'C!I)'.'"
I "··r·~':' :a" :··~auu· '~ .
. .~ _. "," ..,' . _', - .. :' _._ ....,' - ,'t, '[ .... . ~,
DJ7I'Pi 0/·' "···'R,· "T"" .,' O··'·'·D ""'~,S·····~····'Tl·' r, :G",,:A'··T"-I' .IO~"N
~, ,<... U,"",Y C ,:',",,' ->". I,
10' "0"'1:': "0< -I' 1"·,·· ',"···'·X·,· '.~: 'Z·~ .. , ..... " 'MA·'· .. · . ,". 'y .. ~ .. ': )····00··· .. "",'''-6>''O'J ·'D·:···C····· ,- 'W~""':l' IF:' '.c',
... :. . :".' .' .. "., :.,. :- '.'.' "'. ' .. - .. / ,.:' .. ', .. ' .",-_ .. ": : .
. -. ",' \. " • ~. ,'", ,"': .•• ,.~ .. ' ~"':" "," I "[ • ,,:...:_ _.-.' ••... '[ i_ ..... ,,~~,\i " _.,.,.- ',' i" "
J .. H,' ".', ,;, '2'-"4'''- 2>0 ..... '·'·0::-:···8···
anuary :.::-- ,.". , .... "'~'
1-
nelS Headquarters, National Security Program (03NS) Immigration and Customs Enforcement, Cyber Crimes Center
U~S; Attorney's Office, Eastern District of'Yirginia, Alexandria Division (A . O. Smagala)
I~
11(1)
11(. ).
,
. .
iCc :I ·1t·S··'-:·S··· :1')=:10'; A-"TtO'" N'" I!'
:'.'L..fi\, :~ .. :,,:I I.~ ~ ..... _ I.," t:.·.'·' iii
I FeROFFIGIAL HBE ONL¥
I
I
J
I
Ii. I
!
" ,
I,
2""0"'0:"'1' 011' '9' '9~'X< i- ' 2' "9'" MA' : ,", Y' '''0:'Q'''7' 6' a"D"C" 'W" "'~11F' :
>. " .. ,.,.' ~ •... : ,'.,', ,._.:\_ ,::""".,, •. "I.," "., _~, •• """,_,~,~':,;" ". ,[_ ", ".'
J' 2' "4'- 2"'O'~O"o , anuary ~,(,.";J ."1, -. UJ
N' " 'D'1:J.!, ,I.T·'IVE[', ' •
-~,.',' .. ,.·'I
1 In April 2007 , DClS, Arlington Resident Agency received information from Assistantl .. S. Attorney (AUSA) Gerald Smagala, u.s. Attorney's Office (USAO), Eastern. District of Virginia (BOV A)~ AUSA Smagala provided information concerning a national investigation being conducted by ICE. ICE had identified over .5,000 individuals who subscribed to websites that were known to contain child pornography. ICE designated their operation as PROJECT FLICKER.
2 ·8"'" ,..,.. .. !j, nd ',ii, ,,~:"d' •• Clil· '··d'·:·" uifi :'. d"'· 'd:' , ,' .. p'" . ., .. '·····-·1'·: 'F' "'Ii' -:1, .. ' ..•• ' . "'d''- th ... _ 'D'~' "'D:'/::' "', ' .. ,,' " . :,"'~ ".,' '·"'1- . ' ,···,,··,;11
'~ c 'CVel~L"U In .·IVl UAlS 1" ,en.l I.e "". un ... er. lOJ.ec .. CJ\,e:f use . .. ,) . :elr ~" 0 . '" .' ,g 0 vemm en, , .. e-Il1aJ..
addre ' 'F'}'"'' 'P"" t Offi ('F'P"'O'~") ili' v addre or Arm ,'''','' P t 'O", .. ··ftj·,,'·,,: ·,'AP.-·,· .. O"·· ... ·.')·,· milita .... zaddres t-["
[. ".'.',SS,.·. eet ~O,S '.: mee t, ':',J/, mn tary ,'<. ::,,88, or ... " ~ .. ,y .. 0·5.·.·", ' .. C'C \:"""'/ .1Dll~.j aaoress · ,0
,--, t ,~ ... t"'h' 'hi·"'ld' " "".' mh b' ·,··-'t . A"'U"'S""A' 'S"" ala .". " · .. ,t d[' tha t' 'D":C-:~'IS'~'" sist ! th ,,'
regis er ror t .. e c ': ',,~, 'po:mograp ;'Y' we·,"SlCS,·\,.'.-::,·, ',".:ma.:g··.'.a req.uc[s:e ~_ '. ,,>. ,",:. "~I, as,'SIS ~ 10'·e
identification of individuals affiliated with 1beDoD. Initiation of'ajoint project into this matter
· .... [ .. ' d ld h .. -DV" de' 'IC"E' A D 'D 'b:t
was mitiatec to provide snort 'term assistance to E .. > .': A ana .,.::, ::,,:~ ·,·"s,:o'·~, su'~crects· were
identified, information was provided to the DCIS office within the appropriate area of
ibili f .. d ed · C rdi .. d thro gil" th !II t
respo msn 1 tty ',,' or lac" < "t'I' on .',. ee emer 'a·,'p·'· propn a···· re "0· o ,',<", natio . D' was m';:8"':'C': '~. '. 'U~'" "0, ·U"i·t '. ""C' projec
~~ .. "~'" "' , .;.~ '&~. " ",' _ .. 1 ••• ,",-', ,.'_'.~ •• ,~ •• ' _ ' •• :_.J' ',-["][', ,',!ftJ .':': .',., ~~.,_~ I- •. ~.~:~ •• , •• _ ,:, .__!l" , ,_, ••. ,'L'"."_,. ',',.., "'~ ,.,,_/
. ,._. [' J'J - ' •• ' [._
.. ' .,·!th' ~ th 'e'" 'ap.,~:, ere 'p' riat M"-':' ilitary I': ., C" imlnal ' I" ',' stig 'l'-'ti'll .: ' '0"" "'\r' gam izati '''''DS''''
WI, " ,.,.',: ,'. P4' ~ .. """ -c .,'/, '. '" .,·n" ,:.,':, " .. nve:l~ll, .'_,: ve,~: ",:',.;~ .. 0'.
-
3 0, ,'··,b, ..... in ed 8<" "CO' ',' 'm'''' 'po slete l 1!Ii! I:! t', iden ,': tifvin .g,'" ali: I :1,' U, ',S;~' b '8,', sed s ':u··· .: ibieets fro::', om the
, ·,LaI ." . " .. ' ' .··IAW· '.' a,:,·" "', ,. . ,.I.....I.,I· , .. ,:. e". , , "~ J'P" .. , ," .. ill! I
ICE Cy · . .. me Center. The list contained the name, e .. mailaddress, telephone number, and
postal address of each subject 'Queries of subjects were conducted through Antotrack, the Joint Personnel Ac:ljudication System, the Defense Central Index of Investigations, and the DoD Employee Interactive Data System to obtain additional identifyin'g information and establish a DoD nexus. In total, 20 states and D.,C·~ were vetted,
4 A':··s;"·, a resul t 0"" "f': the ,;I .. ~~L.t'\II[~C"" qu eries, 2~"64'-'-':'" 1-0" [d'" ivid ual 'S: affiliated with Do·::D·:·· were identified
. . ... ' ,'-''iI. ~'<.', i ua~,', "I!Iw' ", ".:. - ' .' '.",[ "..,,~, ,Q.~ <. .'. .' ,."., '. ,- ... '..... . .'"
.'r.. ""[,1' ':'" d' ;I., 3~'9'" .• , : d ','!It' ··:"'d" ual . :W1' ,.--··thi·~~ ~ ,',,-'" t 'h"'" Eastern D'· ,,...:·,t'· of ·V~' ".,:.Ifj .. "~" '0' "f~·th,·,"', ',",.,',' '. id ,',,' "t"·fj' ed '9"·'
Inc .urnS ,:,,·10, lVl",. ,S' .,- .. ,n ... ' e ,'QDwnl :.lSU1C 0"",": Ir81m·a~: .. _, Dse 1.·, .en".11 ~::, ... '
ind ividuals possessed ~a Top Secret Sen . sitive Compartmented 'I' nform at ion security' clearance 13
,<11.,.".,' ",~'UW ",""".~'\'",. '_ ',.,. ,". '.',."',."' .. <'.:'."' ..... _'." '.' .", .. ,".".' '~,.' "",:,~, ." '0",', - ,".', ,""'" '", ",. """",~,', ;-', '."">:', ...•
, . 'sed' .' T .... '. 'S' ,"," '.- t ", .',' '",t·· .- :1-, ',' '. " .', 8""""'" ,,,., .. ' " "do" .', 'N"··,[ 'A-'" T' '0" ·S··, " " et ',. ", .. " " i:ty, . 'I' , .' .' ... .A2-·:
posses" -: a .J op 'ecre,' seC:~l,y CLearanee~, possesse,::, a·':·,..· ,.·eer,.' :'. secur.l :-, cearance', ~, .
possessed 8' Secre 't'''·, secun ,"t"y" clear ranee an" 'd' 4' posses se 'd' an' interi im Secret se cun .,.,ty' -,,', clear ance
",·,~".i:L·,,<:~· .", >"~' 'I,.:.' :,: ",: ': ',' .,.':." :': , '::, ,~' ", ': :~. ':~ :y> :" ',: :, : ,:" i.l~.." :" ,::' """ ".', '.~ '; .......... ,'.~ •
. " [' : .
5 Th ubi iii c.: rmati' "n:",l D'" D'" '1 di lid d b 1 ti d
~ '. _. 'e s"~ect 'lnlO:' .. :' ,~~:' .on cottWunl.ng ,'0 ',: query resu ts were~:';"lVl,: e .. ;y ,Dca' on an,'·,,,
,4;. ·'-d"""'d' t[', " ·th,:,',···,··, .. ,' .-.' + l'P'C"~E' ,·"',d·:', :D\C""'.'I·S::-' "'_'''''ffi'-': ., .. ~: .'. [,····ti··"·o ..
(onvar <e·:~o :.' e ~pp,mpna.Le:.; '. an,. '>." <'<~. 0: ce Lor ac ·on~,
6. To date, 31 spin-off cases have been initiated and 52 subjects have been titled:
20070'1 274·Z -
J" 20'" '0'.·7:'·0'.', '}·2,'··7: 7····C···, ~'
.' '. .: :.~' -. ~ _. ~ . . ",
• 200701301F- Sweeney); I>aniel Joseph
• 200'701 340S _.
I 200701341 T - Campbell, Cameron MOrr1sOJ1
• 20070 1,40.2'H ,_ I{[artes, 'Thomas Edward
2,007'014031 _,
A-")'
. 1
b(B) b(7)(C)
CLASS'IFICATlON'
J. ,. .. '2':'4'- '2"0' ···'0····'8··' anuary , .... , ... , .... ,~,,>/,
•. : 20'······O'·'··7:'·O~_-'JI4/,·6···'·'3'::Q·':· - Jones Paul Bum 1:·:--:]'1
' ,: '. / ' .', .... '. " ,'. / .. .i ".' .' .. " . Jj' , '. .,";":, ", I .• ,." .~ J ,'. ", . . '.' '" "
•"'. 20"""O':"'7~·,·'-'O""""l' c IIR'
, .'._.[\ _. "VI':' , ~.:' _l ......
2' '0: "'0"7:' . ·'0··'····· '15:'· I' '2'S"
• "'/<'" ,.-_", ,/,: -
.• -.... 200"·'·····.- 7:0"'1" 5·_-·'·1·· 6--·"W"'·
,,',.', .. '. I" ,',,' ..._.
I ~ ," . ......' . I, . _ • ... _ ' . _ . ._' _"
,. 2,QO'701,S·17X _, .1 2,~'"-'O'" ·0:'··,7',·_-··0:'·, 1 S·,~"S···'····'·J\H·'- ,_,
I ... '_. ~: ", r, " "" ': ., I, . ~ . ~ ",.".. . " ,:' .. ,
•' '2"'·OO""'·.7·'/.O~'·1- S·:':'S:S···::'M· -_-'.-.,,' - 'Op' '"Qf .. u4-;'O·· m 'F·'·~l-"l~'~k·'·"·r·'
, . , ,_ .. ',,: <_. _. '--," I . I ...... '/, ~'.:, '," :,' '. '_".' .' ~·...:W"~ '.'~ .. ' ... ,_ ,", .... , ·w. i •. ~'j.;
• 200701,567V' - Operation Flicker
• 200701S7IZ -Fitzpatrick, 'Leland Chace .1 ,2100701,5'96 Y _,
- 200701606N - Operation Flicker ',2,007'0 1619,A - •. 2007016208 [_1 Mullen, Shawn B~. • ,2007·016·2,3'~E. -, Lindimore .. ,S,haile, Brewster
.f#'
[20,070 165:31,I ,_
• 20,070'] 6,65'U ,_
- 200701661W - Operation Flicker-50ES Targets
_. 200701690T ,_
•. _I 2'00'701691 U '_, ~. 200701692V' ,_, .1 200701'7'5:6'M:,~,
• 200701 765V - Project Flicker .. SDOB (Western DiVisiott)-WDICY-EDKY
• 200800031.0 - Demoulin, Stanley P.
• 200800080D - Operation. Flicker
'l, Six Information oL.·""'~ ....... ;b;
200' .: " .. ~ "8"0""" ·0·····'···]·- 5:: 9'··· J-'
" ", •• ~ •••• ~-: ••• ,. :', [ J •• ~.:~~" •• _. _,
2', .' 0"" :0".-,"'7' '"0'':''' '1 '5" ". '3: 9"'~"'T-- :",
....... ..:". '. '~:", .... ~. :. ~-'
", " ..•.. ~." .. \. : ..: ~ ".' . "', J. ", ... t.. . /' _ ~
9. Due to the short term nature of this project and the need 10 focus more resources on other
'D···C···'····"I,"S':- . it' '''.' C'" S"ti-'·~·,DQ-.·l·V~- '.::II p' __ "n""o' rities thi !liD P'" 'r"a~'ie""'f'Yt' I"~" ""10'--...1 g~ "tc .... ,~SL.o4;; . ...I" A..-·· .. l'l·· C'·brdAS· g' 'dinara' '-'00"·"-' fr:····" o""m' i thl "~ .
. ,.), '. IDV, , ";I:~i"~L, v ~ ,.:_' :,<,~' u_'·:'·" '-',:, '0 ' c'~W:,~ •. ·'al ~.:,5£7Ll :~, 11I1l:: IlCU.~ ,',' .! ,',~":>U&I~.,', ,;' , , .: ,~_' ':, ,,:. ,iI·
iii' , ·11 b ,ft__" - I''''
project WI·, .. "C pursued "to cone. usion.
