You are on page 1of 97

D,E,PARTMENT OF D'E'FE:NS:E, OFF'ICE DF-I'NS'PEelDA GE'N'ERAL D'EFENII!, CRI'MI'NA,L INVESTI'GATIVE SE,RVIC,E, A~R:LINGTON RESI.

DEN,T ,AiGE'NCY

2,01 .. 12111 :8TR,EET IQU'TH., .SUI'TE 1712:

,ARLINGT:ON, 'VlRG'INIA ,22202-5401 ~

(In vestigaticn 'C!I)'.'"

I "··r·~':' :a" :··~auu· '~ .

. .~ _. "," ..,' . _', - .. :' _._ ....,' - ,'t, '[ .... . ~,

DJ7I'Pi 0/·' "···'R,· "T"" .,' O··'·'·D ""'~,S·····~····'Tl·' r, :G",,:A'··T"-I' .IO~"N

~, ,<... U,"",Y C ,:',",,' ->". I,

10' "0"'1:': "0< -I' 1"·,·· ',"···'·X·,· '.~: 'Z·~ .. , ..... " 'MA·'· .. · . ,". 'y .. ~ .. ': )····00··· .. "",'''-6>''O'J ·'D·:···C····· ,- 'W~""':l' IF:' '.c',

... :. . :".' .' .. "., :.,. :- '.'.' "'. ' .. - .. / ,.:' .. ', .. ' .",-_ .. ": : .

. -. ",' \. " • ~. ,'", ,"': .•• ,.~ .. ' ~"':" "," I "[ • ,,:...:_ _.-.' ••... '[ i_ ..... ,,~~,\i " _.,.,.- ',' i" "

J .. H,' ".', ,;, '2'-"4'''- 2>0 ..... '·'·0::-:···8···

anuary :.::-- ,.". , .... "'~'

1-

nelS Headquarters, National Security Program (03NS) Immigration and Customs Enforcement, Cyber Crimes Center

U~S; Attorney's Office, Eastern District of'Yirginia, Alexandria Division (A . O. Smagala)

I~

11(1)

11(. ).

,

. .

iCc :I ·1t·S··'-:·S··· :1')=:10'; A-"TtO'" N'" I!'

:'.'L..fi\, :~ .. :,,:I I.~ ~ ..... _ I.," t:.·.'·' iii

I FeROFFIGIAL HBE ONL¥

I

I

J

I

Ii. I

!

" ,

I,

2""0"'0:"'1' 011' '9' '9~'X< i- ' 2' "9'" MA' : ,", Y' '''0:'Q'''7' 6' a"D"C" 'W" "'~11F' :

>. " .. ,.,.' ~ •... : ,'.,', ,._.:\_ ,::""".,, •. "I.," "., _~, •• """,_,~,~':,;" ". ,[_ ", ".'

J' 2' "4'- 2"'O'~O"o , anuary ~,(,.";J ."1, -. UJ

N' " 'D'1:J.!, ,I.T·'IVE[', ' •

-~,.',' .. ,.·'I

1 In April 2007 , DClS, Arlington Resident Agency received information from Assistantl .. S. Attorney (AUSA) Gerald Smagala, u.s. Attorney's Office (USAO), Eastern. District of Virginia (BOV A)~ AUSA Smagala provided information concerning a national investigation being conducted by ICE. ICE had identified over .5,000 individuals who subscribed to websites that were known to contain child pornography. ICE designated their operation as PROJECT FLICKER.

2 ·8"'" ,..,.. .. !j, nd ',ii, ,,~:"d' •• Clil· '··d'·:·" uifi :'. d"'· 'd:' , ,' .. p'" . ., .. '·····-·1'·: 'F' "'Ii' -:1, .. ' ..•• ' . "'d''- th ... _ 'D'~' "'D:'/::' "', ' .. ,,' " . :,"'~ ".,' '·"'1- . ' ,···,,··,;11

'~ c 'CVel~L"U In .·IVl UAlS 1" ,en.l I.e "". un ... er. lOJ.ec .. CJ\,e:f use . .. ,) . :elr ~" 0 . '" .' ,g 0 vemm en, , .. e-Il1aJ..

addre ' 'F'}'"'' 'P"" t Offi ('F'P"'O'~") ili' v addre or Arm ,'''','' P t 'O", .. ··ftj·,,'·,,: ·,'AP.-·,· .. O"·· ... ·.')·,· milita .... zaddres t-["

[. ".'.',SS,.·. eet ~O,S '.: mee t, ':',J/, mn tary ,'<. ::,,88, or ... " ~ .. ,y .. 0·5.·.·", ' .. C'C \:"""'/ .1Dll~.j aaoress · ,0

,--, t ,~ ... t"'h' 'hi·"'ld' " "".' mh b' ·,··-'t . A"'U"'S""A' 'S"" ala .". " · .. ,t d[' tha t' 'D":C-:~'IS'~'" sist ! th ,,'

regis er ror t .. e c ': ',,~, 'po:mograp ;'Y' we·,"SlCS,·\,.'.-::,·, ',".:ma.:g··.'.a req.uc[s:e ~_ '. ,,>. ,",:. "~I, as,'SIS ~ 10'·e

identification of individuals affiliated with 1beDoD. Initiation of'ajoint project into this matter

· .... [ .. ' d ld h .. -DV" de' 'IC"E' A D 'D 'b:t

was mitiatec to provide snort 'term assistance to E .. > .': A ana .,.::, ::,,:~ ·,·"s,:o'·~, su'~crects· were

identified, information was provided to the DCIS office within the appropriate area of

ibili f .. d ed · C rdi .. d thro gil" th !II t

respo msn 1 tty ',,' or lac" < "t'I' on .',. ee emer 'a·,'p·'· propn a···· re "0· o ,',<", natio . D' was m';:8"':'C': '~. '. 'U~'" "0, ·U"i·t '. ""C' projec

~~ .. "~'" "' , .;.~ '&~. " ",' _ .. 1 ••• ,",-', ,.'_'.~ •• ,~ •• ' _ ' •• :_.J' ',-["][', ,',!ftJ .':': .',., ~~.,_~ I- •. ~.~:~ •• , •• _ ,:, .__!l" , ,_, ••. ,'L'"."_,. ',',.., "'~ ,.,,_/

. ,._. [' J'J - ' •• ' [._

.. ' .,·!th' ~ th 'e'" 'ap.,~:, ere 'p' riat M"-':' ilitary I': ., C" imlnal ' I" ',' stig 'l'-'ti'll .: ' '0"" "'\r' gam izati '''''DS''''

WI, " ,.,.',: ,'. P4' ~ .. """ -c .,'/, '. '" .,·n" ,:.,':, " .. nve:l~ll, .'_,: ve,~: ",:',.;~ .. 0'.

-

3 0, ,'··,b, ..... in ed 8<" "CO' ',' 'm'''' 'po slete l 1!Ii! I:! t', iden ,': tifvin .g,'" ali: I :1,' U, ',S;~' b '8,', sed s ':u··· .: ibieets fro::', om the

, ·,LaI ." . " .. ' ' .··IAW· '.' a,:,·" "', ,. . ,.I.....I.,I· , .. ,:. e". , , "~ J'P" .. , ," .. ill! I

ICE Cy · . .. me Center. The list contained the name, e .. mailaddress, telephone number, and

postal address of each subject 'Queries of subjects were conducted through Antotrack, the Joint Personnel Ac:ljudication System, the Defense Central Index of Investigations, and the DoD Employee Interactive Data System to obtain additional identifyin'g information and establish a DoD nexus. In total, 20 states and D.,C·~ were vetted,

4 A':··s;"·, a resul t 0"" "f': the ,;I .. ~~L.t'\II[~C"" qu eries, 2~"64'-'-':'" 1-0" [d'" ivid ual 'S: affiliated with Do·::D·:·· were identified

. . ... ' ,'-''iI. ~'<.', i ua~,', "I!Iw' ", ".:. - ' .' '.",[ "..,,~, ,Q.~ <. .'. .' ,."., '. ,- ... '..... . .'"

.'r.. ""[,1' ':'" d' ;I., 3~'9'" .• , : d ','!It' ··:"'d" ual . :W1' ,.--··thi·~~ ~ ,',,-'" t 'h"'" Eastern D'· ,,...:·,t'· of ·V~' ".,:.Ifj .. "~" '0' "f~·th,·,"', ',",.,',' '. id ,',,' "t"·fj' ed '9"·'

Inc .urnS ,:,,·10, lVl",. ,S' .,- .. ,n ... ' e ,'QDwnl :.lSU1C 0"",": Ir81m·a~: .. _, Dse 1.·, .en".11 ~::, ... '

ind ividuals possessed ~a Top Secret Sen . sitive Compartmented 'I' nform at ion security' clearance 13

,<11.,.".,' ",~'UW ",""".~'\'",. '_ ',.,. ,". '.',."',."' .. <'.:'."' ..... _'." '.' .", .. ,".".' '~,.' "",:,~, ." '0",', - ,".', ,""'" '", ",. """",~,', ;-', '."">:', ...•

, . 'sed' .' T .... '. 'S' ,"," '.- t ", .',' '",t·· .- :1-, ',' '. " .', 8""""'" ,,,., .. ' " "do" .', 'N"··,[ 'A-'" T' '0" ·S··, " " et ',. ", .. " " i:ty, . 'I' , .' .' ... .A2-·:

posses" -: a .J op 'ecre,' seC:~l,y CLearanee~, possesse,::, a·':·,..· ,.·eer,.' :'. secur.l :-, cearance', ~, .

possessed 8' Secre 't'''·, secun ,"t"y" clear ranee an" 'd' 4' posses se 'd' an' interi im Secret se cun .,.,ty' -,,', clear ance

",·,~".i:L·,,<:~· .", >"~' 'I,.:.' :,: ",: ': ',' .,.':." :': , '::, ,~' ", ': :~. ':~ :y> :" ',: :, : ,:" i.l~.." :" ,::' """ ".', '.~ '; .......... ,'.~ •

. " [' : .

5 Th ubi iii c.: rmati' "n:",l D'" D'" '1 di lid d b 1 ti d

~ '. _. 'e s"~ect 'lnlO:' .. :' ,~~:' .on cottWunl.ng ,'0 ',: query resu ts were~:';"lVl,: e .. ;y ,Dca' on an,'·,,,

,4;. ·'-d"""'d' t[', " ·th,:,',···,··, .. ,' .-.' + l'P'C"~E' ,·"',d·:', :D\C""'.'I·S::-' "'_'''''ffi'-': ., .. ~: .'. [,····ti··"·o ..

(onvar <e·:~o :.' e ~pp,mpna.Le:.; '. an,. '>." <'<~. 0: ce Lor ac ·on~,

6. To date, 31 spin-off cases have been initiated and 52 subjects have been titled:

20070'1 274·Z -

J" 20'" '0'.·7:'·0'.', '}·2,'··7: 7····C···, ~'

.' '. .: :.~' -. ~ _. ~ . . ",

• 200701301F- Sweeney); I>aniel Joseph

• 200'701 340S _.

I 200701341 T - Campbell, Cameron MOrr1sOJ1

• 20070 1,40.2'H ,_ I{[artes, 'Thomas Edward

2,007'014031 _,

A-")'

. 1

b(B) b(7)(C)

CLASS'IFICATlON'

J. ,. .. '2':'4'- '2"0' ···'0····'8··' anuary , .... , ... , .... ,~,,>/,

•. : 20'······O'·'··7:'·O~_-'JI4/,·6···'·'3'::Q·':· - Jones Paul Bum 1:·:--:]'1

' ,: '. / ' .', .... '. " ,'. / .. .i ".' .' .. " . Jj' , '. .,";":, ", I .• ,." .~ J ,'. ", . . '.' '" "

•"'. 20"""O':"'7~·,·'-'O""""l' c IIR'

, .'._.[\ _. "VI':' , ~.:' _l ......

2' '0: "'0"7:' . ·'0··'····· '15:'· I' '2'S"

• "'/<'" ,.-_", ,/,: -

.• -.... 200"·'·····.- 7:0"'1" 5·_-·'·1·· 6--·"W"'·

,,',.', .. '. I" ,',,' ..._.