.11(1)
b(7)(j' C)
.. ' '. !. " " ",",
. ~). ,
_'_ '. " • H. " .. "",, .
C~I ASS' 'IF--I'C"A' "11';0'1.1
,LJ"\',; . .' _' >:. L!,' .:1';
" - F8~R~'B'FPIBlAL:, H,IEGNLi,¥ I:IcW ENFeASEIIE'NJ liNII~'IJI&-
Ny. ~?EV 0/:S+«:AVn..V&VY~<0~<, qLWS'" .. "'J
• _ • • _. .> .. ".... 10... ....
,I
U.S. DEPARTMENT OF DEFENSE OFFrCE,'~F INSPECTOR GENERAl, DEFENSE CRiMINAL INVESTIGATIVE SER,V1C.E Mid-Atlantic field Office- Arlington Resident Agency 201 12th Street South, Suite 712
Arlington, Virginia 22202~5408
(Investigations )
200701239Q .. 07-JUN-2007-60DC-Wl/R (IR)
J nne 6~, 2007
S'SN:_
INFORMATION RE,PORT/REFERRED: On May 29, 2007, the Defense Criminal Investigative 'Service (DeIS), Mid-Atlantic Field Office (MAFO), initiated a project based an information provided by Assistant United States Attorney (AUSA) Gerald Smagala, United States Attorney's Office (USAO), EasternDistrict of Virginia; Alexandria Division (DeIS Case Control Number 200701199X). AUSA Smagala advised that the Imruigration and Customs Enforcement (ICE) is conducting a national investigation that has identified over 5,000 individuals who subscribed to predicated child pornography websites.
Among the 5,000' names ICE identified under 'Operation Flicker, several individuals used their .mil e-mail address; Fleet Post Office (FPO), or Army Post Office (APO) military zip codes. AUSA Smagala requested that the DelS assist in identifying any additional Department of Defense (000) affiliated individuals and provide any investigative assistance. Additional background information 011 Operation Flicker is included as Attachment 1.
of special interest because, according to DEIPS,
The RA spoke with ICE Special Agent (SA)
briefed her on efforts on Operation
DelS can can be reached by '"~''''WllVl'''''
.or
in Tampa, Florida and welcomed any assistance _, extension
Given the uature of the allegations, the pCi~ential for possibjlity ofharm tQ the children, and the subject's. location in the Tampaarea, the MAFOjs referring this ease to the DeIS, Tampa Bay Resident Agency, for review and any action deemed appropriate.
b(6} b(7}{C)
CLAS'SlHCAHON:
OPHeIM: USE OHLY
20070 1239Q-07-JUN-2007-600C- WlIR ([R)
The investigative databases containedin National Crime Information Center (NCle), Defense Clearance and Investigations Index (DeII), Treasury Enforcement Communications System (TEes) were queried for relevant information concerning the subject. No criminal information was found in NCrC Of TEGS. However, there is a record within DClL The Dell results are included as Attachment 3.
Attac lunents·:.
1. Project Fliekcr Summary
2. DEIDSiJP AS Results
3. DeI! Results
Prepared by Special Agent rHSTR: 03N
Mid-Atlantic Field Office APPR:_ . SAC DC •• _)
2
b(8) b(7XC)
CLASSIFICATION:
efFICfAL USE ON&¥
I
INSPECTOR GENERAL DEPARTMF:NT OF DEFENSE DEFENSE CRIM.INAL LNVESTJGA TIVE SERVICE TAMPA RESIDENT AGENCY
400 North Tampa Street, Suite 1130
Tampa, Florida 33602-4707
(lnvesrl gations)
200701277C-15~JUN~2007-20TB-.wlru
June 5j 2008
'-
nl:sTRIBUTION:
National Security program Manager Southeast FieldOffice
Mid--Atlantic Field Office
Immigration and Customs Enforcement-Tampa
b(6} b(7}{C)
C~SS:IF.IC:ATION·:'
feR 8FFlelWL tJ9E eMU"
I
20()t701277C-15-JUN-2007.,20TB·WlIU
NARRATIVE:
1. On June 7, 2007, the Reporting Agent eRA) received an Information Report (JR») Case Control Number (CeN) 200701239Q, from the Defense Criminal Investigative Service (DeIS). Mid-Atlantic Field Office (MAFO). The IR advised that on May 29" 2007, ncrs MAFO initiated a project titled Operation Flicker (CeN 200701199X), based on information provided by Assistant U.S. Attorney CAUSA) Gerald Smagala, Eastern District of V irgini a, Alexandria Division, AUSA Srnagala advised that the Immigration and Customs Enforcement (lCE) was conducting a national Investigation that identified over 5,000 individuals who subscribed to predicated child pornography websites,
2. Among the 5,000 names, ICE identified several individuals who used their .mil email. address and/or their Fleet Post Office or Army Post Office military zip code. AUSA Srna gala requested that DCIS assist in identifying any additional Department of Defense (D@D) affiliated individuals and provide investigative assistance.
3. The DClS MAFO utilized information contained within the, DoD Employee Interactive
Data System (DElOS) and the Joint Personnel Adjudication S . in order to identify DoD
affiliated individuals. those Identified was a Retired U.S .
. Captain (0-6),
4. The DCIS MAFO spoke-with ICE Special Agent ( briefed her on the DCIS joint efforts with Operation Flicker. to exploitation cases, requested investigative, assistance from
Tampa, PL, and , who Was. assigned
5. On June 18, 2007, the RA telephonically contacted to offer nClS
assistance with the investigation. During the conversation, clarified information
previously received from the IR and subsequently was ' in case initiation._
did not use a .mil e-mail addressand/or a Fleet Post Office or Army Post Office
while sub SCrib_.:iiiIiIIII __ bsite s,
6. On September 19,2007 the RA conducted a DEIDS check to verify _ was still
residing at The DElDS check revealed on st
27,2007
7. On September 27, 2007, the RA coordinated with
Investigative Service (NelS), Resident Y
execution of a search warrant
•
b(S) b(.7}{C)
A-l
CLASSIFICATION:
FeR e.F,Fl8hfcl: liSE SNb¥
I
200701277C~ 15~JUN~2007-20TB-Wl -u
June 5,2008
... ' ..
Office and the local Japanese _residenQe.
_ agreed to coordinate with the ICE, Attache )pT'."'n'n~f··l'ltin order to obtain a search warrant for
8. On October 15, 2007, the NelS executed a search warrant on
located in During the execution of the search n""',.,.~,n
ave th computer .' to access the Internet to
tty Tower Computer Millennia, serial number 2422181-0001; was residence.
10. On January 14,2008, provided the RA a copy of two computer forensic
exams, The first ferensic exam was laptop computer, which was seized
during the execution of the search, located in, Japan. The second
forensic exam was performed computer which was seized during
the execution of the search warrant on residence in _II The
examination ofboth computers did not re m ' of any child pornographic image
files. or movie files, However, the examination ofthe desktop computer indicated that a user of the computer had regularly used one or more privacy appfioations which wiped most of the history of Intemet websites visited and any incriminating files that may have been viewed. Despite using the privacy applications, the examination did find traces that a USer had accessed questionable Internet sites that appeared to be child pornographic in nature.
11. Due 10 the fact that no child pornographic images were found on the computers, this' investigation is closed with the submission of this report. There were no fraud vulnerabilities identified during thecourse of this investigation.
A-2
b(6} b(7}{C).
CLASSIFICATION:
This docume , of the, Department 'of 0 r enerat and Is on
loan to your agency. Contents m '. to any Party under Investigation nor
may this nocurne . outside the recervrn the specific prror
: ,. 0 ,~he DE.!p.uty Jnsl1e.ct~r t;'if;lneralfor Invo:stigaMlls. -
""51'1111.
FOR 9PFIGIA .. 1.t&E' QNIJ'I
200701277C-15-JUN~2007~20TH~Wl/l)
June 5 :2:008
.IDENTITY OF .sUBJE.CT:'
IDENTIFYING DATA
Employment/Occupation Telephone Number Drivers License Number Education
Name Alias.
Social Security Number Date/Place of Birth Rape
Sex
Height
Wdght
Hair
Eyes
Residence
Preparedby_.
•
B-1
APPR_
b(6} b(7){C)
. CLIlSSIFICATION:
I
DEPARTMENT OF DE.FENSE OFFICE OF INSPECTOR GENERAL .OEFEN·SE CRIMINAL INVI;STIGATIVE SERVICE ARLINGTON RESIDENT AGENCY' 201 12t1i STREET SOUTH., SUITE 712 ARLINGTON, VIRGINIA 22202.5408
( Investigations)
REPORT OF INVESTIGATION
20.070 1340S-26.,JUN., 2007 -60DC- W lID
February .27 ~ 2008
DISTRIBUTION:
DelS Headquarters, National Security Program (03NS) Immigration and Customs Enforcement, SAC Washington, D~C. U.S. Army Criminal Investigation Command 9020d Military
b(8} D(7){C)
CLAS$IF1CATION:
. FOR OFFISIAL USE ONl::¥ LAW E.NFORGEMENl' 'SENSll~
200701 340S-26-JUN-2007-fiiODC-Wl!D
February 2:7,2008
NARRATIVE: .
1. This case was initiated. based on information derived from DCIS Project: Operation
Flicker (Case Control Number 20070 1199X). As background, ICE initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection." The investigation revealed "Home Collection" was operating numerous commercial child pornography websites, In addition, the organization utilized various Payl'al accounts to process the payments for access to the member restricted websites,
2. This. criminal organization utilized a specific and identifiable payment website known as
"i West," The information developed during thecourse of the investigation identified thatjhe organization (1) used various Payl'al accounts to facilitate the customer payments; (2) used specific subject identifiers within the PayPal accounts to identity purchases into the various member restricted websites; and (3) used specificadministrative e-mail accounts that were used to distribute access to the member restricted websites,
3. utilized information contained within the 000 Employee
Interactive Joint Personnel Adjudication Systems (JPAS) to identify DoD
personnel and contract employees who joined the member restricted sites. Among those
identified Lieutenant Colonel (0-5), with the U.S. Army Reserve.
(VSAR). was on active duty, A query of JPAS revealed he wag. a.
_:.
4, On June 27,2007, agents from the nelS, ICE, and the Fairfax County Police Department
iIIIIii_arCh warrant on _s residence located
5. Concurrent to the execution of the search ICE and.
FCPD, attempted to interview ption to
commerc . . pornography websites, However, invoked his right to legal counsel
and the interview was term..i~ left his ... . during the execution of the search
warrant. Media 'seized fro~ residence was sent to the Defense Computer Forensics Laboratory (nCFL) for analysis.
7.. The DCFL's analysis of_ media did not recover anychild pornography images
(Exhibit 1). However, the DCFL recovered 25 documents and one movie that was classified
A-l
b(5} b(1){C)
CLASSIFICATION:
. FOR OFFICIAL USE 8NL'{ LA\."ENFORCEMENT SENSITIV£
I
20.070 13405- 26~JUN -2007 -'60DC - WIlD
February 27 ~ 2008
secret. The classified documents were recovered from compact discs that were seized from _ residence,
8. On September 17? 2007, two additional search warrants were obtained; a warrant for
_ work computer and a warrant for_ personal email.
9, A review of_. personal email did not recover any evidence related to the receipt of
child .... . Before theanalysis of_ computer could be performed, AUSA
. . declined to criminally prosecute _ for violations relatingto possession
or receipt. child pornography, due to insufficient evidence.
10. The matter relating-to the mishandling of classified information will be referred to the
US AClDC for aetion(s.~ deemed: necessary. No fraud vulnerabilities were identified . .oelS will take no further criminal, civil, or administrative actions on this matter. No fraud vulnerabilities were identified. This case is dosed as "declined,"
A-2
b(S} b(7){C)
CLASSIFICATION:
FOR OFFl61AL l:ISE ONLY· LNII E.NF9.R6EMENT SENSITI-JE .
I
200701340S~26-JUN~2007~60DC~Wl/TIJ
February 27,20.0'8
,IDENTITY OF 'SUBJECTS:
Name Alias,
Social Security Number Date/PIace of Birth
Race
Sex
Height
Weight
Hair
Eyes
Residence Employment/Oceupation Telephone Number nriver's License Number
and Issuing State Education
feR 9rf;161AL USE ONLY LNlJ ENfORGEMENT SENSllllti .'
b(S} b(7){C)
CLASSIFICATIQN:.
I
200701340S-26-JUN-2007-60DC- WllD
February 27.2008
EXHIBIT.:
1 , ncn, nig:ital F orensic Analysis Report
Prepared by Special, Agent
APPR:_
Arlington Resident Agency
C-l
b(B) b(7}{C)
CLASSIFICATION:
FOR: OFFISIAL \:lSI! QNbY LAW ENFORCEMENT '5&NiR'IUE
I
DEPARTMENT OF DEFENSE OFFICE OF INSPECTOR GENERAL DEFENSE CRIMINAL INVESTIGATIVE. SERVlCE ARLINGiON RES1DENT AGENCY
201 12\!1 STREET SOUTfH, SUIT,E 71.2. ARLINGTON .• VIRGINIA 22202.-5408
200701402H-09-JUL-2007-60DC- WlIF
February 25,2008
(Investigations)
REPORT OF INVESTIGATION
KARTES; THOMAS EDWARD
DISTRIBUTION:
nels Headquarters, National Security Program (03NS)
Immigration and Customs Enforcement, SAC Washington, D.C. __
b(6} b(7}{C)
FOR ernslAL ld8E ONLy lM! ENFQRCEMIiN:r iiN~I:rllJl!
CLASSIFICATION:
I
20070 1402H-09-JUL-2007 -60DC- WI/F
February 25, 2008
NARRATIVE:
1. This case was initiated based on information derived from nelS Project: Uper:ation
Flicker (Case Control Number 2'0070 I I 99X). As background, ICE initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection." The investigation revealed "Home Collection" was operating numerous comrrrercial ehild pornography websites, In addition, the organization utilized various PayPaL accounts to process the payments fer access to the member restricted websites.
2. This criminal organization utilized a specific and identifiable payment website known as
"iWest." The information developed during the course of the investigation identified that the organization (1) used various PayPal accounts to facilitate thecustomer payments; (2) used specific subject identifiers within the PayPal accounts to identify purchases into' the various member restricted websites; and (3) used specific administrative e-mail accounts that were. used,
to-distribute access to the member restricted websltes, .
.-
Interactive Data System ,) and the Joint Personnel Adjudication Systems (JPAS) to
identify DoD employees who subscribed to. the websites, Among those identified was Thomas Edward Kartes, Major (O-4), with the U.S. Army A query of JPAS revealed Kartes wason active,
_ .. -
utilized information contained within the DoD Employee
4. On July .11,,2007, agents from the DCIS, ICE, and the Fairfax:
executed a search warranten Kartes's residence Iocated
5, Concurrent to the execution of the search warrant, ICE and FGPD
_ conducted a non-custodial interview of Kartes regarding his
subscription to commercial child pornography websites, Kartes admitted to the subscribing to commercial child pornography sites and possessing child pornography images on his computers. Based on his admissions, Kartes was arrested and charged. with violation of Title 18, U.S. Code, Section 2252A, attempted receipt of child pornography,
6. On August 29, 2007, Kartes pled guilty to a single count of attempted receipt of child
pornography, a violation of Title 18, U.S, Code, Section 2252A.
7. On December 19,2007, Kartes was sentenced to 60 months, incarceration, 120 months
supervisedrelease, $3,000 fine and a $100 special assessment, for the, attempted receipt of child pornography, a violation of Title 18, U.S. Code" Section 2252A.
8. No fraud vulnerabilities were discovered during the course of this investigation. nelS
will take no further criminal, civil, OT admialsrrative 'actions on this matter. This case is closed as "finished."
A-l
b(6} b(7)(C)
CUISSIFICATION
reR8rFlCIAll::lSE ONLY' 'LNN ENFOR6EMEN'f 'SEN'SITIJ.fE
I
" t
20070 1402H-09-JUL.:2007-60DC-W L1F
February 2S,:WOS,
,IDENTITY OF'SUBJECTS:
Name Alias
Social Security Number Date/l'laee of Birth
Race
Sex
Height
Weight
Hair
Eyes
Residence Employraent/Occupation Telephone Number Driver's License Number
and Issuing State Education
Kartes, Thomas Edward None
-
Prepared by Special Agent
Arlington Resident Agency APPR: _
13-1
b(6). b{7){C)
'FeR OFFl6tAL weE ONLY LN.V ,ENFORSEMENT SENSI'fIVE
CLASSIFIC:ATION:
I
200701511R:-24~ruL-2007-10PB-ze/Z
INSPECTOR GENERAL DEPARTMENT OF DEFENSE
DEFENSE CRIMINAL INVESTIGATIV.E SERVICE PITTSBURGH RESIDENT AGENCY
1000 LIBERTY AVE, STE 1310 PITTSBURGH, PA 15222-4004
(In v cstiga rio DS)
REP8RT OF INVESTIGATiON
20070151 1 R-24-JUL- 2007 ~ 1 OPB- ZO/Z
DISTRIBUTION:
nels HQ - 03S0 Northeast Field Office DClS~ lOPB
ICE - Pittsburgh
CLASSIF1CA Tl0N:
feR: 8FFl6hfd: Y6E9NL,¥
April 8~ 2010
b(6) b(7){C)
20(}70 1511 R -24-JUL~007 -l'OPB-ZO/Z NARRATIVE
1. On July 11,2,007, the Reporting Agent received a lead referral from Special Agent. Del'S Mid-Atlantic Field Office, regarding the Immigration and Customs Enforcement (ICE) initiated Operation Flicker, Operation Flicker is a nationwide
investigation that has identified over 5,000 individuals who have subscribed to predicated child pornography websites, A listing was provided detailing individuals residing in the Western District of Pennsylvania who are employed by the Department of Defense and/or u.s. Military and have subscribed to websites that contain child pornographic images or other material that exploit children via the internet.
2. Among the 5,000 names ICE identified, several individuals used their .mil e-mail
address". Fleet Post Office or Army Post Office military zip codes. DoD databases were queried, ,!O id~ntif~ individuals that ma,Y b~session of ch.ild pomogtaph~c ma~erial.
One subjectidentified was 1S currently enlisted m the
Marine Corps Reserve as a Corporal (Pay rating/grade E-4, Enlisted). Unit ,'11 ,pnT"Hf1
data was not available. Also to DElOS and REDI') databases',
3. ~ coordinated with ~._, Supervisor, ICE Pittsburgh, and '~ed that he would assign an ICE agent to the case and agreed to work jointly with DClS. Based upon previously established protocols, ICE will be the lead .investigative agency f0T this matter and will prepare the Report ofInvestigation, Based on the agreement, the Reporting Agent initiated the case on July 24, 2007 (Exhibit 1).
4. On August 9, 2007, Reporting Agent received photo 1D and. driver's license information o~.
5. On January 14;.200 files and records provided on
, requested and later received military personnel Reporting Agent reviewed military personnel files was unable to determine'_ global location, let ocation during the time period when he purchased access to the. pornography websites, Additionally, records did not indicate that a laptop computer and/or cell phone was issued to_:
6. From discussion with Special Agent_, NelS along with personal experience. as a Naval Officer" Reporting Agent is aware that multiple computers and cell phones are, accessible by enlisted personnel whether onboard a ship or shore installation. Further discussion with _ former Computer Crimes Coordinator and former RAC, led to the decision to dose the case. Case closure was based upon the lack QJ any concrete evidence and the lack of probable cause that_ may have downloaded photos and to which, if any, computer was utilized for such purpose, Further, the location of such computer and establishing that_ alone used such computer was unlikely to be determined, Finally, due to the fact that this type of case is not a DCIS priority, case
b(8} b(7}{C)
200701511R-2f'1.-JUL-4007-,lOPB,.ZOfZ
closure is the best use of current resourcesand best course of action for the DCIS Pittsburgh RA.
7. Based upon the above, it is recommended that matter be closed.
CLASS1FlcATION:
FOR OFFICIAL US, ON.LV
I
2007015 I 1 R -24-JUL-2007 -1 GPB-ZO/Z IDENTITY OF SUBJECTS
Name:
Alias;
Socia:l Security Number; Date/Place of Birth:
Ra:c€~ Sex:
Height Weight:
Hair:
Eyes:
Residence:
Emplcyment/Occupatlon:
Telephone No:
Drivers, License Numbcs'State:
Edaeation:
IDENTIFYING DATA
b(8} tl(7){C)
CLArSSIFICAT10N:
FeR .8'FFlBIAk Y6E BNkV,
I
20070.1511R-24-JUL-2007-10PB-ZO/Z ExHIBJ'fS
1. DClS Form 1; Case lnitiation, July 24, 2007
2. DCrS Letter to HQ USMC, Personnel Management Division, January 14, 2008
3. nCIS Form I; Receipt of_ Personnel File, January 18, 2008
b(8} b(7}fC)
.c LASSI FICA 1ION~
FaR erFIGIAIa W&EgN~
I
;J007()1512S-24~JUL-2007 -1 OSY-WlIF
09-MA Y -2'008
INSPECTOR GENERAL DEPARTMENT OF DEFENSE
DEFENSE CRIMINAL INVESTIGAT'IVE SERVICE SYRACUSE 'POST OF DUTY
441 s. SAUNA ST,STE 602 SYRACUSE', NY 132'02-2400
(Investigations)
REPORTOF INVESTIGATION
DISTRIBUTION
Headquarters, Investigative Operations Directorate Northeast Field Office
Pittsburgh Resident Agency
b(8} b(7){C)
CLASSIFICATION;
I
20070 1512S-24-JUL-2007 -1 08 Y - zo
May 9, 2008
NARRATIVE
1. On July 11, 2007, the reporting agent received a lead referral from Special Agent • . DCrs. Mid-Atlantic Field Office regarding the Immigration and Customs rrrorcernent . (rCE) initiated Operation Flicker, Operation. Flicker is a nationwide investigation that has 'identified over 5,000 individuals that have subscribed to predicated
child pornography websites. • sent a list of indi viduals in New York
State that are employed by the Department Defense/U .S., Military, that have subscribed to websites that contain child pornographic images or other material that exploit children via the internet.
2. 'On May 17, 2007, • regarding Operation information:
attended a briefing at ICE, Fairfax, Virginia briefing included the following background
3. In April 2006, the ICE/Cyber Crimes Center/Child Exploitation Section (ICE/C3!CES) initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection.'; The investigation has revealed that the same organization is operating numerous commercial child pornography websites, to. addition, the organization utilizes various Pay Pal accounts to process the payments for. access to the member restricted areas of these websites. The investigation is being workedjointly with ICE/C3/CES, ICE/RAC/Binningham, the U.S. Postal Inspection Service, the U.S. Department of Justice/Child Exploitation and Obscenity Section, and the USAO for the Northern District of Alabama. ICE has designated this operation as PROJECT FLICKER,
4. ICE/C3JCES has conducted over 60 undercover transactions at the advertising websites associated with this investigation, The investigation has identified that a specific criminal organization is operating approximately 18 different commercial child pornography advertising websites which provide access to approximately 1 8 child pornography member restricted websites, This criminal organization has utilized a specific and identifiable payment website known as "iWest." The information developed during the course of the investigation has identified that the organization (1) uses various Pay Pal accounts to facilitate the. customer payments; (2) uses specific subject identifiers within the Pay Pal accounts to i~entify purchases into the various member restricted websites; and (3) uses specific administrative e-mail accounts that are used to distribute access to the member restricted websites,
5. Among the 5,000 names ICE identified under Project Flicker, several individuals used their .mil e-mail address, Fleet Post Office (FrO), or Army Post Office (APO) military
zip codes. advised the U.S. Attorney's Office and ICE that the DC IS
will assist in any additional Department of Defense (DoD) affiliated
individuals and provide any investigative assistance.
A~2
b(6) b(.7}{C)
CLASSIFICATION:
._1!!:M8
ui\1ent is the pJ;.qpe,t·y.of the Depal:t.rnent of DefEnse 'In.
General an ~. to your "gE_nCy, Con t, e o.iscloseq t
any patti. una",·J; inv'i''?tlga ... J.? dq(;ume.ht. h.e Oi·st.rihuted
·out:s:ide t.h . ager.<fy w:itJwut t: . .. .rior authorization O
t _ _ss~·stant Inspector General for I.l1ve'stigat,ions.
6J!'PI€11ltl5 eBB 9NY
I
200701 5 I2S-24-JUL-2007-t OSY -zo
May 9, 20.08
6. conducted queried DoD databases to identify individuals that may be in d pornographic material or access, 'and has forwarded the results of his
resnective neTS office for consideration for possible DCIS case initiations. attached a spreadsheet for subjects of Operation Flicker in the state of
ew a DoD affiliation. One subject identified on the spreadsheet includes
an individual identified as is a retired U.S. Army, Army
National Guard Staff Sergeant (E-6).
7.
8.
10. Upon review 0 f the spreadsheet sent by _, the reporting agent determined that ~ made four payments utilizing PayPal to the restricted access wehsites, The payments were for $79.95 each, and occurred on the following dates: November 7,,2006, November 21,2007 (2 transactions), and December 16" 2006., The "trans.Item Title" was either- listed as an invoice number or for "TV~2 collection Xl Days access," (Agent Note: this is the subject line identifier which indicates which member restricted site a specific customer purchased, In the Project Flicker Overview report, it stated that in November 2006, the criminal organization dropped the subject line identifiers, and began using Invoice numbers, The ICE agent stated that the Pay Pal accounts still identify the specific member restricted sites an individual purchased).
A~3
9. The reporting agent contacted Special Agent ~_ ICE Alexandria Bay, NY regarding Operation Flicker, _ subsequently forwarded the reporting ageat a spreadsheet that identifies all New York subjects of Operation Flicker, and pertinent information regarding subscriber information related to the child exploitation websites, _ advised that he would be reviewing the list of subjects for possible investigation. The reporting agent advised that the DCIS wouJd review the list) and initiate an investigation of DoD related personnel in the Syracuse Post of Duty area of responsibility. _ advised that another' ICE agent would be assigned to specific investigation, but he would assist in the computer forensicspart of the cases.
b(6} b(7}{C)
CLASSIFICATION :'
I
2007015128~24-JUL-.2007-1 OSY -ZQ
11. This investigation was anticipated to be conducted jointly with Immigration and Customs Enforcement, Massena, NY. As lCE was determined to be the lead agency, and the fact that there was only a loose ,affi'Iiation between the subject and the DoD, this investigatinn was deferred to ICE Massena for any action they deemed appropriate.
12. This investigation is closed.
A-4
CLASSIFICATION:
clliscL0sed t
I
IDENTITY OF SUBJECTS
Name ALias
Social Security Number Date of Birth
Sex
Race
Height
Weight
Byes
Hair
Residence
-
peR 8F,F,16IAL YSE 8NI=¥
I
b(S} b(7}(C)
2.0Q70 1 512S.,24-JUL.-2007-1OSY .zo
!SXHI.BI'fS:
J - Excel Spreadsheet titled "Flick~r New York" " identifies l1li as" a s'I.Jbject. .'
P.r~po;u:ed by:
A,PPR:'_
A-2
b{S} ,b(7}(C)
oirt s.i de ~he rece': w~!th",ut the. $R a:1;1tl"!.o'l::i·~"t·io.r\ o
n _.l!;t$,pectO'r GE\De",,·l for Ih"!lestigBti \ffiS'~
l11A\Ull1S-
,the :prDpe.l:·ty of tn.e Depar-tment bf De,f,ense
te.neral!ln i, to you·!: agency. ,(Co.nte'rrts .mav-
,m:{ pa'rty unde r ~nveSti'getH'
INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVEST1GATIVE SERVICE PITTSBURGH RESIDENT AGENCV
1000 LIBERTY AVE. Room 2101 PITTSBURGH. PA 15222-4004
(Investigatmns]
REPORT OF INVESTlGATION
20070] 51 7X-2S-NL-2007-10PB-ZO/Z
I8-fEBRUARY-2008
DISTRIBUTION:
DCIS HQ - 03S0 Northeast Field Office DCIS-I0PB
ICE - Pittsburgh
b(8) b(7){C)
CLASSIRCATION:
F8:R 8F£.161 ...... liSE 91NIrY
20Q701517X:-25 .. JUL-200q~ WPB-ZO/Z
NARRATIVE
IDBNTITY OF ·SUBJECT{'S) t:XHIBI}l(S,}
february .08, 2008
TABLE O:F CONTENTS
SECTION A
13
C
CLASSIFICAT.I.ON;
I
NARRATIVE.
1.. On July 11, 2007, the' Reporting Agent received a lead referral from Special Agent. DelS Mid-Atlantic Field Office, regarding the Immigration and-Customs Fn1'","r,p""ent (ICE) initiated Operation Flicker. Operation Flicker is a nationwide
investigation that has identified over 5,000 individuals who have subscribed to predicated child pornography websites, A listing was provided detailing individuals residing in the. Western District of'Pennsylvania who are employed by the Department of Defense and/or U.s. Military and have subscribed to' websites that contain child pornographic images or other material that exploit children via the internet.