I ~ ," . ......' . I, . _ • ... _ ' . _ . ._' _"

,. 2,QO'701,S·17X _, .1 2,~'"-'O'" ·0:'··,7',·_-··0:'·, 1 S·,~"S···'····'·J\H·'- ,_,

I ... '_. ~: ", r, " "" ': ., I, . ~ . ~ ",.".. . " ,:' .. ,

•' '2"'·OO""'·.7·'/.O~'·1- S·:':'S:S···::'M· -_-'.-.,,' - 'Op' '"Qf .. u4-;'O·· m 'F·'·~l-"l~'~k·'·"·r·'

, . , ,_ .. ',,: <_. _. '--," I . I ...... '/, ~'.:, '," :,' '. '_".' .' ~·...:W"~ '.'~ .. ' ... ,_ ,", .... , ·w. i •. ~'j.;

• 200701,567V' - Operation Flicker

• 200701S7IZ -Fitzpatrick, 'Leland Chace .1 ,2100701,5'96 Y _,

- 200701606N - Operation Flicker ',2,007'0 1619,A - •. 2007016208 [_1 Mullen, Shawn B~. • ,2007·016·2,3'~E. -, Lindimore .. ,S,haile, Brewster

.f#'

[20,070 165:31,I ,_

• 20,070'] 6,65'U ,_

- 200701661W - Operation Flicker-50ES Targets

_. 200701690T ,_

•. _I 2'00'701691 U '_, ~. 200701692V' ,_, .1 200701'7'5:6'M:,~,

• 200701 765V - Project Flicker .. SDOB (Western DiVisiott)-WDICY-EDKY

• 200800031.0 - Demoulin, Stanley P.

• 200800080D - Operation. Flicker

'l, Six Information oL.·""'~ ....... ;b;

200' .: " .. ~ "8"0""" ·0·····'···]·- 5:: 9'··· J-'

" ", •• ~ •••• ~-: ••• ,. :', [ J •• ~.:~~" •• _. _,

2', .' 0"" :0".-,"'7' '"0'':''' '1 '5" ". '3: 9"'~"'T-- :",

....... ..:". '. '~:", .... ~. :. ~-'

", " ..•.. ~." .. \. : ..: ~ ".' . "', J. ", ... t.. . /' _ ~

9. Due to the short term nature of this project and the need 10 focus more resources on other

'D···C···'····"I,"S':- . it' '''.' C'" S"ti-'·~·,DQ-.·l·V~- '.::II p' __ "n""o' rities thi !liD P'" 'r"a~'ie""'f'Yt' I"~" ""10'--...1 g~ "tc .... ,~SL.o4;; . ...I" A..-·· .. l'l·· C'·brdAS· g' 'dinara' '-'00"·"-' fr:····" o""m' i thl "~ .

. ,.), '. IDV, , ";I:~i"~L, v ~ ,.:_' :,<,~' u_'·:'·" '-',:, '0 ' c'~W:,~ •. ·'al ~.:,5£7Ll :~, 11I1l:: IlCU.~ ,',' .! ,',~":>U&I~.,', ,;' , , .: ,~_' ':, ,,:. ,iI·

iii' , ·11 b ,ft__" - I''''

project WI·, .. "C pursued "to cone. usion.

.11(1)

b(7)(j' C)

.. ' '. !. " " ",",

. ~). ,

_'_ '. " • H. " .. "",, .

C~I ASS' 'IF--I'C"A' "11';0'1.1

,LJ"\',; . .' _' >:. L!,' .:1';

" - F8~R~'B'FPIBlAL:, H,IEGNLi,¥ I:IcW ENFeASEIIE'NJ liNII~'IJI&-

Ny. ~?EV 0/:S+«:AVn..V&VY~<0~<, qLWS'" .. "'J

• _ • • _. .> .. ".... 10... ....

,I

U.S. DEPARTMENT OF DEFENSE OFFrCE,'~F INSPECTOR GENERAl, DEFENSE CRiMINAL INVESTIGATIVE SER,V1C.E Mid-Atlantic field Office- Arlington Resident Agency 201 12th Street South, Suite 712

Arlington, Virginia 22202~5408

(Investigations )

200701239Q .. 07-JUN-2007-60DC-Wl/R (IR)

J nne 6~, 2007

S'SN:_

INFORMATION RE,PORT/REFERRED: On May 29, 2007, the Defense Criminal Investigative 'Service (DeIS), Mid-Atlantic Field Office (MAFO), initiated a project based an information provided by Assistant United States Attorney (AUSA) Gerald Smagala, United States Attorney's Office (USAO), EasternDistrict of Virginia; Alexandria Division (DeIS Case Control Number 200701199X). AUSA Smagala advised that the Imruigration and Customs Enforcement (ICE) is conducting a national investigation that has identified over 5,000 individuals who subscribed to predicated child pornography websites.

Among the 5,000' names ICE identified under 'Operation Flicker, several individuals used their .mil e-mail address; Fleet Post Office (FPO), or Army Post Office (APO) military zip codes. AUSA Smagala requested that the DelS assist in identifying any additional Department of Defense (000) affiliated individuals and provide any investigative assistance. Additional background information 011 Operation Flicker is included as Attachment 1.

of special interest because, according to DEIPS,

The RA spoke with ICE Special Agent (SA)

briefed her on efforts on Operation

DelS can can be reached by '"~''''WllVl'''''

.or

in Tampa, Florida and welcomed any assistance _, extension

Given the uature of the allegations, the pCi~ential for possibjlity ofharm tQ the children, and the subject's. location in the Tampaarea, the MAFOjs referring this ease to the DeIS, Tampa Bay Resident Agency, for review and any action deemed appropriate.

b(6} b(7}{C)

CLAS'SlHCAHON:

OPHeIM: USE OHLY

20070 1239Q-07-JUN-2007-600C- WlIR ([R)

The investigative databases containedin National Crime Information Center (NCle), Defense Clearance and Investigations Index (DeII), Treasury Enforcement Communications System (TEes) were queried for relevant information concerning the subject. No criminal information was found in NCrC Of TEGS. However, there is a record within DClL The Dell results are included as Attachment 3.

Attac lunents·:.

1. Project Fliekcr Summary

2. DEIDSiJP AS Results

3. DeI! Results

Prepared by Special Agent rHSTR: 03N

Mid-Atlantic Field Office APPR:_ . SAC DC •• _)

2

b(8) b(7XC)

CLASSIFICATION:

efFICfAL USE ON&¥

I

INSPECTOR GENERAL DEPARTMF:NT OF DEFENSE DEFENSE CRIM.INAL LNVESTJGA TIVE SERVICE TAMPA RESIDENT AGENCY

400 North Tampa Street, Suite 1130

Tampa, Florida 33602-4707

(lnvesrl gations)

200701277C-15~JUN~2007-20TB-.wlru

June 5j 2008

'-

nl:sTRIBUTION:

National Security program Manager Southeast FieldOffice

Mid--Atlantic Field Office

Immigration and Customs Enforcement-Tampa

b(6} b(7}{C)

C~SS:IF.IC:ATION·:'

feR 8FFlelWL tJ9E eMU"

I

20()t701277C-15-JUN-2007.,20TB·WlIU

NARRATIVE:

1. On June 7, 2007, the Reporting Agent eRA) received an Information Report (JR») Case Control Number (CeN) 200701239Q, from the Defense Criminal Investigative Service (DeIS). Mid-Atlantic Field Office (MAFO). The IR advised that on May 29" 2007, ncrs MAFO initiated a project titled Operation Flicker (CeN 200701199X), based on information provided by Assistant U.S. Attorney CAUSA) Gerald Smagala, Eastern District of V irgini a, Alexandria Division, AUSA Srnagala advised that the Immigration and Customs Enforcement (lCE) was conducting a national Investigation that identified over 5,000 individuals who subscribed to predicated child pornography websites,

2. Among the 5,000 names, ICE identified several individuals who used their .mil email. address and/or their Fleet Post Office or Army Post Office military zip code. AUSA Srna gala requested that DCIS assist in identifying any additional Department of Defense (D@D) affiliated individuals and provide investigative assistance.

3. The DClS MAFO utilized information contained within the, DoD Employee Interactive

Data System (DElOS) and the Joint Personnel Adjudication S . in order to identify DoD

affiliated individuals. those Identified was a Retired U.S .

. Captain (0-6),

4. The DCIS MAFO spoke-with ICE Special Agent ( briefed her on the DCIS joint efforts with Operation Flicker. to exploitation cases, requested investigative, assistance from

Tampa, PL, and , who Was. assigned

5. On June 18, 2007, the RA telephonically contacted to offer nClS

assistance with the investigation. During the conversation, clarified information

previously received from the IR and subsequently was ' in case initiation._

did not use a .mil e-mail addressand/or a Fleet Post Office or Army Post Office

while sub SCrib_.:iiiIiIIII __ bsite s,

6. On September 19,2007 the RA conducted a DEIDS check to verify _ was still

residing at The DElDS check revealed on st

27,2007

7. On September 27, 2007, the RA coordinated with

Investigative Service (NelS), Resident Y

execution of a search warrant

b(S) b(.7}{C)

A-l

CLASSIFICATION:

FeR e.F,Fl8hfcl: liSE SNb¥

I

200701277C~ 15~JUN~2007-20TB-Wl -u

June 5,2008

... ' ..

Office and the local Japanese _residenQe.

_ agreed to coordinate with the ICE, Attache )pT'."'n'n~f··l'ltin order to obtain a search warrant for

8. On October 15, 2007, the NelS executed a search warrant on

located in During the execution of the search n""',.,.~,n

ave th computer .' to access the Internet to

tty Tower Computer Millennia, serial number 2422181-0001; was residence.

10. On January 14,2008, provided the RA a copy of two computer forensic

exams, The first ferensic exam was laptop computer, which was seized

during the execution of the search, located in, Japan. The second

forensic exam was performed computer which was seized during

the execution of the search warrant on residence in _II The

examination ofboth computers did not re m ' of any child pornographic image

files. or movie files, However, the examination ofthe desktop computer indicated that a user of the computer had regularly used one or more privacy appfioations which wiped most of the history of Intemet websites visited and any incriminating files that may have been viewed. Despite using the privacy applications, the examination did find traces that a USer had accessed questionable Internet sites that appeared to be child pornographic in nature.

11. Due 10 the fact that no child pornographic images were found on the computers, this' investigation is closed with the submission of this report. There were no fraud vulnerabilities identified during thecourse of this investigation.

A-2

b(6} b(7}{C).

CLASSIFICATION:

This docume , of the, Department 'of 0 r enerat and Is on

loan to your agency. Contents m '. to any Party under Investigation nor

may this nocurne . outside the recervrn the specific prror

: ,. 0 ,~he DE.!p.uty Jnsl1e.ct~r t;'if;lneralfor Invo:stigaMlls. -

""51'1111.

FOR 9PFIGIA .. 1.t&E' QNIJ'I

200701277C-15-JUN~2007~20TH~Wl/l)

June 5 :2:008

.IDENTITY OF .sUBJE.CT:'

IDENTIFYING DATA

Employment/Occupation Telephone Number Drivers License Number Education

Name Alias.

Social Security Number Date/Place of Birth Rape

Sex

Height

Wdght

Hair

Eyes

Residence

Preparedby_.

B-1

APPR_

b(6} b(7){C)

. CLIlSSIFICATION:

I

DEPARTMENT OF DE.FENSE OFFICE OF INSPECTOR GENERAL .OEFEN·SE CRIMINAL INVI;STIGATIVE SERVICE ARLINGTON RESIDENT AGENCY' 201 12t1i STREET SOUTH., SUITE 712 ARLINGTON, VIRGINIA 22202.5408

( Investigations)

REPORT OF INVESTIGATION

20.070 1340S-26.,JUN., 2007 -60DC- W lID

February .27 ~ 2008

DISTRIBUTION:

DelS Headquarters, National Security Program (03NS) Immigration and Customs Enforcement, SAC Washington, D~C. U.S. Army Criminal Investigation Command 9020d Military

b(8} D(7){C)

CLAS$IF1CATION:

. FOR OFFISIAL USE ONl::¥ LAW E.NFORGEMENl' 'SENSll~

200701 340S-26-JUN-2007-fiiODC-Wl!D

February 2:7,2008

NARRATIVE: .

1. This case was initiated. based on information derived from DCIS Project: Operation

Flicker (Case Control Number 20070 1199X). As background, ICE initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection." The investigation revealed "Home Collection" was operating numerous commercial child pornography websites, In addition, the organization utilized various Payl'al accounts to process the payments for access to the member restricted websites,

2. This. criminal organization utilized a specific and identifiable payment website known as

"i West," The information developed during thecourse of the investigation identified thatjhe organization (1) used various Payl'al accounts to facilitate the customer payments; (2) used specific subject identifiers within the PayPal accounts to identity purchases into the various member restricted websites; and (3) used specificadministrative e-mail accounts that were used to distribute access to the member restricted websites,

3. utilized information contained within the 000 Employee

Interactive Joint Personnel Adjudication Systems (JPAS) to identify DoD

personnel and contract employees who joined the member restricted sites. Among those

identified Lieutenant Colonel (0-5), with the U.S. Army Reserve.