2. Among the 5,000 names ICE identified, several individuals used their .rnll e-mail address, Fleet Past Office or Army Post Office military zip codes. DoD databases were
queried to identify individuals that may bein of child pornographic material.
One subject Identified was is. enlisted in the Reserve as a
LOI'POx"al (E-5, Enlisted).
3. The Reporting Agent contacted Special Agent ICE Pittsburgh, who
agreed to jointly work the case. with ICE serving as agency, Based all the
agreement, the Reporting Agent initiated the case on July25, 2007 (Exhibit 1).
4. On September 7, 2007, the; Reporting Agent received copies of subpoena returns for subpoena's served on'" email address and Internet service provider from Special Agent_ Also;~n that date, Special Age.n.~_ requested that the Reporting Agent ~ military personnel file (Exhibit 2).
5. On November 16;. 2007'; the Reporting Agent 0 btained ~ personnel file and contacted Special Agent_, but-received no response, Since then, the Reporting. Agent has
attempted numerous times to contact Special Agent through email and phone
calls but he has continued to be non-responsive. In Resident
Agent in Charge, contacted Special Agent " Pittsburgh, and
advised him of the situation.' speak: with.
_, however to '.' .
6. Based upon the complete non-responsiveness of ICE, who has. been named the lead agency regarding all Operation Flicker spin off cases, it is recommended that matter be closed.
b(S} b(7}{C)
ELASSIFICATH)N~
OPPIG.IAL USE ONL¥
l00701517X-25-JUlr2007~ 1 OPB~ZOfZ
February 08i 2008
IDENTITY OF SUBJECTS:
is enlisted in the Army Reserve as a Corporal (E-5, Enlisted) .
. __ 1,--
'CLASSIFICA lION:
b(8} b(7}{C)
FeR eFFI6IAl:WBE 8NLV
EXHIBITS!
1. DCIS Form 1; Case Initiation, July 25,2007
2. nCIS Form 1; Receipt of S Returns, October 3,2007
J, nelS Form 1; Receipt Personnel File, November 16,2007
Prepared by SA _ 1:_; Pittsburgh Resident Agency
APPR: _
b(S} b(7){C)
INSPECTOR GENERAL DePARTMENT OF DE'FE~SE' DEFENSE 'CRIMINAL INVESTIGATIVE SERVICE DAYTON RESIDENT AGENCY
3055 KETTERING Bl VD,#205 DAYTON,OH 45439
(Investigations)
,. '"
,
20070 1539T-26-JUL~2007-40DY -WlIIR
26-July-2007
INIIORMATION. REPORT: On July26, 2007, information was. received from the Federal Bureau of Ohirx.coneerni ng a telephonic complaint they receivedalleging illegal activity (chHd
a. DoD employee. The complaint is sum rnarized below (see attachment for
This lnfortnation is being furnished to the SIEFO/Nashville RA and the Western Fa for any action deemed appropriate and to the MAFO (Operation :Flicker) for information only. (Note: The complainant does not want to get involved beyond this initial reporting - see attached),
Attachment
1) FBI Complaint Form, July 9, 2006
2) DErDS 7/'46107
3) 4) 5)
APPR:_ Dayton, OH (w/o attachments)
b(6} b(7){C)
'CI.ASSJfICATION:
FOR OFFIGIA .. 118& ONI=N
I
20070 1553H-31-JUt-:2007 -40SX- YOIU
March 17, 2008
INSPECTOR GENERAL DEPARTMENT OF DEFENSE DE,FENSE CRIMINAL INVESTIGATIVE SERVICE SIOUX FALLS POST OF DUTY
P.O. BOX 139
CASTLEWOOD, SD 57223
(Investigations)
REPORT OF INVESTIGATION
200701553M-31-RJL-2007-40SX-YO/O
:17-MARCH-2008
---
DISTRIBUTION
D'CISHQ (03NS)
Central Field Office (40FO)
Il(B} b(7){C)
O"'''",e.nON, :
FeR BFFI6IAb. Y&&.QNI.¥ '
I
200701'553H-3L-.JUL-2007-40SX~YO/U
March I7" 2008
NARRATIVE
1. This Jnvestigation was initiated based upon information received from the' Defense
Criminal Investigative Service (DelS) Project, Operation PEeker. the DCIS Mid-Atlantic Field Office initiated Operation Flicker based on information provided by Assistant United States Attorney Gerald Smagala, 'United States Attorney's Office, Eastern District of Virginia, Alexandria Division.regarding a national investigation conducted by the United States. Immigration and Customs Enforcement (ICE). This investigation has identified over 5,000 individuals who subscribed to predicated child pornography websites. The DClS 'Sioux Fans Post of Duty was notified of one of these identified individuals, who is a full lime ArmyNational Guard.member_1
2. A database check through th€ Defense Manpower Data Center was conducted which
revealed tha_ is a Sergeant First Class and works with the North
Dakota Army National Guard (NDANG).
3. According to the ICE Cyber Crimes Center, on December 18~ 2006,_ made a
purchase through his PayPal account for $79.95 that was processed identified targe1. PayPal account utilizing the email address transaction follows virtually the exact same pattern as the other anss .... "~lVl pornography web sites, and was purchased through a PayPal account that appeared to be used almost exclusively for processing payments to these types of sites ..
4. A search of the IP address identified during the transaction revealed it belonged to the
internet service provider ND Telephone Company located in Devils Lake, ND. A Summons to NDTelephone was served by ICE, Grand Forks, ND, on August 7, 2007, which requested subscriber information for the identified IP address for the date and time of the transaction in question. Pursuant to the summons, ND Telephone identified the subscdberas"'_ residing i~".
Camp Grafton, NDANG, was contacted and agreed advised that he has hadseveral problems with
6. The Reporting Agent (RA) coordinated with _ regarding the internet history
file on the government computer used by. On. October 24, 20@7, the reporting agent received a memorandum for record from the Joint Force Headquarters, North Dakota. Army National Guard (NDARNG). regarding a cursory computer check conducted on the governmem computer used b~ The review was conducted remotely and consisted of a check of the' computer's Internet Explorer internet favorites directery, temporary internet files, internet
A·2
b(6} b(1}{C)
IRQR OI=FIGIAL "BE 9Nb¥
CLASSifiCATION:'
200701553H-31-JUL-2007~40SX~YO/U
March 17.ZQ08
history, and internet cookies, A general review offiles and directories was also conducted. Nothing was found outside of the NDARNG~s acceptable usepolicy,
7. On December 5,2007,. the RA and Special Agent_ ICE, Grand Forks, NO;
interviewed at Camp Grafton Army National Guard Headquarters building, Camp
Grafton, ND, was cooperative and related that he enjoyed watching young female models
progres~ . .' their career._ related that occasionally he would come across images .
that depicted young girls naked but he would immediately delete those images. _ stares that 'he bought memberships to 'a handful of pay sites and advised that most of those sites dealt with young modeling. He claimed that if he bought into a site that contained anything offensive, he wouldn'treturn to that site,
8. _ subsequently provided consent to search his home computer. A search of the
computer included the internet history file which was commensurate with the kinds of-images
that claimed interest in, including teen and preteen modeling, sites. While looking at these
. again related that if he visited a web site with inappropriate content, he would leave munediately,_ bad a shortcut on his desktop to a file containing approximately four subfolders. Two of these sub folders contained images that were very similar in nature to what Grove described would be on his computer. Most depicted young females and appeared to be in either photo 'shoot type settings or in swimwear, There were some images of naked females in each of the foJdcl's, but these females appeared to be oyer the age of eighteen. SA ~ used a "presearch" software program to view all of the image files 01_ computer. A couple of images located in the "temporary internet files" area of the computer appeared to be females of questionable age, possibly younger than eighteen .. These images and the location of the images on the computer appear to be consistent with_ description of his internet interests and
activities. -
9. Based on the information developed during the course of this investigation, the nelS,
Sioux Falls Post of Duty and ICE, Grand Forks, ND, consider this investigation closed. An investigative leads haw, been covered and no further investigative activity is anticipated.
A-3
b(.B} .b(7}{C)
fOR.8FFl81.AL '=IS'E aN..,.,.
CLASStFICA:r~ON :
200701553H-31-JUL~2007-40SX-YO/V
IDENTITY OF SUBJECTS
Name Alias
Social Security Number Date of Birth
Race
Sex
Residence
Employment/Occupation.
Telephone Number
March 17, 2008
IDENTIFYING DA l'A
..
'CLA:SSI FICA.:JION,:
B-1
b(S} b(7}{C)
F'S'R eFFlelA'1i "'51! DNL¥
I
20070] 553H-31-JUL-2007-40SX- YO/U
EXHIBITS
None. Previously submitted.
Prepared by:'
GLASSIFICAJION;
FeR, eFFIE.AI. U&1i QNLrY,
March 170 2008
Sioux Falls Post of Duty c-i
APPR;_
b(6} b(7){C)
I
INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMlNAL INVESTIGATIVE SERVICE WESTERN FIELD OFFICE
26722 PLAZA ST, STE 130
M.ISSION VIEJO, CA 92691-6300
(Investigations)
REPORT OF INVESTIGATION
20070 1606N-08-AUG~2007 -50LA- WI
November 17,2009
GRANT, GARY DOUGLASS
DlS1'RlBUTlON
DCTS~ Headquaters (03NS) ICE~ Santa Ana" CA
b(S} b(7}{C)
OLASSIFICATION::
FeR erF.SIA .. "BE 8,Nb¥
I
200701606N-08-AUG~2007~50LA~Wl/F
November 17,2009
NARRATIVE
1. On July 18, 2007, .~. . nets Arlington Resident.Agency; referred
identi tying information for sixteen persons " ties to the Department of Defense (DoD) who 'are in the nels Mission Viejo Resident Agency (MYRA) area of responsibility (AOR) and are
suspected of involvement in child pernography. • initially received the
information from Assistant United States Attorney United States Attorney's
Office (USAO), Eastern District of Virginia, The persons identified are active and retired military members; D0DciviIians and DoD contractor employees, several of whom have Top Secret or higher clearances and all of whom used. '".mil" e-mailaddresses to register for access to child pornography websites.
2. In April 2006, the Immigration and Customs Enforcerueut/Cyber Crimes Center/Child Exploitation Section (ICE/C3/CES) initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection." The investigation revealed that the same organization is operating numerous: commercial child pornography websites. In addition, the organization utilizes various PayPal accounts to process the. payments for access to the. member restricted websites. The investigation was worked jointly with ICElC3/CES, ICElBirmingham,the US. Postal Inspection Service, the 0'$. Department of Justice/Child Exploitation and Obscenity Section, and the USAO for the Northern District of Alabama. ICE designated this operation as Project Flicker,
3. ICE/C3/CES conducted over 60 undercover transactions 'at the advertising websites associated with this investigation. The investigation determined that. a specific criminal organization operated approximately 18 commercial child pornography portal websites which provided access to approximately 18 child pornography member ... restricted websites, using a specific and identifiable payment website known as "i West." The investigation identified that the criminal organization 0) used various Payf'al accounts to facilitate the customer payments; (2) used specific subject identifiers within the PayPal accounts to identify purchases into the various member restricted websites.and (3) used specific administrative e-mail accounts that are
used to distribute access to the member restricted websites, .
4. Project Flicker data was sorted to identify individuals who used their .mil e-mail address, Fleet Post Office, or Army Post Office military zip codes to register for the Pay Pal service to access the child pornography web sites. Gary Grant, Captain, U.S. Army Reserves was one of the individuals identified from this data. Grant is a JAG assigned'to the Judge Advocate detachment ,at the Los Alamitos Army Reserve Base, Los Alamitos, CA
5" On August 28" 2007 ~ a 'Search warrant was conducted at Grant's residence, The investigation revealed that Grant sent, through the Internet, an image depicting minors engaged in sexually
explicit conduct as set forth in California Penal Code Section 3]1)' Specifically, on
bet Grant sent America Online users and
, an email with image A9.jpg" depicts a nude
mitior female back in the sand and facing. the viewer, The minor female has her left leg
bent and is exposing her genitals,
A-I
b{S} b(7){C)
I
'20070 1606N-08-AUG-2007-50LA-Wl/F
November 17, 2009
6 .. On August 5, 2008, Grant was arrested pursuant 10 a State of California warrant. The arrest occurred at Grant's residence located at 55 Bluff Cove Drive, Aliso Viejo, CA, 92656. Also participating with DelS in the arrest were Special Agents from Immigration and Customs Enforcement (ICE) and investigators with the Orange County, CA Sheriff s Department. Grant was arrested for three counts of California Penal Code 311. t 1 (a), possession of obscene matter ofa minor in a sexual act (Refer to Exhibit 1).
7. On April S, 2009, Grant pled guilty in Superior Court of Cali forni a, County of Orange, to possession of obscene matter of a minor in a sexual act, California Penal Code 311.11 (a). Grant was sentenced to 90 days confinement and three years probation (Refer to Exhibit's 2 & 3),
8. In light of the successful prosecution of Grant. this. investigation isconsidered formally dosed, The DCIS, Mission Viejo Resident Agency, will devote no further resources to the matter. This case wasconducted jointly with the ICE, Santa Ana, CA The Orange County District Attorney's Office, handled the criminal prosecution.
9. No operational readiness or safety issues were identified during the investigation, and no systemic weaknesses Were revealed .. Therefore, no Fraud Vulnerability Report will be generated.
A-2
20070 1606N-08~AUG-2007~50tA- WI IF
IDE:NTITY OF SlJBJECT
.NAME ALIAS DOB SSN .HEIGHT WEIGHT HAIR EYES:
ADDRESS
PHONE
DRIVERS LICENSE # STATUS
OCCUPATION
Novem ber 17, 2009
IDENTIFYING DATA
Gary Douglass Grant
Gary Dougalss Grant; Oary Dougals Grant
'-95,
]70Ibs.
Brown
B·
Lawyer
b(B} b(7){C)
20070 1606N -08~AUG~2007 -50LA-W.1 iF
November 17.2009
EXHIDITS
1. DelS Form 1, "Arrest Report," dated August 5, 2008, with attachments'.
2. DCIS FOI1n I" "Significant Incident-Guilty Plea & Sentencing," tlated April 27; 2Q09, with attachment.
3. DCIS Form If "People Vs Grant Minute Order," dated November 11,,2009., with attachment.
Prepared "by' Special Agent ~_ Mission Vle'jo Resident Agency APPR:
-c-
b(6} b(7}{C)
INSPECTOR GENERAL DEPARTMENT OF DEFENse. 'DEFENSE CRIMINAL INVESTIGATIVE SERVICE KANSAS CITY RESIDENT AGE~'NCY
500 STATE AVE, STI: 565
·KANSAS CITY, Ks 66101-2453
[Investlgations)
REPORT OF INVESTIGATION
2'0070162'013-1 O-AUG-2007~40[(C- YO/F SHAWN MULLEN
JAMES MAr'rES
SEPTEMBER 7,2009
DISTRIBUTION
J)CISHQ (03NS)
ncis Central Field Office (40FO)
CLASSIFICATION:
, FilA OFF.C..A .. "BE .QNI.¥
20070 1620B-IO-AUG-2007-40KC-YO/F
SEPTEMBER 7, 2009
TABLE OF CONTEN1'S
SECTION A A B B C D E F F G
Synopsi s " , ... , , ... , , .. , '. , . , ,
Statutes ' , " .. '. " ., . _ • , .... , ' "
Background .. , , , .. , .. , '" . , ,
Narrative . , .. , , .. , , .
Identity of Subjects, .•...... , , , , , .
Law Enforcement Records , , ... , , "' ... , ,
EVIdence" H , •• " • , , •••• , , •••• , ••••• ,
Status of Investigation , , . , , .
Prosecutive Considerations _ , , , ,
Exhibits. , , , , .
Cl.A:SSIFICA1ION:
FeR 8FFI81AL Y,S£ 8NL¥
I
2G0701620B~ lO-AUG-2007-40KC-YOfF
SEPTEMBER 7. 2009
SYNOPSIS
Immigration and Customs Enforcement (ICE) conducted a national investigation that identified over 5,000 individuals who subscribed to predicated child pornography websites, The Reporting Agent (RA) utilized information contained within the DoD Employee Interactive Data System (DEIDS) and the Joint Personnel Adjudication Systems (JPAS) to identify DoD affiliated individuals. The RA identified 14 possible subjects with a DoD nexus! and with ties to the DelS Kansas City Resident Agency areas of responsibility. After further interviews and data checks, two individuals were named as subjects in this case, Shawn Mullen (Mullen) and James Mattes (Mattes).
A search warrant was executed at Mullen's residence, Analysis of the computers seized during the warrant identified images of child pornography. Mullen was indicted on one count receipt ofchildpornography in violation of 18 U.S.C. § 2252(a)(2), and one count possession of child pornography in violation of U U.S.C. § 2252(a)(4)(B) of which he pleaded guilty. Mullen was sentenced to 78 months confinement and 8 years supervised release.
Mattes was interviewed and consented to a search of hif> personalcomputer. Analysis of the computer identified images of child pornography. Mattes was indicted on one count receipt of visual depictions involving the use of minors engaging.in sexually explicit conduct by means of'computer in violation of 18 U.S.C. § 2252(a)(2), and one count possession of material involving sexual exploitation of minors, 18 U.S.C. § 2252(a)(4)(B) .. Mattes pleaded guilty to Count 1 of the indictment, 18 U.S.C. § 2252(a)(2), receipt. Mattes was sentenced to 65 months confinement.f years. supervised release and $5,000 in restitution,
The case was successfully prosecuted by the u.s. Attorney's Office, District of Kansas and District of Southern Iowa,
STATUTES
The following violations of the United States Code apply to this investigation:
18 USC § 2252(a)(2)
18 USC §. 2252(a)(4)(B)
(Receipt of Child Pornography) (Possession of Child Pornography)
A
CLASSIFICATION:
ra'RsrFI61AL I:ISE, a,N~Y
I
200701620B~ lO~AUG~2007~40KC- YOIr
SEPTEMBER?,2009
BACKGROUND
This case was initiated based oninformation derived from Defense Criminal Investigative Service (DCIS) Project: Operation Flicker (Case Control Number 200701 199X), As background, on May 29.~ 2007, the nelS, Mid-Atlantic Field Office (MAFO), initiated Operation Flicker based on informatlon provided by Assistant United States Attorney (AUSA) Gerald Smagala, United States Attorney's Office (USAO), Eastern District of Virginia - Alexandria Division. AUSA Smagala advised that the Immigration and Customs Enforcernent (ICE) conducted a national investigation that identified over 5,0.00 individuals who subscribed to predicated child pornography websites, AUSA Smagala specifically requested that DCIS<\ssist in identifying Department of Defense (DoD) affiliated individuals and provide investigative
assistance. .
The Reporting Agent (RA) utilized information contained within the DoD Employee Interactive Data System (OEIDS) and the Joint Personnel Adjudication Systems (JPAS) to identify DoD affiliated individuals. The RA identified 14 possible subjects (listed below) with a DoD nexus) and with ties to the DCIS Kansas City Resident Agency areas cf responsibility.
Search warrants and computer analysis were techniques. used during the course of this investigation.
NARRATIVE
1. Asearth warrant was served on the residence of Shawn Mullen, DoD contractor. The,
computers and digital media seized from Mullen's house were submitted by the RA to the Defense computer' Forensics Laboratory (DeFL) in Linthicum. MD.
2.. The RA and ICE SA __ conducted three interviews with • __
_ and" On September 4,2007._ consented to an interview and 'a
review of his laptop. admitted to subscribing to the child pornography website. The
RA discovered .. .• , of child pornography on his laptop and_ consented to.
_ seizing the laptop for further forensic review. ICE will continue the investigation involving_without DCIS because he has since separated from the military and no longer has any DoD affiliation.
The RA and _ interviewed _ who denied purchasing any subscriptions to child pornography websites, _ has since retained an attorney. The RA contacted the Federal Bureau of Investigation Innocent Images to search their database for any information 011 _ his name, and user name yielded no results.
_ consented to an interview and a review of his computer. No images of child 'pornography were fOUI'lI;! and the agents will not continue the investigation on_
3. The RA and_ interviewed James Mattes who admitted to possessing child
pornography and consented to a review of his computer. The review showed that the computer
b{6} b{1}(C)
B~l
~CL~~~'SS~IF~IC~A~T~IO~N:~------~--------------'-------=-----------------------~--------------,-----
FOR 9FFICI~L "ali GNU
I
20070 1620B~ lO-AUG~200T-40KC~ Y(i)/F
SEPTEMBER 7, 2009
did have child pornography on the hard drive and Mattes consented to the seizure of the computer. The RA has been conducting a forensic examination of the computet and will submit the results to the National Center for Missing and Exploited Children upon completion to
identify known victims. _ is coordinated the case with the U.S. Attorney's Office, Southern District of Iowa, which agreed to prosecute this case. Mattes was added as a subject.
_ consented to a
4. 'The RA and ICE Springfield, MO interviewed
review of his computer and no child pornography was r
5. Mattes was indicted on January 23, 2008 on one count receipt of visual depictions
involving the Use of minors, engaging in sexually explicit conduct by means of computer in violation of 18 LT..S.c. § 2252{fl)(2), and one count possession of material involving sexual exploitationof minors, lRHS.C. § 2252(a)(4)(B).
6. The computer analysis of Mullen's computers was completed by the Defense Computer
Forensics Laboratory, Chlld pornography was identified, On May 21,2008, Mullen was charged by a federal grand jury as part ofatwo count indictment in United States District Court, District Of Kansas, Mullen was indicted on one count receipt of child pornography in violation of 18 U.S.C. § 2252(a)(2),and one COl111t possession of child pornography in violation of 18 U.S"C. § 2252{a)( 4)(B}.
7. Mullen pleaded gui lty to both counts of the. May 21, 2008 indictment, one count receipt of child pornography in violation of 18 V.S.c. § 2252(a)(2), and one count possession of chitd pomography in violation ofl8 V.S.c. § 2252(a)(4J(B).
8. On October 3,2008, Mattes signed a plea agreement. Mattes pleaded guilty to Count 1
of the January 23, 2@08 indictment, 18 U.S.c. § 2252(a)(2), receipt. Count 2 of the indictment, 18 U.S,C, § 2252(a)(4)(B)"possession, was dismissed at the conclusion of the sentencing hearing,
9. On April 6, 2009, Mullen was sentenced by U.S. District Judge John W, Lungstrum in
United States District Court, District of Kansas. Mulien Was sentenced to 78 months confinement, 8 years supervised release (to include sex offender registration) and was ordered to pay a $200 assessment fee.
10. On May 15,2009, Mattes was sentenced by Chief U.S. District Court Judge Robert W.,
Pratt, in United States District Court, Southern. District of Iowa. Mattes was sentenced to 65 months confinement, 5 years supervised release (to include sex offender registration) and was ordered to pay a $100 assessment fee. Mattes was al so ordered to forfeit the Dell Dimension comii. uter 4600, Serial NUhlbet~4~KF3.1 used in th~ c~mmissio~oft.hc crime. The victim of
the _ filed fer $6 million dollars of restitunon be paid,
II. On June 22,2009, Mattes was also ordered to pay restitution in the amount of$5,000 to
the MarshLaw Finn, White Plains, New York. The Marsh Law Firm represents the victim from the __ which was among the images identified on Mattes.' computer.
b(8) b(7){C)
CLASSIFICATION:
FOR OFEI'CIAL USIi. ONk'f
I
2007'01'62@B-l0-AUG-2007-4@KC~YO/F
SEPTEMBER 7, 2009
IDENTITY OF SUBJECTS
IDENTIFYING DATA
Name Alias
Social Security Number Date/Place of Birth Race
Sex
Height
Weight
Hair
Eyes
Residence
'Shawn Mullen UNK
-
4/301l964~ UNK
Caucasian Male/F emale
6' 1 '.'
]851bs Brown Brown
Employment/Occupation
I
Former analyst
Northrop Grumman UNK
UNK
UNK
Telephone Number Home
Driver's License Number and Issuing State Education
UNK
b(6} b(7){C)
CLASSIFICAJ,IOti'i ~--------,-----=D:__--=l:------ __ -------- ~ ~
FaR BFFISIALY8E 8NI=¥
I
200]0 1620B-l O-AUG-2007-40KC- YO/F
SEPTEMBER 7~ 2009
IDENTITY Of SUBJECTS
Name Alias
Social Security Number Date/Place of Birth Race
Sex
Height
Weight
Hair
Ey€s
Residence
Employment/Occupation
Telephone Number Home
Dl'iver's License Number and Issuing State Education
IDENTIFYING DATA
James Dean Mattes UNK
-
7/11/1970, UNK
Caucasian Male/Female 6'Z}'
2001bs Brown Brown
E~7 UNK UNK UNK
UNK
b(6} b(7){C)'
C[_ASSIFICA liON:
FeR eFFlelA .. "'&Ii QNL¥
I
200701620B~lp-AUG-2007-40KC-YO/F
SEPTEMBER 7, 2009
LAW ENFORCEMENT RECORDS
THe files of the Defense Clearance and Investigations Index (DelI) were queried for records of Shawn Mullen and James Mullen. A check did not reveal anything pertinent to this investigation, A National Crime Information Center (NeIe) query (If Shawn Mullen and jatIIes Mattes revealed no' criminal records, either state or Federal.
CLASSlflCATIONt
FaR e:FFI,el.AL Hal: .DNt? ....
I
200701620B-10-AUG-2007-40,KC-YO/F
SEPTEMBER 7, 2009
EVIDENCE
A. Subjects
Shawn Mullen
18 USc. § 2252(3)(2)
18 USC § 2252(a)(4)(B)
James Mattes
18 USC § 2252(a)(2)
1,8 USC § 2.2.S2(a)(4){B)
B. Documents
Previouslysubmitted
C. Witnesses
None
(Receipt of Chi"ld Pornography) (Possession of Child Pornography)
(Receipt of Child Pornography) (Possession of Child Pornography)
E-l
<;LASSIFICAl'l(l)N:
POK OPPIC.I,At tJ9E 8NLY
I
2,00701620B-I0-AUG-2007-4O:KC-YO/F SEPTEMBER 7~ 2009
STATUS OF INVESTIGATION'
This investigation was successfully prosecuted by LJ. S. Attorney's Offi CE1 District of Kansas, Kansas City; KS and Southern District of Iowa, Des Moines, IA.
Shawn Mullen was indicted on one count 18 USC § 2252 (a)(2) and one count 18 USC § 2252(a)(4)(B). He pleaded guilty both counts and was sentenced to 78 months confinement, 8 years supervised release (to include sex offender registration) and was ordered to pay a $200 assessment fee,
James Mattes was indicted on one count 18 USC § 2252 (a)(2) and one count 18 l)SC § 2252(a)(4)(B)_ He pleaded guilty to one count of 18 USC § (a)C2) and sentenced to 65 months confinement, 5 years supervised release (to include sex offender registration) and was orderedto pay a $1 O? assessment fee. ,M. anes w. _as also order.ed, to forfeit th~ Del~ ~)im~. n~ion ~om~ 4600, Serial Number 14PKF31 used in the commission of the crime. I'he victim of the _ _ filed for $6 million dollars of restitution to be paid. An amended judgment was filed and ordered Mattes to pay $5,000 in restitution.
PROSECUTIVE CONSIDERATIONS
There are no prosecutive considerations to date.
CLASSIFiCATION:
FaR 8FFIGIAl: "Be 9Nl:V
b(6) b(7}{C)
200701620B-1 O-AUG-2007 -40KC- YO/F
SEPTEMBER 7,2009
EXHIBITS
Previously submitted.
Prepared by: • __ , Kansas City Resident Agency
APPR:_
b(6} b(7}(C)
G-I
'CLASSIF,ICA TIO,.,.:.
FaR, 8FF1SIAb YI&ONL.Y
I
..
DEPARTMENT OF DEFENSE OFFICE OF INSPECTOR GENERAL IJEFENSECRIMINAL INVESTIGATIVE SERVicE ARLINGTON RESIDENT AGENCY
201 12thSTREer SOUTH, SUITE 712 ARLINGTON. VIRGINIA 22202·5408.
(Investigations)
REPORT OF INVESTIGATION
200701623E~10-AtJG-2007·60DC-WIID
July ,8~ 2008
--
DISTRIBUTION:
DClS Headquarters, National Security Program '(03'NS)
b(6} b(.7}(C)
eL:A.SSIFleATION:
FOR' OfFlel~L liSE ONlY LNiI ENFORCEMENT SENSITIl:iE
I
200701623E~1O-AUG-2007-60DC~WllD
July 8,2008
NARRATIVE:
1. This case was initiated based on information derived frorn the nelS Project: Operation Flicker (Case. Control Number200701199X). On May 29, 2007, the DClS Arlington Resident Agency initiated Operation Flicker based on information provided by Assistant U,S. Attorney CAusA.) Gerald Smagala, U.S. Atterney's Office, Eastern District of Virginia, Alexandria Division. AUSA Smagalaadvised that the: Immigration and Customs Enforcement (ICE) was. conducting a nationwide investigation that identified over 5,000 individuals that subscribed to predicated child pornography websites, AUSA Smagala requested DCTS assistance in identifying individuals affiliated with the DoD and investigate those individuals with ICE.