(VSAR). was on active duty, A query of JPAS revealed he wag. a.

_:.

4, On June 27,2007, agents from the nelS, ICE, and the Fairfax County Police Department

iIIIIii_arCh warrant on _s residence located

5. Concurrent to the execution of the search ICE and.

FCPD, attempted to interview ption to

commerc . . pornography websites, However, invoked his right to legal counsel

and the interview was term..i~ left his ... . during the execution of the search

warrant. Media 'seized fro~ residence was sent to the Defense Computer Forensics Laboratory (nCFL) for analysis.

7.. The DCFL's analysis of_ media did not recover anychild pornography images

(Exhibit 1). However, the DCFL recovered 25 documents and one movie that was classified

A-l

b(5} b(1){C)

CLASSIFICATION:

. FOR OFFICIAL USE 8NL'{ LA\."ENFORCEMENT SENSITIV£

I

20.070 13405- 26~JUN -2007 -'60DC - WIlD

February 27 ~ 2008

secret. The classified documents were recovered from compact discs that were seized from _ residence,

8. On September 17? 2007, two additional search warrants were obtained; a warrant for

_ work computer and a warrant for_ personal email.

9, A review of_. personal email did not recover any evidence related to the receipt of

child .... . Before theanalysis of_ computer could be performed, AUSA

. . declined to criminally prosecute _ for violations relatingto possession

or receipt. child pornography, due to insufficient evidence.

10. The matter relating-to the mishandling of classified information will be referred to the

US AClDC for aetion(s.~ deemed: necessary. No fraud vulnerabilities were identified . .oelS will take no further criminal, civil, or administrative actions on this matter. No fraud vulnerabilities were identified. This case is dosed as "declined,"

A-2

b(S} b(7){C)

CLASSIFICATION:

FOR OFFl61AL l:ISE ONLY· LNII E.NF9.R6EMENT SENSITI-JE .

I

200701340S~26-JUN~2007~60DC~Wl/TIJ

February 27,20.0'8

,IDENTITY OF 'SUBJECTS:

Name Alias,

Social Security Number Date/PIace of Birth

Race

Sex

Height

Weight

Hair

Eyes

Residence Employment/Oceupation Telephone Number nriver's License Number

and Issuing State Education

feR 9rf;161AL USE ONLY LNlJ ENfORGEMENT SENSllllti .'

b(S} b(7){C)

CLASSIFICATIQN:.

I

200701340S-26-JUN-2007-60DC- WllD

February 27.2008

EXHIBIT.:

1 , ncn, nig:ital F orensic Analysis Report

Prepared by Special, Agent

APPR:_

Arlington Resident Agency

C-l

b(B) b(7}{C)

CLASSIFICATION:

FOR: OFFISIAL \:lSI! QNbY LAW ENFORCEMENT '5&NiR'IUE

I

DEPARTMENT OF DEFENSE OFFICE OF INSPECTOR GENERAL DEFENSE CRIMINAL INVESTIGATIVE. SERVlCE ARLINGiON RES1DENT AGENCY

201 12\!1 STREET SOUTfH, SUIT,E 71.2. ARLINGTON .• VIRGINIA 22202.-5408

200701402H-09-JUL-2007-60DC- WlIF

February 25,2008

(Investigations)

REPORT OF INVESTIGATION

KARTES; THOMAS EDWARD

DISTRIBUTION:

nels Headquarters, National Security Program (03NS)

Immigration and Customs Enforcement, SAC Washington, D.C. __

b(6} b(7}{C)

FOR ernslAL ld8E ONLy lM! ENFQRCEMIiN:r iiN~I:rllJl!

CLASSIFICATION:

I

20070 1402H-09-JUL-2007 -60DC- WI/F

February 25, 2008

NARRATIVE:

1. This case was initiated based on information derived from nelS Project: Uper:ation

Flicker (Case Control Number 2'0070 I I 99X). As background, ICE initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection." The investigation revealed "Home Collection" was operating numerous comrrrercial ehild pornography websites, In addition, the organization utilized various PayPaL accounts to process the payments fer access to the member restricted websites.

2. This criminal organization utilized a specific and identifiable payment website known as

"iWest." The information developed during the course of the investigation identified that the organization (1) used various PayPal accounts to facilitate thecustomer payments; (2) used specific subject identifiers within the PayPal accounts to identify purchases into' the various member restricted websites; and (3) used specific administrative e-mail accounts that were. used,

to-distribute access to the member restricted websltes, .

.-

Interactive Data System ,) and the Joint Personnel Adjudication Systems (JPAS) to

identify DoD employees who subscribed to. the websites, Among those identified was Thomas Edward Kartes, Major (O-4), with the U.S. Army A query of JPAS revealed Kartes wason active,

_ .. -

utilized information contained within the DoD Employee

4. On July .11,,2007, agents from the DCIS, ICE, and the Fairfax:

executed a search warranten Kartes's residence Iocated

5, Concurrent to the execution of the search warrant, ICE and FGPD

_ conducted a non-custodial interview of Kartes regarding his

subscription to commercial child pornography websites, Kartes admitted to the subscribing to commercial child pornography sites and possessing child pornography images on his computers. Based on his admissions, Kartes was arrested and charged. with violation of Title 18, U.S. Code, Section 2252A, attempted receipt of child pornography,

6. On August 29, 2007, Kartes pled guilty to a single count of attempted receipt of child

pornography, a violation of Title 18, U.S, Code, Section 2252A.

7. On December 19,2007, Kartes was sentenced to 60 months, incarceration, 120 months

supervisedrelease, $3,000 fine and a $100 special assessment, for the, attempted receipt of child pornography, a violation of Title 18, U.S. Code" Section 2252A.

8. No fraud vulnerabilities were discovered during the course of this investigation. nelS

will take no further criminal, civil, OT admialsrrative 'actions on this matter. This case is closed as "finished."

A-l

b(6} b(7)(C)

CUISSIFICATION

reR8rFlCIAll::lSE ONLY' 'LNN ENFOR6EMEN'f 'SEN'SITIJ.fE

I

" t

20070 1402H-09-JUL.:2007-60DC-W L1F

February 2S,:WOS,

,IDENTITY OF'SUBJECTS:

Name Alias

Social Security Number Date/l'laee of Birth

Race

Sex

Height

Weight

Hair

Eyes

Residence Employraent/Occupation Telephone Number Driver's License Number

and Issuing State Education

Kartes, Thomas Edward None

-

Prepared by Special Agent

Arlington Resident Agency APPR: _

13-1

b(6). b{7){C)

'FeR OFFl6tAL weE ONLY LN.V ,ENFORSEMENT SENSI'fIVE

CLASSIFIC:ATION:

I

200701511R:-24~ruL-2007-10PB-ze/Z

INSPECTOR GENERAL DEPARTMENT OF DEFENSE

DEFENSE CRIMINAL INVESTIGATIV.E SERVICE PITTSBURGH RESIDENT AGENCY

1000 LIBERTY AVE, STE 1310 PITTSBURGH, PA 15222-4004

(In v cstiga rio DS)

REP8RT OF INVESTIGATiON

20070151 1 R-24-JUL- 2007 ~ 1 OPB- ZO/Z

DISTRIBUTION:

nels HQ - 03S0 Northeast Field Office DClS~ lOPB

ICE - Pittsburgh

CLASSIF1CA Tl0N:

feR: 8FFl6hfd: Y6E9NL,¥

April 8~ 2010

b(6) b(7){C)

20(}70 1511 R -24-JUL~007 -l'OPB-ZO/Z NARRATIVE

1. On July 11,2,007, the Reporting Agent received a lead referral from Special Agent. Del'S Mid-Atlantic Field Office, regarding the Immigration and Customs Enforcement (ICE) initiated Operation Flicker, Operation Flicker is a nationwide

investigation that has identified over 5,000 individuals who have subscribed to predicated child pornography websites, A listing was provided detailing individuals residing in the Western District of Pennsylvania who are employed by the Department of Defense and/or u.s. Military and have subscribed to websites that contain child pornographic images or other material that exploit children via the internet.

2. Among the 5,000 names ICE identified, several individuals used their .mil e-mail

address". Fleet Post Office or Army Post Office military zip codes. DoD databases were queried, ,!O id~ntif~ individuals that ma,Y b~session of ch.ild pomogtaph~c ma~erial.

One subjectidentified was 1S currently enlisted m the

Marine Corps Reserve as a Corporal (Pay rating/grade E-4, Enlisted). Unit ,'11 ,pnT"Hf1

data was not available. Also to DElOS and REDI') databases',

3. ~ coordinated with ~._, Supervisor, ICE Pittsburgh, and '~ed that he would assign an ICE agent to the case and agreed to work jointly with DClS. Based upon previously established protocols, ICE will be the lead .investigative agency f0T this matter and will prepare the Report ofInvestigation, Based on the agreement, the Reporting Agent initiated the case on July 24, 2007 (Exhibit 1).

4. On August 9, 2007, Reporting Agent received photo 1D and. driver's license information o~.

5. On January 14;.200 files and records provided on

, requested and later received military personnel Reporting Agent reviewed military personnel files was unable to determine'_ global location, let ocation during the time period when he purchased access to the. pornography websites, Additionally, records did not indicate that a laptop computer and/or cell phone was issued to_:

6. From discussion with Special Agent_, NelS along with personal experience. as a Naval Officer" Reporting Agent is aware that multiple computers and cell phones are, accessible by enlisted personnel whether onboard a ship or shore installation. Further discussion with _ former Computer Crimes Coordinator and former RAC, led to the decision to dose the case. Case closure was based upon the lack QJ any concrete evidence and the lack of probable cause that_ may have downloaded photos and to which, if any, computer was utilized for such purpose, Further, the location of such computer and establishing that_ alone used such computer was unlikely to be determined, Finally, due to the fact that this type of case is not a DCIS priority, case

b(8} b(7}{C)

200701511R-2f'1.-JUL-4007-,lOPB,.ZOfZ

closure is the best use of current resourcesand best course of action for the DCIS Pittsburgh RA.

7. Based upon the above, it is recommended that matter be closed.

CLASS1FlcATION:

FOR OFFICIAL US, ON.LV

I

2007015 I 1 R -24-JUL-2007 -1 GPB-ZO/Z IDENTITY OF SUBJECTS

Name:

Alias;

Socia:l Security Number; Date/Place of Birth:

Ra:c€~ Sex:

Height Weight:

Hair:

Eyes:

Residence:

Emplcyment/Occupatlon:

Telephone No:

Drivers, License Numbcs'State:

Edaeation:

IDENTIFYING DATA

b(8} tl(7){C)

CLArSSIFICAT10N:

FeR .8'FFlBIAk Y6E BNkV,

I

20070.1511R-24-JUL-2007-10PB-ZO/Z ExHIBJ'fS

1. DClS Form 1; Case lnitiation, July 24, 2007

2. DCrS Letter to HQ USMC, Personnel Management Division, January 14, 2008

3. nCIS Form I; Receipt of_ Personnel File, January 18, 2008

b(8} b(7}fC)

.c LASSI FICA 1ION~

FaR erFIGIAIa W&EgN~

I

;J007()1512S-24~JUL-2007 -1 OSY-WlIF

09-MA Y -2'008

INSPECTOR GENERAL DEPARTMENT OF DEFENSE

DEFENSE CRIMINAL INVESTIGAT'IVE SERVICE SYRACUSE 'POST OF DUTY

441 s. SAUNA ST,STE 602 SYRACUSE', NY 132'02-2400

(Investigations)

REPORTOF INVESTIGATION

DISTRIBUTION

Headquarters, Investigative Operations Directorate Northeast Field Office

Pittsburgh Resident Agency

b(8} b(7){C)

CLASSIFICATION;

I

20070 1512S-24-JUL-2007 -1 08 Y - zo

May 9, 2008

NARRATIVE

1. On July 11, 2007, the reporting agent received a lead referral from Special Agent • . DCrs. Mid-Atlantic Field Office regarding the Immigration and Customs rrrorcernent . (rCE) initiated Operation Flicker, Operation. Flicker is a nationwide investigation that has 'identified over 5,000 individuals that have subscribed to predicated

child pornography websites. • sent a list of indi viduals in New York

State that are employed by the Department Defense/U .S., Military, that have subscribed to websites that contain child pornographic images or other material that exploit children via the internet.