AUSA Smagala identified ,as one individual with a DoD afflliation
that subscribed to . pornography websites,
A query of the 000 Employee Interactive Data System indicated _ was in the
...,,,,,,,·v •• ,, E-05 .. A . of the Joint Personnel . Systems indicated that
3. AUSA Smagala informed __ that ICE did not purchase a, subscription to the website _ purchased .: AUSA Smagala declined criminal prosecution of_ because It could not be proven that the website_ purchased contained child pornography,
4, On January 16,2008, ICE, interviewed
_ at his residence,a subscription to aehild
pornography website, admitted he purchased subscriptions to several online
pornography websites over past few years. _ stated' he encountered child
pornography on the Internet on several occasions. On one occasion, after downloading a pornographic video that he believed was adult pornography, reviews of the video that were posted by other people that previously ... IT·", ""P'T> posts were calling the individual that posted the video on the Internet a. pedophile. After seeing
the comments posted by people about the ' downloading the video
because he believed it may have been child also encountered child
pemography in the form of "pop ups." on the Internet on . occasions, _ was
questioned about a website called "Red Lagoon Mags" and stated he had. no knowledge of the wehsite.~as informed that his credit card was used to purchase a SUbscription to Red Lagoon Mags for $79.99.,_. repeated he had no knowledge of the website and stated he
did not remember . a SUbscription to the. website. At the, conclusion of the interview,
voluntarily turn over computer for forensic review. but
then terminated the interview .
5. On January 30
•• ' regarding
.. _-
. DelS investigation.
. CLA.SSIFfCATION:
FOR OFFle·Ii&tL USE ONLY LV.II ENF9RGEMENf SENSlfl\(E
I
b(6} b(7}{C)
200701623E-IO-AlIG~2007~60DC-Wl/D
July 8,2008
7, nelS will take no further action-on thi& matter. No fraud vulnerabilities were-identified
during Ithis investigation, The irrvestigation is "lased as "declined."
A-2
b(8} b(7){C)
OlASSIFICATION:
FOR: :{lFFISIAllJSE ONLY ,lAW [NFOAS~MEN1SEN&I1:I\f& -
~ANINe '
ent is the pr:opetfy of!he Department of Defense Inspector Ganef ' nd is on loan toy - ~'ntents may not be dis - aWnder investigation hor may this docume otl1Slde the ,teceivi~'g agenCy wtttlQut the s ariiauon Ilf me Depu ,I " er;ll for
T ns.
2:00701623E~lO-AUG~2007~60DC-Wl/n
IDENTITY OF SUBJECTS
Name
Social Security N umber Date of Birth
Sex.
Residence
Employment/Occupation
July 8, 2008
III
Prepared by Special Agent __ , Arlington Resident Agency
I
APPR: _
B-1
b(6} b(7}{C)
I
(Investigations}
IN'SPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRJMINAL INVESTIGATIVE SERVICE LONG BEACH RESIDENT AGENCY
501 w,. OCEAN BL. VO, SUITE 1300
LONG BEACH" CA 90802'
REPORT OF fNVESTIGATlON
20070 1667W ~ 17~AUG-2007-50ES- WI!Z
--
DI'STRIBtrrION
Western Field Office
31-JANUARY-200S
b(6} b(7}{C)
ClAS.SIFICA TIO N,
FeR eFFie.",," 1::16E eN~LV'
.200701667W -17-AUG-2007-50ES- WIIZ
31-JANUARY-2008
NARRATIVE
1. On July 18.2007._ nels Arlington Resident Agency, referred .
identifying information for sixteen persons with ties to the Department of Defense (00'0) who
are. in the neTS Long Beach Resident Agencies (50ES) Area of Responsibility OR) and are
suspected of purchasing and supporting the child pornography trade. • initially
received the information from Assistant United States Attorney Gerald States
Attorney's Office (USAO), Eastern District of Virginia. The personsidentified are active, reserve & retired military members, 000 civilians and DoD contractor employees, several of whom have security clearances.
2. In Apri,120061 the Immigration and Customs Enforoement/Cyber Crimes Center/Child Exploitation Section (ICE/C3(CES) initiated an investigation intoa criminal organization operating a commercial child pornography website known as "Horne Collection." The investigation revealed that the same organization is operating numerous' commercial child pornography websites. In addition, the organization utilizes various PayPal accounts to process the payments for access to the member restricted websites, The investigation is being worked jointly with ICE/C3JCES, ICElBirmingham, the U.S. Postal Inspection Service, the U'.S, Department of Justice/Child Exploitation and Obscenity Section.and the USAO for the Northern District of Alabama. ICE has designated this operation as Project Flicker.
3. ICE/C3/CES conducted over 60 undercover transactions at the advertising websites associated with this investigation, The investigation determined that a specific criminal O"r:gan:izatiotl operates approximately 18 commercial child pornography portal websites which provide access to approximately 18 child pornography member-restricted web sites, using a specific and identifiable payment website known as "iWest." The investigation identified that the criminal organization (1) uses various PayPal accounts to facilitate the customer payments; (2) uses specific subject identifiers within the PayPal accounts to identify purchases into the various member restricted websites; and (3) uses specific administrative e-mail accounts that are used to distribute access to the member restricted websites,
4. Project Flicker data was sorted te identify individuals who used their personal e-mail addresses, .mil e-mail address, Fleet Post Office, or Army Post Office military zip codes to register for the PayP.al service to access the child pornography websites, The four suspects ideRtitied in the 50ES AOR have been tided as subjects based upon the initial evidence that was provided to the nelS by ICE. Based upon the fact that the subjects are DoD employees and
possess securiry clearances, ICE has listed them as a Tier 1 . This investigation was
coordinated with ICE Child Exploitation Unit, Long
Beach, CA," _. has been assigned as the
Investigating agent, .
A-J
I
b(8} b(7}(C)
200701 667.W -17-AUG.:2007-50ES;WlIZ
Jl-JANUARY-2008
5.. After a review of _ transactions in, December 2007, it was determined that the probable cause for a search warrant was stale and that more recent.evidence was not available.
In addition to this information, it was also determined that a portion of the original nexus for the initiation of the investigation was incorrect The information report referred had indicated that the subject had used his/her .mil account to conduct the illegal purchase of child pornography.
At the time it was decided that the use of a .mil account in conjunction with the fact that the subject was a contractor to the U.S, military was sufficient nexus to initiate an investigation, However, once it was determined that the use of a .rrril account aid not occur and that the PC was stale 'and no further evidence is available, this investigation is closed. There, were no management control deficiencies identified during the course of this investigatien,
A-2
b(6} b(7}{C)
-- .... -
I
20070 1667W -17-AUG~2007 -S·OES~ WIll,
IDENTITY OF SUBJECTS
Name Alias
Social Security Number Date/Place of Birth Race
Sex
Residence
Employm eat/Occupation Telephone Number Education
31-JANUARY-2008
Identifying Data:
B-1
b(6:} fl(7}{C.l
- -_------_----
2007D1667W-17-AUG-2007-50ES~Wl/Z
EXHIBI1'S
No Exhibits
Prepared By; SA __ , Long Beach Resident Agency APPR:
I
:3' 1··.J ANVARY-2008
b(8} b(7}{C)
[Add CCN to. Header]
(Investigations)
Month ##, YYYY
INSPECTOR GENERAL, DEPARTMENT OF DEFENSE D.EFENSE CRIMINAL INVESTIGATIVE S'ERVICE LONG BEACH RESIDENT AGENCY
501 W. OCEAN BLVD, SUITE 7300
LONG BEACH; CA 90802
REPORT OF INVESTIGATION
20070 1690T -23~AUG-2007-50ES- Will
--
DISTRIBUTION
Western Field Office
3l:~J'ANUARY-2008
b(8J I:l(7){C),
CLASSIF.Ie,A fION:
r8.R 8,FFI6IAI=Y8E9NL'l
[Add CCN to Header]
Month ##, yyyy
200701690T~23~AUG~2007~50ES~WVZ
31 ~JANUAR y ~2008
NARRATIVE
DCIS Arlington Resident Agency, referred
identifying' sixteen persons with ties to the Department of Defense (DoD) who
are in the DelS Long Beach Resident Agencies (50ES) Area of Responsibility (AOR) and are
suspected of purchasing and supporting the child pornography trade. initially
received the information from Assistant United States Attorney States
Attorney's Office (USAO), Eastern District of Virginia. The persons identified are-active, reserve & retired military members" DoD civilians and DoD contractor employees, several of whom have security clearances.
2. In April 2006, the Immigration and Customs Enforcernent/Cyber Crimes Center/Child Exploitation Section (ICE/C3/CES) initiated an investigation into a criminal organization operating a commercialchild pornographywebsite known as "Home Collection," The investigation revealed that the same organization is operating nume~ous commercial child pornography wcbsites, In addition, the organization utilizes. various PayPal accounts to process the payments for access to the member; restricted websites, The investigation is being worked jointly with ICEJC3/CES, ICElBirrriinghrun, the UX Postal Inspection Service, the U.S. Department of Justice/Child Exploitation and Obscenity Section, and the USAO for the Northern. District of Alabama. ICE has designated this operation as Project Flicker,
3. ICE/C3/CES conducted over 60 undercover transactions at the advertising websites associated with this investigation. The investigation determined that a, specific criminal organization operates approximately 18 commercial child pornography portal websites which provide access to approximately 18 child pornography member-restricted websites, using a specific and identifiable payment website known as "i'Weat." The investigation identified that the criminal organization (1) uses various PayPal accounts to facilitate the customer payments; (2) uses specific subject identifiers within the PayPaI accounts to identify purchases into the various member restricted websites; and (3) uses specific administrative e-mail accounts that are used to distribute access to the member restricted website-so
4. Project Flicker data was sorted to identify individuals who used their personal e-mail addresses, .mil e-mail address, Fleet Post Office, or Army Post Office military zip codes to register for the PayPal service to access the child pornography websites. The four suspects, identified in the 500BS AOR have been titled as subjects based upon the initial evidence that was provided to the DCIS by' ICE .. Based upon the fact that the subjects-are DoD employees and possess security clearances, ICE has listed them as a Tier 1 priority. This investigation was
coordinated with ICE Child Exploitation UnitLong
Beach, CA, _ has 'been assigned as the
investigating
A~2
b(6} b(7}{C)
peR. e.ffle,lAt: 1:15E eN.LV
Cl;llSSIFICA ll.oN:
[Add CCN to Header]
Month ## YYYY
20070 1690T -2J-AU G-2007-5 OES- W J IZ
'31-JA~lltJARY -2008
5. After a review Of_fahSactiollS in December 2007, it was determined that the probable cause for asearch warrant was stale and that more recent evidence was not available. In addition te this information, it was also determined that a portion of the original nexus for the initiation of the. investigation was incorrect. The Information report referred had.indicated that the subject had used his/her .mil account to conduct the: illegal purchase of child pornography. At the time it was decided that the use ora .mil account in conjunction with the fact that the subject Was: a activemember of the military was sufficient nexus to initiate an investigation. However, once it was determined that the use of a .mil account did not occur and that the PC was stale and no further evidence is available, this investigation is closed. There were no management control deficiencies identified during the COUl:!il€ of this investigation.
A~3
b(6} b(7}(C)
CLASSIFICA:rIO~:
I
, .
[Add CCN to Header]
Month ##, YYYV
2@0701690T-2.3-AUG-2007-50ES-WI/Z
31-JANUARY-2008
,EXHIBITS
No Exhibits
Prepared By; SA
Long Beach Resident Agency
APPR
b(6} b(7}(C)
C-l
FeR 9FFIS.IAb "8.& eNL¥
,CLASSIFICATION~
I
{I nvestigations)
INSPECTOR GENERAL DEPARTMENT OF DEFENse DE'FENSE CRIM'INAL INVESTIGATIVE SERVICE LONG BEACH RESIDENT AGENCY
.501 W. OCEAN BLVD, SUITE 1300
LONG BEACH, CA90802
REPORT OF INVESTlGAUON
200701691 U -23-AUG-2007~50ES~W1!z
--
DISTRIBUTION
Western Field Office
31-JANUARY-2Q08
b(6} Il<7){C)
CLASSIFICATIOllif
-FeR erFI61AL USE, 'BN"¥"
I
200701691U-23~AUG-2007-50ES-WI/Z
31-JANUARY~2008
NARRATIVE
1. On July 18,2007._ DClS Arlington Resident Agency, referred
identifying information for sixteen persons ties to the Department of Defense (DoD) who
are in the DCIS Long Beach Resident Agencies (SOES), Area of Responsibility (AOR) and. are
·suspec1ed of purchasing and supporting the child pornography trade. initially
received the information from Assistant United States Attorney States
Attorney's Office (USAO), Eastern District of Virginia. The persons identified are active, reserve & retired military members, DoD civilians and DoD contractor employees, several of whom have security clearances.
2. In April 2006, the Immigration and Customs Enforcement/Cyber Crimes. Center/Child Exploitation Section OCE/C3/CES) initiated an investigation into a criminal organization operating a commercial child pornography website known as "Horne Collection." The investigation revealed that the same organization is operating numerous commercial child pornography websites, In addition, the organization utilizes various PayPal accounts to process the payments for access to the member restricted websites. The investigation 1S being worked jcintly with ICE/C3/CES, ICE/Birmingham, the U.S. Postal Inspection Service, the U.S,. Department of Justice/Child Exploitation and Obscenity Section, and the USAO for the Northern District of Alabama. ICE has designated this operation as Project Flicker.
3., ICE/C3/CES conducted over 60 undercover transactions at the advertising websites associated with this investigation. The investigation determined that a specific criminal organization operates approximately I g commercial child pomography portal websites which provide access to approximately 18 child pornography member-restricted websites, using-a specific and identifiable payment website known as "[West," The investigation identified that the criminal organization (1) uses various Pay-Pal accounts to facilitate the customer payments; (ly uses specific subject identifiers within the Pay Pal accounts te identify purchases into the various member restricted websites; and (3) uses specific administrative e-mail accounts that 'are used to distribute access to the member restricted websites.
4. Project Flicker' data. was sorted to identify individuals who used their personal e-mail addresses, .mil e-mail address, Fleet Post Office, or Army Post Office military zip codes to register for the PayPaJ service to access the child pornography websites, The four suspects identified in the SOES AOR have been titledas subjects based upon the initial evidence that was provided to the DelS by ICE. Based upon the fact that the subjects are Don employees and
possess security clearances, ICE has listed them as a Tier I·' . This investigation was
coordinated with ICE Child Exploitation Unit, Long
Beach, CA, _ .has been assigned as the
5. After a review of _ transactions in December 2007; it was determined that the probable cause for a search warrant was stale and that mere recent evidence was not available. In addition
A-2
b(S) b(7}{C)'
FeR 8FFI81ItLUSE; 8.NLY
CLA~ SIFICATION:
I
200701691U~23-AUG-2007-50ES~Wl/Z
3l-JANUARY-2008
to this information, it was also, determined that a portion of the original nexus fOT the: initiation of the investigation was incorrect. The information report referred had indicated that the subject had used his/her .mil account to conduct the illegal purchase of child pornography, At the time it was decided that the use of a .mil account in conjunction with the fact that the subject was a active member of the military was sufficient nexus to initiate an investigation. However, once it was determined that the use of a .mil account did not occur and that the PC was stale and no further evidence is available, this investigation is closed. There were no management control deficiencies identified during the CDUf!)C of this investigation,
A-3
CLASSIFICATION':
FeR efFleIA,LH5E eN,LV'
I
20070 1691 U~23-AUG-2007-50ES-W1/Z
31-JANUARY-2008
IDENTITY OF SUBJECTS
Name Alias
Social Security Number Date/Place of Birth Race
Sex
Residence
Employment/Occupation Telephone Number Education
Identifying Data:
b(6} b(7}{C)
8-1
,CLASSIFICA1IQN:
Fe,. eFFle.Al: "$," aN""
200701691 U-23-AUG-2007-50ES-WlIZ
JI-JANUAR Y -2008
EXHIBITS
Nd Exhibits
Prepared
.A
Long Beach Resident AgeNcy
C-l
b(6} b(7}{C)
FilA 9FFI'GIAJ. US&:, QNb¥ '
:CLASSIFICATION:
(Investigations)
INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE LONG BEACH RESIDENT AGENCY
501 W. OCEAN BLVD, SUITE 7300
LONG BEACH, CA 90802
REPORT OF INVESTIGA11ION
20070 1691V ·23-AUG-200J-50ES~W1/Z
D]STRJiBUTlON
Western Field Office
31-,JANU AR Y -2008
b(6} b(7){C)
CLASSI".ICA(IO~:
FeR eFFlelA" WIE eN,""
I
200701 692V -23-AUO-20Q7 -50ES- WJ Il
3,1' -J ANUAR Y -2008
NARRATIVE
L On July 18, 2007.. ncrs Arlington Res-ident Agency, referred
identifying information for sixteen persons with ties to the Department of Defense (DoD) who are In the nelS Long Beach Resident Agencies (SOES) Area of Responsibility (AOR) and are suspected of purchasing and supporting the child pornography trade .• _ initially received the information from Assistant United States Attorney Gerald Smagala, United States Attorney's Office (USAO), Eastern District of Virginia .. The persons identified are active, reserve & retired military members, DoD civilians and DoD contractor employees, several of whom have security clearances.
2. In April 2006, the Immigration and Customs Enforcemect/Cyber Crimes Center/Child Exploitation Section (ICEfC3JCES) initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection." The investigation revealed that the same organization is operating numerous' commercial child pornography websites, In addition, the organization utilizes various PayPal accounts to process the payments for access to the member restricted websites. The investigation is being worked jointly with ICE/CC3ICES, ICE/Birmingham, the U.S. Postal Inspection Service, the U.S. Department of Justice/Child. EXploitation and Obscenity Section, and the USAO for the Northern District of Alabama ICE has designated this operation as Project Flicker.
3. TCE/C3/CES conducted over 60 undercover transactions at the advertising websites associated with this investigation. The investigation determined that a specific criminal organization operates approximately 18 commercial child pornography portal web sites which provide access to approximately 18 child pornography member-restricted websites, using a specific and identifiable payment website known as "i West." The investigation identified that the criminal organization (1 ) uses various PayPal accounts to facilitate the customer payments; (2) uses specific subject identifiers within the, PayPa! accounts to identify purchases into the various member restricted websites; and (3) uses specific administrative e-mail accounts that are used to distribute access to the member restricted websites.
4, Project Flicker data was sorted to identify individuals who used their personal e-mail addresses, .mil e-mail address, Fleet Post Office; or Army Post Office military zip codes to register for the PayPal service to access the child pornography websites. The four suspects 'identified in the 50ES AOR have been titled as SUbjects based upon the initial evidence that was provided to the' nels by ICE. Based upon the fact that the subjects are DoD employees and
possess security clearances. ICE has listed them. as a Tier l nri . This investigation was
coordinated with ICE Child Exploitation Unit, Long
Beach, CA, _ has been assigned as the
investigating agent,
A-l
b(6) b(7}{C)
CLASSIF1CA.TION:
FeR. err.SIAb Y&E9NI.¥
I
20D70 1692V-23-AUG-2007-50ES- Wl IZ
31-JANlJARY-2008
5. After a review of _ transactions, in December 2007, it was determined that the probable cause for a search warrant was stale and that more recent evidence was not available. In addition to this information, it was also determined that a portion of the original nexus for the initiation of the investigation was incorrect The information report referred had indicated that the subject had used his/her .mil account to conduct the' illegal purchase of child pornography, At the time it was decided that the use of arnil account in conjunction with the fact that the subject was a military service member was sufficient nexus to initiate an investigation.
However, once it was determined that the use of a .mil account did not occur and that the PC was stale and no further evidence is available) this investigation is closed, There were no management control deficiencies identified during the course of this investigation.
A-2
b(6) b(7}(C)
CLASSIFICATION:
FeR 8FFl6IA .. USE 8N.loY
I
10070 1692V-23-AUG-2007-50ES- WI!Z
IDENTITY OF SUBJECTS
Nam~ Alias
Social Security Number Date/Place of Birth Race
Sex
Residence
Employment/Occupation Telephone Number Education
.3.1-JANUARY-2008
Identifying Data:
B-1
b(S) Il(7}{C)
CLASSIFICATION:
feR BFF.I:6IA" YSEDN:..v
I
200701692V -23~AUG·2007-50ES-Wl/Z
3 [-lANUAR¥-20Q.8
EXHIBITS
NQtJe
Prepared By;
Long Beach Resident Agency
AP.PR:
b(5} b(7J(C)
C-l
FOR eFFlelAL .. BE 8NLY
CI!.ASSIFICAJlON:
(Investigations)
lNSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE S-ERVICE SAN FRANCISCO RESIDENT AGENCY 1301 CLAY ST, STE 4BON OAKLAND, CA 94612 .. 5217
REPORT OF INVESTIGA nON
2Q0701756M-Q6-SEP-2007-5'OSF - WI fE
D1STR18UTION
Western Field Office
January 29, 2009
b(6} b(7){C)
CLASSI'PICATION'
roR O'FFICIAl USE ONLY
I
200701756M-06-SBP~@07-50SF-WifE
January 29,2009
NARRATIVE
1. This investigation was initiated based upon a referral from DelS
Arlington Resident Agency, Arlington VA identifying four' San
Francisco Resident Agency area of responsibility who were suspected of involvement in child.
pornography. . initially received the information from Assistant United States
Attorney (A United States Attorney's Office (USAO), Eastern District of
Virginia, Alexandria, VA. The subjects identified were reserve and retired military members, 000 contractor employees. and in one case a sub-contractor to a DoD contractor, all of whom used ".mil" e-mail addressestoallegedlyregisterforaccesstochildpornographywl;lbsites.This investigation was conducted jointly with Immigration and Customs Enforcement (JOE) agents located in Oakland, CA, S~ francisco, CA, and San Jose, CA.
2. Upon coordination with leE regarding all four subjects, it was understood that as a matter of policy the United States Attorney's Offices (USAO), Northern District ofCalifornia, San Francisco, Oakland.and San Jose, CA usually declined to accept any child pornegraphy investigation where the subject of the investigation had not engaged in any downloadactivity within the past six months. Due to the USAO's policy, ICE issued administrative subpoenas to PayPal to determine ifth€ subjects had any recent download activity with known child pomography websites within the past six months. All Pay Pal information returned in response to the subpoenas revealed that none of the subjects had accessed child pornography within the required timeframe, At their discretion ICE agents plan to perform knock-and-talk interviews of an four subjects in order to ascertain their involvement with child pornography; however, due to the heavy case load ofthe assigned ICE agents and higher priority investigations, the knock-andtalk interviews we not expected to be: conducted for an extended period of time.
3. Due to the policy of the USA 0, the limited activity on the part of the subj ccts, the length of time until the interviews win be conducted. by ICE~ and the need to focus on other higher priority investigations, this. investigation is being closed by DCIS. Itis understood that the investigations will be completed by ICE as time and their case load permits. At this time, no judicial or administrative actions are expected. There were no fraud vulnerabilities identified during the course of the. investigation,
A
b(8}. b(7}{C)
CLASSIFICATION'
rn.R· OFFIGIAll:J8E ONbY
I
200701756M-06~SEP~2007~50SF-WI/E
IDENTIT·Y OF S{]BJECTS
Name Alias
Social Security Number Date/P;lace of Birth Race
Sex
Height
Weight
Hair
Eyes
Residence
Employment/Occupation. Telephone Number Driver's License Number
and Issuing State Education
DoD Affiliaticn;
C~S$IFICA liON:
reft OfFICIAL USE. 6NlY
January 29, 2009
Identifying Data:
-,
E~4,. Marine Corp Reserve, Unit unknown
B-1
b(6} b(7){C)
20Q701"756M-06-SEP-2007~50S'F-WI/E
IDENTITY OF SUBJ'ECTS
Name Alias
Social Security Number Date/Place of Birth Race
Se~
Height
Weight
Hair
Eyes
Residence
Employment/Occupation Telephone Number Driver's License Number
and Issuing State Education
DoD Affiliation
January 29, 2009
Identifying Data:
E-7~ U.S, Navy, Retired
b(6} ,b(7}{C)
CLASSIf,ICA'lION:
B-2
FOR 8rFlGIAL .uSE ONLY
I
200701756M-06-SEP~2007-50SF~ Wl /E
IDENTITY OF SHB'JEC'FS
Name AHas
Social Security Number Date/Place of Birth Race
Sex
Height
Weight
Hair
Eye:s
Residence
Employment/Occupation Telephone Number Driver's License Number
and Issuing State Education
DqD Affiliation
CLASSIFICATION,
FOR OFFICIAL USE ONLY
Identifying Data:
B-3
January 29, 2009
-
b(6} b(7){C)
200701756M~06-SEP-2007-50SF- W1 IE
January 29; 2009
IDENTITY OF SUBJECTS
Identifying Data:
Employment/Occupation Telephone Number Driver's License Number
and Issuing St;l!e Education
Name .Alias
Social Security Number Date/Place of Birth Race
Sex
Height
Weight
Hair
Eyes:
Residence
DoD Affiliation
-
Prepared by __ San Francisco RA B-4
APPR:
b(BJ b(7}{C)
CL~SSIFI.Ci\TION :
P81t ep,FlelAL H9E eN,,"\!"
I
'INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVEST1GATIVE SERVICE COLUMBUS RESIDENT AGENCY EASTON PLAZA ONE
4449 EASTON WAY., SUITE 375 COLUMBUS, OH 43219
(Investigations)
REPORT OF INVESTIGATION
200800080D~ 18~OCT -2007 -40CO~ W liZ
December 3~ 2007
OPERA TION FLICKER., Columbus, OH
SPECIAL INTEREST CASE,
C-l
CLASSIFICATION:
II=OR OFI=IQIAI. U'SE ONLY
.--;. - ._-------
I
NARRATIVE
.If This investigation into individuals who subscribed to predicated child pornography websites was initiated based upon information received October 15,2007, from a Special Agent (SA) with the Department of Homeland Security (DHS), Immigration' and Customs Enforcement (leE), Columbus Resident Agency (RAC/Columbus) and as a result of De IS Project "Operation Flicker" (CCN~ 20070 1199X-29-MA Y -2007-60DC- Wl). rCE-Columbus referred identifying information for four individuals with ties to the Department of Defense (DoD) that are in the Columbus Resident Agency area of responsibility and are suspected of involvement in child pornography. In addition to the information provided by fCE Columbus, six additional DoD related subjects in the Cleveland, OR and Detroit MI area were identified by the PHS-ICE Detroit, MI field office and through the efforts of the Mid-Atlantic Field Office (MAFO) in Project Flicker. The persons identified are. active and retired military service members, DoD oivi lians, and DoD contractor employees; several of the individuals have Secret or higher' clearances and some may have used .mil e-mail addresses to register for access to child pornography websites,
2. In Aptil2006, the Immigration and Customs Enforcement/Cyber Crimes Center/Child Exploitation Section (ICE/C3/CES) initiated an investigation of a criminal organization operating a commercial' child pornography website known as "Horne Collection." The investigation revealed that the. same organization is' operating numerous commercial child pornography websites, In addition; the organization utilized various Payf'al accounts to process the payments for access to the member-restricted websites, The is a joint investigation with ICE/C3.!CES, ICE/RAe/Birmingham, the U.S. Postal Inspection Service, the U'S, Department of Justice/Child Exploitation. and Obscenity Section, and multiple USAO offices, including the USAO for the Northern District of Alabama. ICE designated this effort Project Flicker. DCISMAFO and neIS field office representatives assisted ICE after determining that DoD personnel and/or contractor personnel may have been involved in accessing and obtaining child pornography.
3. ICE/C3!CES conducted over 60 undercover transactions at the advertising websites associated with this investigation. The investigation determined that a specific criminal organization operates approximately 18 commercial child pornography portal websites that provide' access to approximately 18 childpornography member-restricted websites, using a specific and identifiable payment website known as "i West." The investigation identified that the. criminal organization (1) uses various Payl'al accounts to facilitate the customer payments; (2) uses specific subject identifiers within the PayPal accounts 'to. identify purchasesinto the various member-restricted web sites; and, (3) uses specific administrative e-mail accounts to distribute access to the member restricted websltes.
4. Project Flicker data 'Was sorted to identify indi viduals who used their .mil e-mail address, Fleet Post Office (FPO), or Army Post Office (APO) military zip codes to register for the Payf'al service for access to the child pornography websltes, The suspects identified in the Columbus RA AOR will be titled as subjects if the investigation determines the individuals were involved in acquiring and/or transmitting child pornography. The priority for investigating suspects win be assessed based on their security clearances, position in their 000 organizations 1 whether their DoD position provides' access to children, and whether they are a recidivist.
S. Prior to opening this investigation, the agent met with Immigration and Customs
Enforcement (ICE) Special Columbus, OH regarding Operation Flicker.
An investigative plan was provided identifying information on
Department of Defense employees. that are . the Columbus Resident Agency area of responsibility and are suspected of being 'involved in child pornography. _ offered ICE cooperation in this investigation.
b(B} 1l(7}{C)
I
. .