2. 'On May 17, 2007, • regarding Operation information:

attended a briefing at ICE, Fairfax, Virginia briefing included the following background

3. In April 2006, the ICE/Cyber Crimes Center/Child Exploitation Section (ICE/C3!CES) initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection.'; The investigation has revealed that the same organization is operating numerous commercial child pornography websites, to. addition, the organization utilizes various Pay Pal accounts to process the payments for. access to the member restricted areas of these websites. The investigation is being workedjointly with ICE/C3/CES, ICE/RAC/Binningham, the U.S. Postal Inspection Service, the U.S. Department of Justice/Child Exploitation and Obscenity Section, and the USAO for the Northern District of Alabama. ICE has designated this operation as PROJECT FLICKER,

4. ICE/C3JCES has conducted over 60 undercover transactions at the advertising websites associated with this investigation, The investigation has identified that a specific criminal organization is operating approximately 18 different commercial child pornography advertising websites which provide access to approximately 1 8 child pornography member restricted websites, This criminal organization has utilized a specific and identifiable payment website known as "iWest." The information developed during the course of the investigation has identified that the organization (1) uses various Pay Pal accounts to facilitate the. customer payments; (2) uses specific subject identifiers within the Pay Pal accounts to i~entify purchases into the various member restricted websites; and (3) uses specific administrative e-mail accounts that are used to distribute access to the member restricted websites,

5. Among the 5,000 names ICE identified under Project Flicker, several individuals used their .mil e-mail address, Fleet Post Office (FrO), or Army Post Office (APO) military

zip codes. advised the U.S. Attorney's Office and ICE that the DC IS

will assist in any additional Department of Defense (DoD) affiliated

individuals and provide any investigative assistance.

A~2

b(6) b(.7}{C)

CLASSIFICATION:

._1!!:M8

ui\1ent is the pJ;.qpe,t·y.of the Depal:t.rnent of DefEnse 'In.

General an ~. to your "gE_nCy, Con t, e o.iscloseq t

any patti. una",·J; inv'i''?tlga ... J.? dq(;ume.ht. h.e Oi·st.rihuted

·out:s:ide t.h . ager.<fy w:itJwut t: . .. .rior authorization O

t _ _ss~·stant Inspector General for I.l1ve'stigat,ions.

6J!'PI€11ltl5 eBB 9NY

I

200701 5 I2S-24-JUL-2007-t OSY -zo

May 9, 20.08

6. conducted queried DoD databases to identify individuals that may be in d pornographic material or access, 'and has forwarded the results of his

resnective neTS office for consideration for possible DCIS case initiations. attached a spreadsheet for subjects of Operation Flicker in the state of

ew a DoD affiliation. One subject identified on the spreadsheet includes

an individual identified as is a retired U.S. Army, Army

National Guard Staff Sergeant (E-6).

7.

8.

10. Upon review 0 f the spreadsheet sent by _, the reporting agent determined that ~ made four payments utilizing PayPal to the restricted access wehsites, The payments were for $79.95 each, and occurred on the following dates: November 7,,2006, November 21,2007 (2 transactions), and December 16" 2006., The "trans.Item Title" was either- listed as an invoice number or for "TV~2 collection Xl Days access," (Agent Note: this is the subject line identifier which indicates which member restricted site a specific customer purchased, In the Project Flicker Overview report, it stated that in November 2006, the criminal organization dropped the subject line identifiers, and began using Invoice numbers, The ICE agent stated that the Pay Pal accounts still identify the specific member restricted sites an individual purchased).

A~3

9. The reporting agent contacted Special Agent ~_ ICE Alexandria Bay, NY regarding Operation Flicker, _ subsequently forwarded the reporting ageat a spreadsheet that identifies all New York subjects of Operation Flicker, and pertinent information regarding subscriber information related to the child exploitation websites, _ advised that he would be reviewing the list of subjects for possible investigation. The reporting agent advised that the DCIS wouJd review the list) and initiate an investigation of DoD related personnel in the Syracuse Post of Duty area of responsibility. _ advised that another' ICE agent would be assigned to specific investigation, but he would assist in the computer forensicspart of the cases.

b(6} b(7}{C)

CLASSIFICATION :'

I

2007015128~24-JUL-.2007-1 OSY -ZQ

11. This investigation was anticipated to be conducted jointly with Immigration and Customs Enforcement, Massena, NY. As lCE was determined to be the lead agency, and the fact that there was only a loose ,affi'Iiation between the subject and the DoD, this investigatinn was deferred to ICE Massena for any action they deemed appropriate.

12. This investigation is closed.

A-4

CLASSIFICATION:

clliscL0sed t

I

IDENTITY OF SUBJECTS

Name ALias

Social Security Number Date of Birth

Sex

Race

Height

Weight

Byes

Hair

Residence

-

peR 8F,F,16IAL YSE 8NI=¥

I

b(S} b(7}(C)

2.0Q70 1 512S.,24-JUL.-2007-1OSY .zo

!SXHI.BI'fS:

J - Excel Spreadsheet titled "Flick~r New York" " identifies l1li as" a s'I.Jbject. .'

P.r~po;u:ed by:

A,PPR:'_

A-2

b{S} ,b(7}(C)

oirt s.i de ~he rece': w~!th",ut the. $R a:1;1tl"!.o'l::i·~"t·io.r\ o

n _.l!;t$,pectO'r GE\De",,·l for Ih"!lestigBti \ffiS'~

l11A\Ull1S-

,the :prDpe.l:·ty of tn.e Depar-tment bf De,f,ense

te.neral!ln i, to you·!: agency. ,(Co.nte'rrts .mav-

,m:{ pa'rty unde r ~nveSti'getH'

INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVEST1GATIVE SERVICE PITTSBURGH RESIDENT AGENCV

1000 LIBERTY AVE. Room 2101 PITTSBURGH. PA 15222-4004

(Investigatmns]

REPORT OF INVESTlGATION

20070] 51 7X-2S-NL-2007-10PB-ZO/Z

I8-fEBRUARY-2008

DISTRIBUTION:

DCIS HQ - 03S0 Northeast Field Office DCIS-I0PB

ICE - Pittsburgh

b(8) b(7){C)

CLASSIRCATION:

F8:R 8F£.161 ...... liSE 91NIrY

20Q701517X:-25 .. JUL-200q~ WPB-ZO/Z

NARRATIVE

IDBNTITY OF ·SUBJECT{'S) t:XHIBI}l(S,}

february .08, 2008

TABLE O:F CONTENTS

SECTION A

13

C

CLASSIFICAT.I.ON;

I

NARRATIVE.

1.. On July 11, 2007, the' Reporting Agent received a lead referral from Special Agent. DelS Mid-Atlantic Field Office, regarding the Immigration and-Customs Fn1'","r,p""ent (ICE) initiated Operation Flicker. Operation Flicker is a nationwide

investigation that has identified over 5,000 individuals who have subscribed to predicated child pornography websites, A listing was provided detailing individuals residing in the. Western District of'Pennsylvania who are employed by the Department of Defense and/or U.s. Military and have subscribed to' websites that contain child pornographic images or other material that exploit children via the internet.

2. Among the 5,000 names ICE identified, several individuals used their .rnll e-mail address, Fleet Past Office or Army Post Office military zip codes. DoD databases were

queried to identify individuals that may bein of child pornographic material.

One subject Identified was is. enlisted in the Reserve as a

LOI'POx"al (E-5, Enlisted).

3. The Reporting Agent contacted Special Agent ICE Pittsburgh, who

agreed to jointly work the case. with ICE serving as agency, Based all the

agreement, the Reporting Agent initiated the case on July25, 2007 (Exhibit 1).

4. On September 7, 2007, the; Reporting Agent received copies of subpoena returns for subpoena's served on'" email address and Internet service provider from Special Agent_ Also;~n that date, Special Age.n.~_ requested that the Reporting Agent ~ military personnel file (Exhibit 2).

5. On November 16;. 2007'; the Reporting Agent 0 btained ~ personnel file and contacted Special Agent_, but-received no response, Since then, the Reporting. Agent has

attempted numerous times to contact Special Agent through email and phone

calls but he has continued to be non-responsive. In Resident

Agent in Charge, contacted Special Agent " Pittsburgh, and

advised him of the situation.' speak: with.

_, however to '.' .

6. Based upon the complete non-responsiveness of ICE, who has. been named the lead agency regarding all Operation Flicker spin off cases, it is recommended that matter be closed.

b(S} b(7}{C)

ELASSIFICATH)N~

OPPIG.IAL USE ONL¥

l00701517X-25-JUlr2007~ 1 OPB~ZOfZ

February 08i 2008

IDENTITY OF SUBJECTS:

is enlisted in the Army Reserve as a Corporal (E-5, Enlisted) .

. __ 1,--

'CLASSIFICA lION:

b(8} b(7}{C)

FeR eFFI6IAl:WBE 8NLV

EXHIBITS!

1. DCIS Form 1; Case Initiation, July 25,2007

2. nCIS Form 1; Receipt of S Returns, October 3,2007

J, nelS Form 1; Receipt Personnel File, November 16,2007

Prepared by SA _ 1:_; Pittsburgh Resident Agency

APPR: _

b(S} b(7){C)

INSPECTOR GENERAL DePARTMENT OF DE'FE~SE' DEFENSE 'CRIMINAL INVESTIGATIVE SERVICE DAYTON RESIDENT AGENCY

3055 KETTERING Bl VD,#205 DAYTON,OH 45439

(Investigations)

,. '"

,

20070 1539T-26-JUL~2007-40DY -WlIIR

26-July-2007

INIIORMATION. REPORT: On July26, 2007, information was. received from the Federal Bureau of Ohirx.coneerni ng a telephonic complaint they receivedalleging illegal activity (chHd

a. DoD employee. The complaint is sum rnarized below (see attachment for

This lnfortnation is being furnished to the SIEFO/Nashville RA and the Western Fa for any action deemed appropriate and to the MAFO (Operation :Flicker) for information only. (Note: The complainant does not want to get involved beyond this initial reporting - see attached),

Attachment

1) FBI Complaint Form, July 9, 2006

2) DErDS 7/'46107

3) 4) 5)

APPR:_ Dayton, OH (w/o attachments)

b(6} b(7){C)

'CI.ASSJfICATION:

FOR OFFIGIA .. 118& ONI=N

I

20070 1553H-31-JUt-:2007 -40SX- YOIU

March 17, 2008

INSPECTOR GENERAL DEPARTMENT OF DEFENSE DE,FENSE CRIMINAL INVESTIGATIVE SERVICE SIOUX FALLS POST OF DUTY

P.O. BOX 139

CASTLEWOOD, SD 57223

(Investigations)

REPORT OF INVESTIGATION

200701553M-31-RJL-2007-40SX-YO/O

:17-MARCH-2008

---

DISTRIBUTION

D'CISHQ (03NS)

Central Field Office (40FO)

Il(B} b(7){C)

O"'''",e.nON, :

FeR BFFI6IAb. Y&&.QNI.¥ '

I

200701'553H-3L-.JUL-2007-40SX~YO/U

March I7" 2008

NARRATIVE

1. This Jnvestigation was initiated based upon information received from the' Defense

Criminal Investigative Service (DelS) Project, Operation PEeker. the DCIS Mid-Atlantic Field Office initiated Operation Flicker based on information provided by Assistant United States Attorney Gerald Smagala, 'United States Attorney's Office, Eastern District of Virginia, Alexandria Division.regarding a national investigation conducted by the United States. Immigration and Customs Enforcement (ICE). This investigation has identified over 5,000 individuals who subscribed to predicated child pornography websites. The DClS 'Sioux Fans Post of Duty was notified of one of these identified individuals, who is a full lime ArmyNational Guard.member_1

2. A database check through th€ Defense Manpower Data Center was conducted which

revealed tha_ is a Sergeant First Class and works with the North

Dakota Army National Guard (NDANG).

3. According to the ICE Cyber Crimes Center, on December 18~ 2006,_ made a

purchase through his PayPal account for $79.95 that was processed identified targe1. PayPal account utilizing the email address transaction follows virtually the exact same pattern as the other anss .... "~lVl pornography web sites, and was purchased through a PayPal account that appeared to be used almost exclusively for processing payments to these types of sites ..

4. A search of the IP address identified during the transaction revealed it belonged to the

internet service provider ND Telephone Company located in Devils Lake, ND. A Summons to NDTelephone was served by ICE, Grand Forks, ND, on August 7, 2007, which requested subscriber information for the identified IP address for the date and time of the transaction in question. Pursuant to the summons, ND Telephone identified the subscdberas"'_ residing i~".

Camp Grafton, NDANG, was contacted and agreed advised that he has hadseveral problems with

6. The Reporting Agent (RA) coordinated with _ regarding the internet history

file on the government computer used by. On. October 24, 20@7, the reporting agent received a memorandum for record from the Joint Force Headquarters, North Dakota. Army National Guard (NDARNG). regarding a cursory computer check conducted on the governmem computer used b~ The review was conducted remotely and consisted of a check of the' computer's Internet Explorer internet favorites directery, temporary internet files, internet

A·2

b(6} b(1}{C)

IRQR OI=FIGIAL "BE 9Nb¥

CLASSifiCATION:'

200701553H-31-JUL-2007~40SX~YO/U

March 17.ZQ08

history, and internet cookies, A general review offiles and directories was also conducted. Nothing was found outside of the NDARNG~s acceptable usepolicy,

7. On December 5,2007,. the RA and Special Agent_ ICE, Grand Forks, NO;

interviewed at Camp Grafton Army National Guard Headquarters building, Camp

Grafton, ND, was cooperative and related that he enjoyed watching young female models

progres~ . .' their career._ related that occasionally he would come across images .

that depicted young girls naked but he would immediately delete those images. _ stares that 'he bought memberships to 'a handful of pay sites and advised that most of those sites dealt with young modeling. He claimed that if he bought into a site that contained anything offensive, he wouldn'treturn to that site,

8. _ subsequently provided consent to search his home computer. A search of the

computer included the internet history file which was commensurate with the kinds of-images

that claimed interest in, including teen and preteen modeling, sites. While looking at these

. again related that if he visited a web site with inappropriate content, he would leave munediately,_ bad a shortcut on his desktop to a file containing approximately four subfolders. Two of these sub folders contained images that were very similar in nature to what Grove described would be on his computer. Most depicted young females and appeared to be in either photo 'shoot type settings or in swimwear, There were some images of naked females in each of the foJdcl's, but these females appeared to be oyer the age of eighteen. SA ~ used a "presearch" software program to view all of the image files 01_ computer. A couple of images located in the "temporary internet files" area of the computer appeared to be females of questionable age, possibly younger than eighteen .. These images and the location of the images on the computer appear to be consistent with_ description of his internet interests and

activities. -

9. Based on the information developed during the course of this investigation, the nelS,

Sioux Falls Post of Duty and ICE, Grand Forks, ND, consider this investigation closed. An investigative leads haw, been covered and no further investigative activity is anticipated.

A-3

b(.B} .b(7}{C)

fOR.8FFl81.AL '=IS'E aN..,.,.

CLASStFICA:r~ON :

200701553H-31-JUL~2007-40SX-YO/V

IDENTITY OF SUBJECTS

Name Alias

Social Security Number Date of Birth

Race

Sex

Residence

Employment/Occupation.

Telephone Number

March 17, 2008

IDENTIFYING DA l'A

..

'CLA:SSI FICA.:JION,:

B-1

b(S} b(7}{C)

F'S'R eFFlelA'1i "'51! DNL¥

I

20070] 553H-31-JUL-2007-40SX- YO/U

EXHIBITS

None. Previously submitted.

Prepared by:'

GLASSIFICAJION;

FeR, eFFIE.AI. U&1i QNLrY,

March 170 2008

Sioux Falls Post of Duty c-i

APPR;_

b(6} b(7){C)

I

INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMlNAL INVESTIGATIVE SERVICE WESTERN FIELD OFFICE

26722 PLAZA ST, STE 130

M.ISSION VIEJO, CA 92691-6300

(Investigations)

REPORT OF INVESTIGATION

20070 1606N-08-AUG~2007 -50LA- WI

November 17,2009

GRANT, GARY DOUGLASS

DlS1'RlBUTlON

DCTS~ Headquaters (03NS) ICE~ Santa Ana" CA

b(S} b(7}{C)

OLASSIFICATION::

FeR erF.SIA .. "BE 8,Nb¥

I

200701606N-08-AUG~2007~50LA~Wl/F

November 17,2009

NARRATIVE

1. On July 18, 2007, .~. . nets Arlington Resident.Agency; referred

identi tying information for sixteen persons " ties to the Department of Defense (DoD) who 'are in the nels Mission Viejo Resident Agency (MYRA) area of responsibility (AOR) and are

suspected of involvement in child pernography. • initially received the

information from Assistant United States Attorney United States Attorney's

Office (USAO), Eastern District of Virginia, The persons identified are active and retired military members; D0DciviIians and DoD contractor employees, several of whom have Top Secret or higher clearances and all of whom used. '".mil" e-mailaddresses to register for access to child pornography websites.

2. In April 2006, the Immigration and Customs Enforcerueut/Cyber Crimes Center/Child Exploitation Section (ICE/C3/CES) initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection." The investigation revealed that the same organization is operating numerous: commercial child pornography websites. In addition, the organization utilizes various PayPal accounts to process the. payments for access to the. member restricted websites. The investigation was worked jointly with ICElC3/CES, ICElBirmingham,the US. Postal Inspection Service, the 0'$. Department of Justice/Child Exploitation and Obscenity Section, and the USAO for the Northern District of Alabama. ICE designated this operation as Project Flicker,

3. ICE/C3/CES conducted over 60 undercover transactions 'at the advertising websites associated with this investigation. The investigation determined that. a specific criminal organization operated approximately 18 commercial child pornography portal websites which provided access to approximately 18 child pornography member ... restricted websites, using a specific and identifiable payment website known as "i West." The investigation identified that the criminal organization 0) used various Payf'al accounts to facilitate the customer payments; (2) used specific subject identifiers within the PayPal accounts to identify purchases into the various member restricted websites.and (3) used specific administrative e-mail accounts that are

used to distribute access to the member restricted websites, .

4. Project Flicker data was sorted to identify individuals who used their .mil e-mail address, Fleet Post Office, or Army Post Office military zip codes to register for the Pay Pal service to access the child pornography web sites. Gary Grant, Captain, U.S. Army Reserves was one of the individuals identified from this data. Grant is a JAG assigned'to the Judge Advocate detachment ,at the Los Alamitos Army Reserve Base, Los Alamitos, CA

5" On August 28" 2007 ~ a 'Search warrant was conducted at Grant's residence, The investigation revealed that Grant sent, through the Internet, an image depicting minors engaged in sexually

explicit conduct as set forth in California Penal Code Section 3]1)' Specifically, on

bet Grant sent America Online users and

, an email with image A9.jpg" depicts a nude

mitior female back in the sand and facing. the viewer, The minor female has her left leg

bent and is exposing her genitals,

A-I

b{S} b(7){C)

I

'20070 1606N-08-AUG-2007-50LA-Wl/F

November 17, 2009

6 .. On August 5, 2008, Grant was arrested pursuant 10 a State of California warrant. The arrest occurred at Grant's residence located at 55 Bluff Cove Drive, Aliso Viejo, CA, 92656. Also participating with DelS in the arrest were Special Agents from Immigration and Customs Enforcement (ICE) and investigators with the Orange County, CA Sheriff s Department. Grant was arrested for three counts of California Penal Code 311. t 1 (a), possession of obscene matter ofa minor in a sexual act (Refer to Exhibit 1).

7. On April S, 2009, Grant pled guilty in Superior Court of Cali forni a, County of Orange, to possession of obscene matter of a minor in a sexual act, California Penal Code 311.11 (a). Grant was sentenced to 90 days confinement and three years probation (Refer to Exhibit's 2 & 3),

8. In light of the successful prosecution of Grant. this. investigation isconsidered formally dosed, The DCIS, Mission Viejo Resident Agency, will devote no further resources to the matter. This case wasconducted jointly with the ICE, Santa Ana, CA The Orange County District Attorney's Office, handled the criminal prosecution.

9. No operational readiness or safety issues were identified during the investigation, and no systemic weaknesses Were revealed .. Therefore, no Fraud Vulnerability Report will be generated.

A-2

20070 1606N-08~AUG-2007~50tA- WI IF

IDE:NTITY OF SlJBJECT

.NAME ALIAS DOB SSN .HEIGHT WEIGHT HAIR EYES:

ADDRESS

PHONE

DRIVERS LICENSE # STATUS

OCCUPATION

Novem ber 17, 2009

IDENTIFYING DATA

Gary Douglass Grant

Gary Dougalss Grant; Oary Dougals Grant

'-95,

]70Ibs.

Brown

Lawyer

b(B} b(7){C)

20070 1606N -08~AUG~2007 -50LA-W.1 iF

November 17.2009

EXHIDITS

1. DelS Form 1, "Arrest Report," dated August 5, 2008, with attachments'.

2. DCIS FOI1n I" "Significant Incident-Guilty Plea & Sentencing," tlated April 27; 2Q09, with attachment.

3. DCIS Form If "People Vs Grant Minute Order," dated November 11,,2009., with attachment.

Prepared "by' Special Agent ~_ Mission Vle'jo Resident Agency APPR:

-c-

b(6} b(7}{C)

INSPECTOR GENERAL DEPARTMENT OF DEFENse. 'DEFENSE CRIMINAL INVESTIGATIVE SERVICE KANSAS CITY RESIDENT AGE~'NCY

500 STATE AVE, STI: 565

·KANSAS CITY, Ks 66101-2453

[Investlgations)

REPORT OF INVESTIGATION

2'0070162'013-1 O-AUG-2007~40[(C- YO/F SHAWN MULLEN

JAMES MAr'rES

SEPTEMBER 7,2009

DISTRIBUTION

J)CISHQ (03NS)

ncis Central Field Office (40FO)

CLASSIFICATION:

, FilA OFF.C..A .. "BE .QNI.¥

20070 1620B-IO-AUG-2007-40KC-YO/F

SEPTEMBER 7, 2009

TABLE OF CONTEN1'S

SECTION A A B B C D E F F G

Synopsi s " , ... , , ... , , .. , '. , . , ,

Statutes ' , " .. '. " ., . _ • , .... , ' "

Background .. , , , .. , .. , '" . , ,

Narrative . , .. , , .. , , .

Identity of Subjects, .•...... , , , , , .

Law Enforcement Records , , ... , , "' ... , ,

EVIdence" H , •• " • , , •••• , , •••• , ••••• ,

Status of Investigation , , . , , .

Prosecutive Considerations _ , , , ,

Exhibits. , , , , .

Cl.A:SSIFICA1ION:

FeR 8FFI81AL Y,S£ 8NL¥

I

2G0701620B~ lO-AUG-2007-40KC-YOfF

SEPTEMBER 7. 2009

SYNOPSIS

Immigration and Customs Enforcement (ICE) conducted a national investigation that identified over 5,000 individuals who subscribed to predicated child pornography websites, The Reporting Agent (RA) utilized information contained within the DoD Employee Interactive Data System (DEIDS) and the Joint Personnel Adjudication Systems (JPAS) to identify DoD affiliated individuals. The RA identified 14 possible subjects with a DoD nexus! and with ties to the DelS Kansas City Resident Agency areas of responsibility. After further interviews and data checks, two individuals were named as subjects in this case, Shawn Mullen (Mullen) and James Mattes (Mattes).

A search warrant was executed at Mullen's residence, Analysis of the computers seized during the warrant identified images of child pornography. Mullen was indicted on one count receipt ofchildpornography in violation of 18 U.S.C. § 2252(a)(2), and one count possession of child pornography in violation of U U.S.C. § 2252(a)(4)(B) of which he pleaded guilty. Mullen was sentenced to 78 months confinement and 8 years supervised release.

Mattes was interviewed and consented to a search of hif> personalcomputer. Analysis of the computer identified images of child pornography. Mattes was indicted on one count receipt of visual depictions involving the use of minors engaging.in sexually explicit conduct by means of'computer in violation of 18 U.S.C. § 2252(a)(2), and one count possession of material involving sexual exploitation of minors, 18 U.S.C. § 2252(a)(4)(B) .. Mattes pleaded guilty to Count 1 of the indictment, 18 U.S.C. § 2252(a)(2), receipt. Mattes was sentenced to 65 months confinement.f years. supervised release and $5,000 in restitution,

The case was successfully prosecuted by the u.s. Attorney's Office, District of Kansas and District of Southern Iowa,

STATUTES

The following violations of the United States Code apply to this investigation:

18 USC § 2252(a)(2)

18 USC §. 2252(a)(4)(B)

(Receipt of Child Pornography) (Possession of Child Pornography)

A

CLASSIFICATION:

ra'RsrFI61AL I:ISE, a,N~Y

I

200701620B~ lO~AUG~2007~40KC- YOIr

SEPTEMBER?,2009

BACKGROUND

This case was initiated based oninformation derived from Defense Criminal Investigative Service (DCIS) Project: Operation Flicker (Case Control Number 200701 199X), As background, on May 29.~ 2007, the nelS, Mid-Atlantic Field Office (MAFO), initiated Operation Flicker based on informatlon provided by Assistant United States Attorney (AUSA) Gerald Smagala, United States Attorney's Office (USAO), Eastern District of Virginia - Alexandria Division. AUSA Smagala advised that the Immigration and Customs Enforcernent (ICE) conducted a national investigation that identified over 5,0.00 individuals who subscribed to predicated child pornography websites, AUSA Smagala specifically requested that DCIS<\ssist in identifying Department of Defense (DoD) affiliated individuals and provide investigative

assistance. .

The Reporting Agent (RA) utilized information contained within the DoD Employee Interactive Data System (OEIDS) and the Joint Personnel Adjudication Systems (JPAS) to identify DoD affiliated individuals. The RA identified 14 possible subjects (listed below) with a DoD nexus) and with ties to the DCIS Kansas City Resident Agency areas cf responsibility.

Search warrants and computer analysis were techniques. used during the course of this investigation.

NARRATIVE

1. Asearth warrant was served on the residence of Shawn Mullen, DoD contractor. The,

computers and digital media seized from Mullen's house were submitted by the RA to the Defense computer' Forensics Laboratory (DeFL) in Linthicum. MD.

2.. The RA and ICE SA __ conducted three interviews with • __

_ and" On September 4,2007._ consented to an interview and 'a

review of his laptop. admitted to subscribing to the child pornography website. The

RA discovered .. .• , of child pornography on his laptop and_ consented to.

_ seizing the laptop for further forensic review. ICE will continue the investigation involving_without DCIS because he has since separated from the military and no longer has any DoD affiliation.

The RA and _ interviewed _ who denied purchasing any subscriptions to child pornography websites, _ has since retained an attorney. The RA contacted the Federal Bureau of Investigation Innocent Images to search their database for any information 011 _ his name, and user name yielded no results.

_ consented to an interview and a review of his computer. No images of child 'pornography were fOUI'lI;! and the agents will not continue the investigation on_

3. The RA and_ interviewed James Mattes who admitted to possessing child

pornography and consented to a review of his computer. The review showed that the computer

b{6} b{1}(C)

B~l

~CL~~~'SS~IF~IC~A~T~IO~N:~------~--------------'-------=-----------------------~--------------,-----

FOR 9FFICI~L "ali GNU

I

20070 1620B~ lO-AUG~200T-40KC~ Y(i)/F

SEPTEMBER 7, 2009

did have child pornography on the hard drive and Mattes consented to the seizure of the computer. The RA has been conducting a forensic examination of the computet and will submit the results to the National Center for Missing and Exploited Children upon completion to

identify known victims. _ is coordinated the case with the U.S. Attorney's Office, Southern District of Iowa, which agreed to prosecute this case. Mattes was added as a subject.

_ consented to a

4. 'The RA and ICE Springfield, MO interviewed

review of his computer and no child pornography was r

5. Mattes was indicted on January 23, 2008 on one count receipt of visual depictions

involving the Use of minors, engaging in sexually explicit conduct by means of computer in violation of 18 LT..S.c. § 2252{fl)(2), and one count possession of material involving sexual exploitationof minors, lRHS.C. § 2252(a)(4)(B).

6. The computer analysis of Mullen's computers was completed by the Defense Computer

Forensics Laboratory, Chlld pornography was identified, On May 21,2008, Mullen was charged by a federal grand jury as part ofatwo count indictment in United States District Court, District Of Kansas, Mullen was indicted on one count receipt of child pornography in violation of 18 U.S.C. § 2252(a)(2),and one COl111t possession of child pornography in violation of 18 U.S"C. § 2252{a)( 4)(B}.

7. Mullen pleaded gui lty to both counts of the. May 21, 2008 indictment, one count receipt of child pornography in violation of 18 V.S.c. § 2252(a)(2), and one count possession of chitd pomography in violation ofl8 V.S.c. § 2252(a)(4J(B).

8. On October 3,2008, Mattes signed a plea agreement. Mattes pleaded guilty to Count 1

of the January 23, 2@08 indictment, 18 U.S.c. § 2252(a)(2), receipt. Count 2 of the indictment, 18 U.S,C, § 2252(a)(4)(B)"possession, was dismissed at the conclusion of the sentencing hearing,

9. On April 6, 2009, Mullen was sentenced by U.S. District Judge John W, Lungstrum in

United States District Court, District of Kansas. Mulien Was sentenced to 78 months confinement, 8 years supervised release (to include sex offender registration) and was ordered to pay a $200 assessment fee.

10. On May 15,2009, Mattes was sentenced by Chief U.S. District Court Judge Robert W.,

Pratt, in United States District Court, Southern. District of Iowa. Mattes was sentenced to 65 months confinement, 5 years supervised release (to include sex offender registration) and was ordered to pay a $100 assessment fee. Mattes was al so ordered to forfeit the Dell Dimension comii. uter 4600, Serial NUhlbet~4~KF3.1 used in th~ c~mmissio~oft.hc crime. The victim of

the _ filed fer $6 million dollars of restitunon be paid,

II. On June 22,2009, Mattes was also ordered to pay restitution in the amount of$5,000 to

the MarshLaw Finn, White Plains, New York. The Marsh Law Firm represents the victim from the __ which was among the images identified on Mattes.' computer.

b(8) b(7){C)

CLASSIFICATION:

FOR OFEI'CIAL USIi. ONk'f

I

2007'01'62@B-l0-AUG-2007-4@KC~YO/F

SEPTEMBER 7, 2009

IDENTITY OF SUBJECTS

IDENTIFYING DATA

Name Alias

Social Security Number Date/Place of Birth Race

Sex

Height

Weight

Hair

Eyes

Residence

'Shawn Mullen UNK

-

4/301l964~ UNK

Caucasian Male/F emale

6' 1 '.'

]851bs Brown Brown

Employment/Occupation

I

Former analyst

Northrop Grumman UNK

UNK

UNK

Telephone Number Home

Driver's License Number and Issuing State Education

UNK

b(6} b(7){C)

CLASSIFICAJ,IOti'i ~--------,-----=D:__--=l:------ __ -------- ~ ~

FaR BFFISIALY8E 8NI=¥

I

200]0 1620B-l O-AUG-2007-40KC- YO/F

SEPTEMBER 7~ 2009

IDENTITY Of SUBJECTS

Name Alias

Social Security Number Date/Place of Birth Race

Sex

Height

Weight

Hair

Ey€s

Residence

Employment/Occupation

Telephone Number Home

Dl'iver's License Number and Issuing State Education

IDENTIFYING DATA

James Dean Mattes UNK

-

7/11/1970, UNK

Caucasian Male/Female 6'Z}'

2001bs Brown Brown

E~7 UNK UNK UNK

UNK

b(6} b(7){C)'

C[_ASSIFICA liON:

FeR eFFlelA .. "'&Ii QNL¥

I

200701620B~lp-AUG-2007-40KC-YO/F

SEPTEMBER 7, 2009

LAW ENFORCEMENT RECORDS

THe files of the Defense Clearance and Investigations Index (DelI) were queried for records of Shawn Mullen and James Mullen. A check did not reveal anything pertinent to this investigation, A National Crime Information Center (NeIe) query (If Shawn Mullen and jatIIes Mattes revealed no' criminal records, either state or Federal.

CLASSlflCATIONt

FaR e:FFI,el.AL Hal: .DNt? ....

I

200701620B-10-AUG-2007-40,KC-YO/F

SEPTEMBER 7, 2009

EVIDENCE

A. Subjects

Shawn Mullen

18 USc. § 2252(3)(2)

18 USC § 2252(a)(4)(B)

James Mattes

18 USC § 2252(a)(2)

1,8 USC § 2.2.S2(a)(4){B)

B. Documents

Previouslysubmitted

C. Witnesses

None

(Receipt of Chi"ld Pornography) (Possession of Child Pornography)

(Receipt of Child Pornography) (Possession of Child Pornography)

E-l

<;LASSIFICAl'l(l)N:

POK OPPIC.I,At tJ9E 8NLY

I

2,00701620B-I0-AUG-2007-4O:KC-YO/F SEPTEMBER 7~ 2009

STATUS OF INVESTIGATION'

This investigation was successfully prosecuted by LJ. S. Attorney's Offi CE1 District of Kansas, Kansas City; KS and Southern District of Iowa, Des Moines, IA.

Shawn Mullen was indicted on one count 18 USC § 2252 (a)(2) and one count 18 USC § 2252(a)(4)(B). He pleaded guilty both counts and was sentenced to 78 months confinement, 8 years supervised release (to include sex offender registration) and was ordered to pay a $200 assessment fee,

James Mattes was indicted on one count 18 USC § 2252 (a)(2) and one count 18 l)SC § 2252(a)(4)(B)_ He pleaded guilty to one count of 18 USC § (a)C2) and sentenced to 65 months confinement, 5 years supervised release (to include sex offender registration) and was orderedto pay a $1 O? assessment fee. ,M. anes w. _as also order.ed, to forfeit th~ Del~ ~)im~. n~ion ~om~ 4600, Serial Number 14PKF31 used in the commission of the crime. I'he victim of the _ _ filed for $6 million dollars of restitution to be paid. An amended judgment was filed and ordered Mattes to pay $5,000 in restitution.

PROSECUTIVE CONSIDERATIONS

There are no prosecutive considerations to date.

CLASSIFiCATION:

FaR 8FFIGIAl: "Be 9Nl:V

b(6) b(7}{C)

200701620B-1 O-AUG-2007 -40KC- YO/F

SEPTEMBER 7,2009

EXHIBITS

Previously submitted.

Prepared by: • __ , Kansas City Resident Agency

APPR:_

b(6} b(7}(C)

G-I

'CLASSIF,ICA TIO,.,.:.

FaR, 8FF1SIAb YI&ONL.Y

I

..

DEPARTMENT OF DEFENSE OFFICE OF INSPECTOR GENERAL IJEFENSECRIMINAL INVESTIGATIVE SERVicE ARLINGTON RESIDENT AGENCY

201 12thSTREer SOUTH, SUITE 712 ARLINGTON. VIRGINIA 22202·5408.

(Investigations)

REPORT OF INVESTIGATION

200701623E~10-AtJG-2007·60DC-WIID

July ,8~ 2008

--

DISTRIBUTION:

DClS Headquarters, National Security Program '(03'NS)

b(6} b(.7}(C)

eL:A.SSIFleATION:

FOR' OfFlel~L liSE ONlY LNiI ENFORCEMENT SENSITIl:iE

I

200701623E~1O-AUG-2007-60DC~WllD

July 8,2008

NARRATIVE:

1. This case was initiated based on information derived frorn the nelS Project: Operation Flicker (Case. Control Number200701199X). On May 29, 2007, the DClS Arlington Resident Agency initiated Operation Flicker based on information provided by Assistant U,S. Attorney CAusA.) Gerald Smagala, U.S. Atterney's Office, Eastern District of Virginia, Alexandria Division. AUSA Smagalaadvised that the: Immigration and Customs Enforcement (ICE) was. conducting a nationwide investigation that identified over 5,000 individuals that subscribed to predicated child pornography websites, AUSA Smagala requested DCTS assistance in identifying individuals affiliated with the DoD and investigate those individuals with ICE.

AUSA Smagala identified ,as one individual with a DoD afflliation

that subscribed to . pornography websites,

A query of the 000 Employee Interactive Data System indicated _ was in the

...,,,,,,,·v •• ,, E-05 .. A . of the Joint Personnel . Systems indicated that

3. AUSA Smagala informed __ that ICE did not purchase a, subscription to the website _ purchased .: AUSA Smagala declined criminal prosecution of_ because It could not be proven that the website_ purchased contained child pornography,

4, On January 16,2008, ICE, interviewed

_ at his residence,a subscription to aehild

pornography website, admitted he purchased subscriptions to several online

pornography websites over past few years. _ stated' he encountered child

pornography on the Internet on several occasions. On one occasion, after downloading a pornographic video that he believed was adult pornography, reviews of the video that were posted by other people that previously ... IT·", ""P'T> posts were calling the individual that posted the video on the Internet a. pedophile. After seeing

the comments posted by people about the ' downloading the video

because he believed it may have been child also encountered child

pemography in the form of "pop ups." on the Internet on . occasions, _ was

questioned about a website called "Red Lagoon Mags" and stated he had. no knowledge of the wehsite.~as informed that his credit card was used to purchase a SUbscription to Red Lagoon Mags for $79.99.,_. repeated he had no knowledge of the website and stated he

did not remember . a SUbscription to the. website. At the, conclusion of the interview,

voluntarily turn over computer for forensic review. but

then terminated the interview .

5. On January 30

•• ' regarding

.. _-

. DelS investigation.

. CLA.SSIFfCATION:

FOR OFFle·Ii&tL USE ONLY LV.II ENF9RGEMENf SENSlfl\(E

I

b(6} b(7}{C)

200701623E-IO-AlIG~2007~60DC-Wl/D

July 8,2008

7, nelS will take no further action-on thi& matter. No fraud vulnerabilities were-identified

during Ithis investigation, The irrvestigation is "lased as "declined."

A-2

b(8} b(7){C)

OlASSIFICATION:

FOR: :{lFFISIAllJSE ONLY ,lAW [NFOAS~MEN1SEN&I1:I\f& -

~ANINe '

ent is the pr:opetfy of!he Department of Defense Inspector Ganef ' nd is on loan toy - ~'ntents may not be dis - aWnder investigation hor may this docume otl1Slde the ,teceivi~'g agenCy wtttlQut the s ariiauon Ilf me Depu ,I " er;ll for

T ns.

2:00701623E~lO-AUG~2007~60DC-Wl/n

IDENTITY OF SUBJECTS

Name

Social Security N umber Date of Birth

Sex.

Residence

Employment/Occupation

July 8, 2008

III

Prepared by Special Agent __ , Arlington Resident Agency

I

APPR: _

B-1

b(6} b(7}{C)

I

(Investigations}

IN'SPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRJMINAL INVESTIGATIVE SERVICE LONG BEACH RESIDENT AGENCY

501 w,. OCEAN BL. VO, SUITE 1300

LONG BEACH" CA 90802'

REPORT OF fNVESTIGATlON

20070 1667W ~ 17~AUG-2007-50ES- WI!Z

--

DI'STRIBtrrION

Western Field Office

31-JANUARY-200S

b(6} b(7}{C)

ClAS.SIFICA TIO N,

FeR eFFie.",," 1::16E eN~LV'

.200701667W -17-AUG-2007-50ES- WIIZ

31-JANUARY-2008

NARRATIVE

1. On July 18.2007._ nels Arlington Resident Agency, referred .

identifying information for sixteen persons with ties to the Department of Defense (00'0) who

are. in the neTS Long Beach Resident Agencies (50ES) Area of Responsibility OR) and are

suspected of purchasing and supporting the child pornography trade. • initially

received the information from Assistant United States Attorney Gerald States

Attorney's Office (USAO), Eastern District of Virginia. The personsidentified are active, reserve & retired military members, 000 civilians and DoD contractor employees, several of whom have security clearances.

2. In Apri,120061 the Immigration and Customs Enforoement/Cyber Crimes Center/Child Exploitation Section (ICE/C3(CES) initiated an investigation intoa criminal organization operating a commercial child pornography website known as "Horne Collection." The investigation revealed that the same organization is operating numerous' commercial child pornography websites. In addition, the organization utilizes various PayPal accounts to process the payments for access to the member restricted websites, The investigation is being worked jointly with ICE/C3JCES, ICElBirmingham, the U.S. Postal Inspection Service, the U'.S, Department of Justice/Child Exploitation and Obscenity Section.and the USAO for the Northern District of Alabama. ICE has designated this operation as Project Flicker.

3. ICE/C3/CES conducted over 60 undercover transactions at the advertising websites associated with this investigation, The investigation determined that a specific criminal O"r:gan:izatiotl operates approximately 18 commercial child pornography portal websites which provide access to approximately 18 child pornography member-restricted web sites, using a specific and identifiable payment website known as "iWest." The investigation identified that the criminal organization (1) uses various PayPal accounts to facilitate the customer payments; (2) uses specific subject identifiers within the PayPal accounts to identify purchases into the various member restricted websites; and (3) uses specific administrative e-mail accounts that are used to distribute access to the member restricted websites,

4. Project Flicker data was sorted te identify individuals who used their personal e-mail addresses, .mil e-mail address, Fleet Post Office, or Army Post Office military zip codes to register for the PayP.al service to access the child pornography websites, The four suspects ideRtitied in the 50ES AOR have been tided as subjects based upon the initial evidence that was provided to the nelS by ICE. Based upon the fact that the subjects are DoD employees and

possess securiry clearances, ICE has listed them as a Tier 1 . This investigation was

coordinated with ICE Child Exploitation Unit, Long

Beach, CA," _. has been assigned as the

Investigating agent, .

A-J

I

b(8} b(7}(C)

200701 667.W -17-AUG.:2007-50ES;WlIZ

Jl-JANUARY-2008

5.. After a review of _ transactions in, December 2007, it was determined that the probable cause for a search warrant was stale and that more recent.evidence was not available.

In addition to this information, it was also determined that a portion of the original nexus for the initiation of the investigation was incorrect The information report referred had indicated that the subject had used his/her .mil account to conduct the illegal purchase of child pornography.

At the time it was decided that the use of a .mil account in conjunction with the fact that the subject was a contractor to the U.S, military was sufficient nexus to initiate an investigation, However, once it was determined that the use of a .rrril account aid not occur and that the PC was stale 'and no further evidence is available, this investigation is closed. There, were no management control deficiencies identified during the course of this investigatien,

A-2

b(6} b(7}{C)

-- .... -

I

20070 1667W -17-AUG~2007 -S·OES~ WIll,

IDENTITY OF SUBJECTS

Name Alias

Social Security Number Date/Place of Birth Race

Sex

Residence

Employm eat/Occupation Telephone Number Education

31-JANUARY-2008

Identifying Data:

B-1

b(6:} fl(7}{C.l

- -_------_----

2007D1667W-17-AUG-2007-50ES~Wl/Z

EXHIBI1'S

No Exhibits

Prepared By; SA __ , Long Beach Resident Agency APPR:

I

:3' 1··.J ANVARY-2008

b(8} b(7}{C)

[Add CCN to. Header]

(Investigations)

Month ##, YYYY

INSPECTOR GENERAL, DEPARTMENT OF DEFENSE D.EFENSE CRIMINAL INVESTIGATIVE S'ERVICE LONG BEACH RESIDENT AGENCY

501 W. OCEAN BLVD, SUITE 7300

LONG BEACH; CA 90802

REPORT OF INVESTIGATION

20070 1690T -23~AUG-2007-50ES- Will

--

DISTRIBUTION

Western Field Office

3l:~J'ANUARY-2008

b(8J I:l(7){C),

CLASSIF.Ie,A fION:

r8.R 8,FFI6IAI=Y8E9NL'l

[Add CCN to Header]

Month ##, yyyy

200701690T~23~AUG~2007~50ES~WVZ

31 ~JANUAR y ~2008

NARRATIVE

DCIS Arlington Resident Agency, referred

identifying' sixteen persons with ties to the Department of Defense (DoD) who

are in the DelS Long Beach Resident Agencies (50ES) Area of Responsibility (AOR) and are

suspected of purchasing and supporting the child pornography trade. initially

received the information from Assistant United States Attorney States

Attorney's Office (USAO), Eastern District of Virginia. The persons identified are-active, reserve & retired military members" DoD civilians and DoD contractor employees, several of whom have security clearances.

2. In April 2006, the Immigration and Customs Enforcernent/Cyber Crimes Center/Child Exploitation Section (ICE/C3/CES) initiated an investigation into a criminal organization operating a commercialchild pornographywebsite known as "Home Collection," The investigation revealed that the same organization is operating nume~ous commercial child pornography wcbsites, In addition, the organization utilizes. various PayPal accounts to process the payments for access to the member; restricted websites, The investigation is being worked jointly with ICEJC3/CES, ICElBirrriinghrun, the UX Postal Inspection Service, the U.S. Department of Justice/Child Exploitation and Obscenity Section, and the USAO for the Northern. District of Alabama. ICE has designated this operation as Project Flicker,

3. ICE/C3/CES conducted over 60 undercover transactions at the advertising websites associated with this investigation. The investigation determined that a, specific criminal organization operates approximately 18 commercial child pornography portal websites which provide access to approximately 18 child pornography member-restricted websites, using a specific and identifiable payment website known as "i'Weat." The investigation identified that the criminal organization (1) uses various PayPal accounts to facilitate the customer payments; (2) uses specific subject identifiers within the PayPaI accounts to identify purchases into the various member restricted websites; and (3) uses specific administrative e-mail accounts that are used to distribute access to the member restricted website-so

4. Project Flicker data was sorted to identify individuals who used their personal e-mail addresses, .mil e-mail address, Fleet Post Office, or Army Post Office military zip codes to register for the PayPal service to access the child pornography websites. The four suspects, identified in the 500BS AOR have been titled as subjects based upon the initial evidence that was provided to the DCIS by' ICE .. Based upon the fact that the subjects-are DoD employees and possess security clearances, ICE has listed them as a Tier 1 priority. This investigation was

coordinated with ICE Child Exploitation UnitLong

Beach, CA, _ has 'been assigned as the

investigating

A~2

b(6} b(7}{C)

peR. e.ffle,lAt: 1:15E eN.LV

Cl;llSSIFICA ll.oN:

[Add CCN to Header]

Month ## YYYY

20070 1690T -2J-AU G-2007-5 OES- W J IZ

'31-JA~lltJARY -2008

5. After a review Of_fahSactiollS in December 2007, it was determined that the probable cause for asearch warrant was stale and that more recent evidence was not available. In addition te this information, it was also determined that a portion of the original nexus for the initiation of the. investigation was incorrect. The Information report referred had.indicated that the subject had used his/her .mil account to conduct the: illegal purchase of child pornography. At the time it was decided that the use ora .mil account in conjunction with the fact that the subject Was: a activemember of the military was sufficient nexus to initiate an investigation. However, once it was determined that the use of a .mil account did not occur and that the PC was stale and no further evidence is available, this investigation is closed. There were no management control deficiencies identified during the COUl:!il€ of this investigation.

A~3

b(6} b(7}(C)

CLASSIFICA:rIO~:

I

, .

[Add CCN to Header]

Month ##, YYYV

2@0701690T-2.3-AUG-2007-50ES-WI/Z

31-JANUARY-2008

,EXHIBITS

No Exhibits

Prepared By; SA

Long Beach Resident Agency

APPR

b(6} b(7}(C)

C-l

FeR 9FFIS.IAb "8.& eNL¥

,CLASSIFICATION~

I

{I nvestigations)

INSPECTOR GENERAL DEPARTMENT OF DEFENse DE'FENSE CRIM'INAL INVESTIGATIVE SERVICE LONG BEACH RESIDENT AGENCY

.501 W. OCEAN BLVD, SUITE 1300

LONG BEACH, CA90802

REPORT OF INVESTlGAUON

200701691 U -23-AUG-2007~50ES~W1!z

--

DISTRIBUTION

Western Field Office

31-JANUARY-2Q08

b(6} Il<7){C)

CLASSIFICATIOllif

-FeR erFI61AL USE, 'BN"¥"

I

200701691U-23~AUG-2007-50ES-WI/Z

31-JANUARY~2008

NARRATIVE

1. On July 18,2007._ DClS Arlington Resident Agency, referred

identifying information for sixteen persons ties to the Department of Defense (DoD) who

are in the DCIS Long Beach Resident Agencies (SOES), Area of Responsibility (AOR) and. are

·suspec1ed of purchasing and supporting the child pornography trade. initially

received the information from Assistant United States Attorney States

Attorney's Office (USAO), Eastern District of Virginia. The persons identified are active, reserve & retired military members, DoD civilians and DoD contractor employees, several of whom have security clearances.

2. In April 2006, the Immigration and Customs Enforcement/Cyber Crimes. Center/Child Exploitation Section OCE/C3/CES) initiated an investigation into a criminal organization operating a commercial child pornography website known as "Horne Collection." The investigation revealed that the same organization is operating numerous commercial child pornography websites, In addition, the organization utilizes various PayPal accounts to process the payments for access to the member restricted websites. The investigation 1S being worked jcintly with ICE/C3/CES, ICE/Birmingham, the U.S. Postal Inspection Service, the U.S,. Department of Justice/Child Exploitation and Obscenity Section, and the USAO for the Northern District of Alabama. ICE has designated this operation as Project Flicker.

3., ICE/C3/CES conducted over 60 undercover transactions at the advertising websites associated with this investigation. The investigation determined that a specific criminal organization operates approximately I g commercial child pomography portal websites which provide access to approximately 18 child pornography member-restricted websites, using-a specific and identifiable payment website known as "[West," The investigation identified that the criminal organization (1) uses various Pay-Pal accounts to facilitate the customer payments; (ly uses specific subject identifiers within the Pay Pal accounts te identify purchases into the various member restricted websites; and (3) uses specific administrative e-mail accounts that 'are used to distribute access to the member restricted websites.

4. Project Flicker' data. was sorted to identify individuals who used their personal e-mail addresses, .mil e-mail address, Fleet Post Office, or Army Post Office military zip codes to register for the PayPaJ service to access the child pornography websites, The four suspects identified in the SOES AOR have been titledas subjects based upon the initial evidence that was provided to the DelS by ICE. Based upon the fact that the subjects are Don employees and

possess security clearances, ICE has listed them as a Tier I·' . This investigation was

coordinated with ICE Child Exploitation Unit, Long

Beach, CA, _ .has been assigned as the

5. After a review of _ transactions in December 2007; it was determined that the probable cause for a search warrant was stale and that mere recent evidence was not available. In addition

A-2

b(S) b(7}{C)'

FeR 8FFI81ItLUSE; 8.NLY

CLA~ SIFICATION:

I

200701691U~23-AUG-2007-50ES~Wl/Z

3l-JANUARY-2008

to this information, it was also, determined that a portion of the original nexus fOT the: initiation of the investigation was incorrect. The information report referred had indicated that the subject had used his/her .mil account to conduct the illegal purchase of child pornography, At the time it was decided that the use of a .mil account in conjunction with the fact that the subject was a active member of the military was sufficient nexus to initiate an investigation. However, once it was determined that the use of a .mil account did not occur and that the PC was stale and no further evidence is available, this investigation is closed. There were no management control deficiencies identified during the CDUf!)C of this investigation,

A-3

CLASSIFICATION':

FeR efFleIA,LH5E eN,LV'

I

20070 1691 U~23-AUG-2007-50ES-W1/Z

31-JANUARY-2008

IDENTITY OF SUBJECTS

Name Alias

Social Security Number Date/Place of Birth Race

Sex

Residence

Employment/Occupation Telephone Number Education

Identifying Data:

b(6} b(7}{C)

8-1

,CLASSIFICA1IQN:

Fe,. eFFle.Al: "$," aN""

200701691 U-23-AUG-2007-50ES-WlIZ

JI-JANUAR Y -2008

EXHIBITS

Nd Exhibits

Prepared

.A

Long Beach Resident AgeNcy

C-l

b(6} b(7}{C)

FilA 9FFI'GIAJ. US&:, QNb¥ '

:CLASSIFICATION:

(Investigations)

INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE LONG BEACH RESIDENT AGENCY

501 W. OCEAN BLVD, SUITE 7300

LONG BEACH, CA 90802

REPORT OF INVESTIGA11ION

20070 1691V ·23-AUG-200J-50ES~W1/Z

D]STRJiBUTlON

Western Field Office

31-,JANU AR Y -2008

b(6} b(7){C)

CLASSI".ICA(IO~:

FeR eFFlelA" WIE eN,""

I

200701 692V -23-AUO-20Q7 -50ES- WJ Il

3,1' -J ANUAR Y -2008

NARRATIVE

L On July 18, 2007.. ncrs Arlington Res-ident Agency, referred

identifying information for sixteen persons with ties to the Department of Defense (DoD) who are In the nelS Long Beach Resident Agencies (SOES) Area of Responsibility (AOR) and are suspected of purchasing and supporting the child pornography trade .• _ initially received the information from Assistant United States Attorney Gerald Smagala, United States Attorney's Office (USAO), Eastern District of Virginia .. The persons identified are active, reserve & retired military members, DoD civilians and DoD contractor employees, several of whom have security clearances.

2. In April 2006, the Immigration and Customs Enforcemect/Cyber Crimes Center/Child Exploitation Section (ICEfC3JCES) initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection." The investigation revealed that the same organization is operating numerous' commercial child pornography websites, In addition, the organization utilizes various PayPal accounts to process the payments for access to the member restricted websites. The investigation is being worked jointly with ICE/CC3ICES, ICE/Birmingham, the U.S. Postal Inspection Service, the U.S. Department of Justice/Child. EXploitation and Obscenity Section, and the USAO for the Northern District of Alabama ICE has designated this operation as Project Flicker.

3. TCE/C3/CES conducted over 60 undercover transactions at the advertising websites associated with this investigation. The investigation determined that a specific criminal organization operates approximately 18 commercial child pornography portal web sites which provide access to approximately 18 child pornography member-restricted websites, using a specific and identifiable payment website known as "i West." The investigation identified that the criminal organization (1 ) uses various PayPal accounts to facilitate the customer payments; (2) uses specific subject identifiers within the, PayPa! accounts to identify purchases into the various member restricted websites; and (3) uses specific administrative e-mail accounts that are used to distribute access to the member restricted websites.

4, Project Flicker data was sorted to identify individuals who used their personal e-mail addresses, .mil e-mail address, Fleet Post Office; or Army Post Office military zip codes to register for the PayPal service to access the child pornography websites. The four suspects 'identified in the 50ES AOR have been titled as SUbjects based upon the initial evidence that was provided to the' nels by ICE. Based upon the fact that the subjects are DoD employees and

possess security clearances. ICE has listed them. as a Tier l nri . This investigation was

coordinated with ICE Child Exploitation Unit, Long

Beach, CA, _ has been assigned as the

investigating agent,

A-l

b(6) b(7}{C)

CLASSIF1CA.TION:

FeR. err.SIAb Y&E9NI.¥

I

20D70 1692V-23-AUG-2007-50ES- Wl IZ

31-JANlJARY-2008

5. After a review of _ transactions, in December 2007, it was determined that the probable cause for a search warrant was stale and that more recent evidence was not available. In addition to this information, it was also determined that a portion of the original nexus for the initiation of the investigation was incorrect The information report referred had indicated that the subject had used his/her .mil account to conduct the' illegal purchase of child pornography, At the time it was decided that the use of arnil account in conjunction with the fact that the subject was a military service member was sufficient nexus to initiate an investigation.

However, once it was determined that the use of a .mil account did not occur and that the PC was stale and no further evidence is available) this investigation is closed, There were no management control deficiencies identified during the course of this investigation.

A-2

b(6) b(7}(C)

CLASSIFICATION:

FeR 8FFl6IA .. USE 8N.loY

I

10070 1692V-23-AUG-2007-50ES- WI!Z

IDENTITY OF SUBJECTS

Nam~ Alias

Social Security Number Date/Place of Birth Race

Sex

Residence

Employment/Occupation Telephone Number Education

.3.1-JANUARY-2008

Identifying Data:

B-1

b(S) Il(7}{C)

CLASSIFICATION:

feR BFF.I:6IA" YSEDN:..v

I

200701692V -23~AUG·2007-50ES-Wl/Z

3 [-lANUAR¥-20Q.8

EXHIBITS

NQtJe

Prepared By;

Long Beach Resident Agency

AP.PR:

b(5} b(7J(C)

C-l

FOR eFFlelAL .. BE 8NLY

CI!.ASSIFICAJlON:

(Investigations)

lNSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE S-ERVICE SAN FRANCISCO RESIDENT AGENCY 1301 CLAY ST, STE 4BON OAKLAND, CA 94612 .. 5217

REPORT OF INVESTIGA nON

2Q0701756M-Q6-SEP-2007-5'OSF - WI fE

D1STR18UTION

Western Field Office

January 29, 2009

b(6} b(7){C)

CLASSI'PICATION'

roR O'FFICIAl USE ONLY

I

200701756M-06-SBP~@07-50SF-WifE

January 29,2009

NARRATIVE

1. This investigation was initiated based upon a referral from DelS

Arlington Resident Agency, Arlington VA identifying four' San

Francisco Resident Agency area of responsibility who were suspected of involvement in child.

pornography. . initially received the information from Assistant United States

Attorney (A United States Attorney's Office (USAO), Eastern District of

Virginia, Alexandria, VA. The subjects identified were reserve and retired military members, 000 contractor employees. and in one case a sub-contractor to a DoD contractor, all of whom used ".mil" e-mail addressestoallegedlyregisterforaccesstochildpornographywl;lbsites.This investigation was conducted jointly with Immigration and Customs Enforcement (JOE) agents located in Oakland, CA, S~ francisco, CA, and San Jose, CA.

2. Upon coordination with leE regarding all four subjects, it was understood that as a matter of policy the United States Attorney's Offices (USAO), Northern District ofCalifornia, San Francisco, Oakland.and San Jose, CA usually declined to accept any child pornegraphy investigation where the subject of the investigation had not engaged in any downloadactivity within the past six months. Due to the USAO's policy, ICE issued administrative subpoenas to PayPal to determine ifth€ subjects had any recent download activity with known child pomography websites within the past six months. All Pay Pal information returned in response to the subpoenas revealed that none of the subjects had accessed child pornography within the required timeframe, At their discretion ICE agents plan to perform knock-and-talk interviews of an four subjects in order to ascertain their involvement with child pornography; however, due to the heavy case load ofthe assigned ICE agents and higher priority investigations, the knock-andtalk interviews we not expected to be: conducted for an extended period of time.

3. Due to the policy of the USA 0, the limited activity on the part of the subj ccts, the length of time until the interviews win be conducted. by ICE~ and the need to focus on other higher priority investigations, this. investigation is being closed by DCIS. Itis understood that the investigations will be completed by ICE as time and their case load permits. At this time, no judicial or administrative actions are expected. There were no fraud vulnerabilities identified during the course of the. investigation,

A

b(8}. b(7}{C)

CLASSIFICATION'

rn.R· OFFIGIAll:J8E ONbY

I

200701756M-06~SEP~2007~50SF-WI/E

IDENTIT·Y OF S{]BJECTS

Name Alias

Social Security Number Date/P;lace of Birth Race

Sex

Height

Weight

Hair

Eyes

Residence

Employment/Occupation. Telephone Number Driver's License Number

and Issuing State Education

DoD Affiliaticn;

C~S$IFICA liON:

reft OfFICIAL USE. 6NlY

January 29, 2009

Identifying Data:

-,

E~4,. Marine Corp Reserve, Unit unknown

B-1

b(6} b(7){C)

20Q701"756M-06-SEP-2007~50S'F-WI/E

IDENTITY OF SUBJ'ECTS

Name Alias

Social Security Number Date/Place of Birth Race

Se~

Height

Weight

Hair

Eyes

Residence

Employment/Occupation Telephone Number Driver's License Number

and Issuing State Education

DoD Affiliation

January 29, 2009

Identifying Data:

E-7~ U.S, Navy, Retired

b(6} ,b(7}{C)

CLASSIf,ICA'lION:

B-2

FOR 8rFlGIAL .uSE ONLY

I

200701756M-06-SEP~2007-50SF~ Wl /E

IDENTITY OF SHB'JEC'FS

Name AHas

Social Security Number Date/Place of Birth Race

Sex

Height

Weight

Hair

Eye:s

Residence

Employment/Occupation Telephone Number Driver's License Number

and Issuing State Education

DqD Affiliation

CLASSIFICATION,

FOR OFFICIAL USE ONLY

Identifying Data:

B-3

January 29, 2009

-

b(6} b(7){C)

200701756M~06-SEP-2007-50SF- W1 IE

January 29; 2009

IDENTITY OF SUBJECTS

Identifying Data:

Employment/Occupation Telephone Number Driver's License Number

and Issuing St;l!e Education

Name .Alias

Social Security Number Date/Place of Birth Race

Sex

Height

Weight

Hair

Eyes:

Residence

DoD Affiliation

-

Prepared by __ San Francisco RA B-4

APPR:

b(BJ b(7}{C)

CL~SSIFI.Ci\TION :

P81t ep,FlelAL H9E eN,,"\!"

I

'INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVEST1GATIVE SERVICE COLUMBUS RESIDENT AGENCY EASTON PLAZA ONE

4449 EASTON WAY., SUITE 375 COLUMBUS, OH 43219

(Investigations)

REPORT OF INVESTIGATION

200800080D~ 18~OCT -2007 -40CO~ W liZ

December 3~ 2007

OPERA TION FLICKER., Columbus, OH

SPECIAL INTEREST CASE,

C-l

CLASSIFICATION:

II=OR OFI=IQIAI. U'SE ONLY

.--;. - ._-------

I

NARRATIVE

.If This investigation into individuals who subscribed to predicated child pornography websites was initiated based upon information received October 15,2007, from a Special Agent (SA) with the Department of Homeland Security (DHS), Immigration' and Customs Enforcement (leE), Columbus Resident Agency (RAC/Columbus) and as a result of De IS Project "Operation Flicker" (CCN~ 20070 1199X-29-MA Y -2007-60DC- Wl). rCE-Columbus referred identifying information for four individuals with ties to the Department of Defense (DoD