6. Due to DelS Headquarters' direction and other nels investigative priorities, this investigation is cancelled. No subjects were formally titled in the DCIS IDS System. No judicial or administrative action will occur. There, is no less 'to the U.S. Government. Then": were no management control deficiencies identified during the course of this investigation,
Prepared by S~
Columbus RA
b{6} b(1}{C)
INSPECTOR GENE.RAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE DAYTON R.ESIDENT AGENCY
3055 KETTERING BLVD, #205 DAYTON.! OH ·4543·9
(Investigations)
2008001 57H-02-NOV-2 007-40DY-W 1
02~ November-Ztltl?
INFORMATION REPORTI REFERRED: The Dayton Resident Agency (RA) received information from the Kansas City RA regarding a project that was initiated based upon information provided by the United States Attorney's Office (USAO), Eastern District of Virginia, Alexandria Division that advised the Immigration and Customs Enforcement (ICE) ofa national investigation that identified over 5,00Q individuals who subscribed to predicated child pornography websites, Asa result of this information ICE and the U. S. Department of Justice/Child Exploitation and Obscenity Section designated this operation as Project Flicker.
As a result of Project Flicker and the initiative from the USAO, ICE identified individuals under Project Flicker associated with the military by either providing their .mil emall addresses, Fleet Post Office (FPO),. or Army Post Office CAPO) military zip codes. DCIS was requested to assist in identifying additional Department of Defense (DoD) affiliated individuals and provide investigative assistance. Targets of Operation Project FLicker that are affiliated with the military put national security at risk by compromising computer systems/email systems and individuals with security clearances from the DoD compromise their clearance and put themselves and the interests of DoD at risk of blackmail, bribery, and threats.
(SSN: _, OOB_ was identified by
Proj ect . as one of these targets. Information he provided to an online website for
subscribed child websites listed an address •
(attachment 1).
A DElOS Report o~Tevealedthathe is an enlisted 05, active
at Fgrt . . It providesa
AREOD R~wsthat_" .••• '."' •• _ •
• _---(attachment3).. ~
A National Comprehensive
"1 •• _-
from Choice Point was generated and lists address abovementioned (attachment 4) ..
OLASSIFICATlON: . ----~---~~-----.-----------------~-
b(6} b(7}{C)
I=QR. OFFICIAl. Utili gNI.¥
I
Contact with office revealed that he was referring because ~ resides in Clarksville, Tennessee.
. ICE Bowling Green, Kentucky lCE Nashville, Tennessee office
'. does not have a current Kentucky driver') s license.
Criminal Investigation Division (CID), Fort Campbell, Kentucky, Special Agent
advised that~des off-base and prdvid~d thea,ddress _
teleph~ __ advised that because off-
would not be involved in the investigation as it would mostI be,
handled by the United States Attorney's Office, unless Information Was, gleaned that~ was participating in criminal activity on-base.
This Information is being forwarded to the Nashville Post of Duty (POD) for further action since Clarksville, Tennessee falls under Nashville POD Area of Response. Any further questions regarding this report should be directed to the undersigned at telephone nuhJ.ber~
-
Attachments:
1) Flicker Targets in Kentucky, 1 page
2) DErDS Report, 1 page
3) REDD Report, 1 page
4) National Comprehensive Report, 26 pages-
Prepared by
Dayten Ra
APPR:_
b(8} b(,7}{C)
CLASSIFICA']U·ON::
I
3
DISTR: 40SLl20F0!20ATI20NV (electronically only)
I
INSPECTOR GENERAL 'DEPARTMENT OF DEFENSE' DEFENSE CRIMINAL INVESTIGATIVE SERVICE DAYTON RESIDENT AGENCY
3055 KETTERING BLVD • .#:205 DAYTON .• OH 45439
(Investigations)
2008001 S81-02 .. NOV~2007-40DY-Wl
02-November-2007
. SSN;_ . Unknown
Campbell, KY
INFORMATION REPORTI REFERRED: The Dayton Resident Agency (RA) received information from the Kansas City RA regarding a project that was initiated based upon information provided by the United States Attorney's Office (USAO), Eastern District of Virginia, Alexandria Division that advised the Immigration and Customs Enforcement (ICE) ofa national investigation that identified over 5,000 individuals. who subscribed to predicated child pornography websites, As a result of this information ICE and the U.S. Department of Justice/Child Exploitation and Obscenity Section designated this operation as Project Flicker.
As a result of Project Flicker and the initiative from the USAO~ ICE identified individuals under Project Flicker associated with the military by either providing their .milemail addresses, Fleet Post Office (FPO), or Army Post Office (APO) military zip codes. DCIS was requested to assist in identifying additional Department of Defense (DoD) affiliated individuals and provide investigative assistance. Targets of Operation Project Flicker that are affiliated with the military put national security at risk by compromising computer systems/email systems and individuals with security clearances from the DoD compromise their clearance and put themselves and the interests of DoD at' risk of blackmail, bribery, and threats.
(SSN:_, Do.B:_) was identified
by Project as one of these targets. Information he provided to an online payment website
for subscribed child '. websites 1isted an address of __ ~_' .•
A check with the DElDS database revealed no record '0f_
A REDD Report; shows that end date with the Army was 1).
. date with the Army was".~ and his was an enlisted 05 with the: Army (attachment
an address
provided from Choice Point was generated 'and Iists ._ (attachment 2) ..
_ does not have a current Kentucky driver's license,
CLASSIF1QATIO'N:
b(8} b{7}{C)
FeR eFFI61AL YBE eN."¥'
Contact with ICE Bowling Green, Kentucky
office revealed thathe was . ng this LU.~'''U'''''L to the ICE Nashville, Tennessee office
because_ resides in ClarksviUe, Tennessee.
This information is: being forwarded to the Nashville Post of Duty (POD) for further action since Clarksville, Tennessee falls under Nashville POD Area of Response ... Any further questions regarding this report should be directed to the undersignedat telephone number II1II
-
Attachments:
1) REOD'Repert, 1, page
2) National Comprehensive Report, 5 pages
APPR:_
b(6) b(7}(C).
CLASSIFICATION;
''_
INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE DAYTON RESIDENT AGENCY
3055 KETTERING BLVD, #205 DAYTON, OH 45439
(Investigations)
200800 159J-02~NOV -2001-40DY-W 1
02-November-2007
INFORMATION REPORT! REFERRED: On June 25, 2007, the Dayton Resident Agency (RA) received information f~om the Kansas City RA regardinga project that was initiated based upon information provided by the United States Attorney's Office (USAO), Eastern District of Virginia, Alexandria Division that advised the 'Immigration and Customs Enforcement (ICE) ofa national investigation that identified over 5,000 individuals who subscribed to predicated child pornography websites .. As a result of,this information ICIS and the U.S. Department of Justice/Child Exploitation and Obscenity Section designated this operation as Project Flicker.
Asa result 'of Project Flicker and the initiative from the USAO, ICE identified Individuals under Project Flicker associated with the military by either providing their .mil e~ mail addresses, Fleet Post Office (FPO),. or Army Post Office (APO) military zip codes. DClS was requested. to assist in identifying additional Department of Defense (DoD) affiliated individuals and provide investigative assistance. Targets of Operation Project Flicker that are affiliated with the military put national security at risk by compromising' computer systems/email systems and individuals with security clearances fromthe 000 compromise their clearance and 'put themselves and the interests of DoD at risk of blackmail, bribery, and threats.
revealed that he is an enlisted 03, active duty Army"
Bliss, Texas 79916. It provides a home address of_.
and hi's end date
with the Army is
begin date was
C~'-'VJJ..lU"'·JU 3 ).
b(6} b(7){C),
CLASSIFICATION:
FDR QFFICIAL USIi ONLY
A National Comprehensive Report provided from Choke Point was generated and lists
_ at • (attachment 4).
_ does not have a current Kentucky driver's license.
A criminal history was: run for _ which revealed a charge of "wrongful use of
marijuana" by the US ',' at ' Belvoir on February 2" 2005. It 11st_ as being a
.II~_ (attachment 5).
. Auny Criminal Investigation Division (CID), Fort Campbell, Kentucky, Special Agent
__ advised tha_ never resided on-base while stationed at Fort Campbell, Kentucky and that he is currently stationed at Fort Bliss, Texas. em forwarded this mformation to em Fort BUss, Texas.
This information is beingforwarded to the El paso Post of Duty (POD) for further action since Fort Bliss, Texas falls under HI Paso POD Area of Response. Any further questions regarding this report should be directed to the undersigned at telephone number"_
Attachments:
1) Flicker Targets in Kentucky, 1 page
2) DETDS Report, 1 page .3) RED D Report, 1 page
4) National Comprehensive Report, .1 0 pages
5) Criminal History" 5 pages
Prepared by • __ • Dayton RA DISTR: 4QSL!30FO/jOHS!30EP (electronically only)
APPR:_
b(6} b(7){c:;)
CLASS I F.ICJ\'l' ION ;
I
INSPECTOR. GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE SACRAMENTO POST OF DUTY
2800 COTTAGE WAY, SUITE W~1946 SACRAMENTO, CA 95825
(Investigations)
200800 168S-0.5-NOV ~2007-50SM-UO!X (lR) SSN:_ UNK
5- November-2007
INFORMATION REPORT: The DCIS Arlington Resident Agency. referred identifying information for persons with ties to the Department of Defense (000) that are in the DelS Sacramento Post of Duty (POD) area of respcnsibility (AOR) and are suspected of involvement in child pornography. The DCIS Arlington Resident Agency initially received the information from the United States Attorney's Office (USAO). Eastern. District of Virginia. The persons identified are active .. and retired military members, DoD civilians and DoD contractor employees, several of whom have or had Top Secret security clearances and all of whom used
. mil e-mail addresses to register tor access to child pornography websites.
As background, in April 2006, the Immigration and. Customs Enforcement/Cyber Crimes Center/Child Exploitation Section. (ICE/C3fCES) initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection." The investigation revealed that the same organization Was operating, numerous commercial child pornography web sites, In addition, the organization utilized various Pay Pal accounts to process, the payments for access to the member restricted websites, The investigation is being worked jointly with ICE/C3/CES., ICE/RAC1Binningham, the U.S. Postal Inspection Service, the U.S. Department of Justice/Child Exploitation and Obscenity Section, and the USAO for the Northern District of Ala.bama,.ICE has designated this: operation as Project Flicker .. lCE/C3/CES conducted over 60 undercover transactions at the advertising web sites associated with this investigation, The investtgation determined that a specific criminal organization operates. approximately 18 commercial child pornography portal websites which provide access to approximately 18 child pornography member-restricted websites, 'Using a. specific and identifiable payment website known as "iWest," The investigation identified that the criminal organization (I) uses various Pay PaJ accounts to facilitate the customer payments;
(2) uses specific subject identifiers within the Pay Pal accounts to identify purchases into the various member restricted websites; and (3J uses specific administrative e-mail accounts that are used to distribute access to the memberrestricted websites, Project Flicl<~r data was sorted to identify individuals Wh0 used their .mil e-mail address; Fleet Post Office (FPO), or Army Post Office. (APO) military zip codes to register for the Pay Pal service to access the child pornography websites, The suspects' names were queried in Dell, Auto Track and other
b{8) b(7){C)
CLASS.IFICATION:
.F8R. ,8FFUllld: Y6E8NLY
'200800168S-05-NOV -2007-50SM-UOIX (IR)
5-Novetnber-2007 2
SUBJECT was advised of his rights in accordance with Article 31; (UCMJ). SUBJF,CT acknowledged his rights; declined legal counsel and agreed to answer questions. SUBJECT provided the following information in a signed, sworn statement: SUBJECT stated some time in the past he signed up for a pornographic website. SUBJECT did not remember the exact amount he paid for access to the site. SUBJECT stated he received a username and 'password via his HOTMAIL account, SUBJECT logged into the site and began browsing. SUBJECT stated he got to a page containing what appeared to be underage females. SUBJECT stated he immediately left the website and never went back aga~n. SUBJECT signed up using a Pay Pal online cash account. SUBJECT reported the loss €If his credit card number in the past and had unknown charges on the stolen card. SUBJECTreJated one of the charges was for "Video Professor" software which was mailed to his address. SUBJECT checked with the card company and they told hirn there were several other charges. SUBJECT stated he disputed the charges, cancelled the card and was issued a new card. SUBJECT believes he lost the card last year. SUBJECT stated he has never "surfed" for child. pam. SUBJECT has received several emails advertising porn sites but he just deletes them. The site he paid to access had adult women on the first page. On subsequent pages of the site. there were thumbnail images showing females approximately 10 years of age. SUBJECT stated he Jeft the site when he saw the underage females. SUBJECT stated he never looked at the. child porn images. Additionally, SUBJECT stated verbally he looked. at the website for "one or two hours" before noticing the underage females. Agents inquired. into the possibility ofa consent search of his' computer. SUBJECT stated he didn't feel comfortable with anyone looking on his computer. Consent was refused. Due to' SUBJECT currently being on terminalleave awaiting his retirement and 110 substantial evidence found concerning the allegation, no further investigation is warranted. SUBJECT provided investigatorswith a signed, sworn statement,
applicable databases. This investigation was coordinated with the Air Force Office of Special. Investigations, (AFOSI), Travis Air Force Base, ·CA.
In Summary, SUBJECT was identified by PROJECT FLICK.ER, as a possible paying m .. ember-of a website containing Child .. pomo~ Septem ... ber 2. 7., 2007, an interview Of. SUBJECT was conducted by"_~, DCIS, Sacramento POD, Sacramento,
CA. . APOSI Detachment 303, Travis AFB, CA. SUBJECT was advised of his
rights to 31, Uniform Code of Military Justice (UCM1). SUBJECT
acknowledged he understood his rights, declined legal counsel and stated he was willing to answer questions, SUBJECT admitted to paying approximately $97.00 through a Pay P~J account for access to a pornography website, SUBJECT stated he logged on and viewed the site for 1.-2 hours before noticing thumbnail images of females approximately 10 years of age. SUBJECT stated he. immediately left the site and never went back. ICE records indicate SUBJECT only visited the site once. SUBJECT was released to his supervisor with no further investigative steps planned.
b{6} b(7}{C)
CLAS'SIFlCAT.ION: .
I
•
200800168S-05-NOV-~WOT-50SM-UOIX OR)
5-Novembet-2001 3
-
-
Attachments
1. Rights Advisement form, September 27, 2007
2. Signed, Swam Statement of_,_ dated September 27,2007.
Prepared by: .... _; Sacramento Post of Duty
DISTR: 60DC .
AP,PR:_
b(6} b(7}{C)
CLASSIFICATION: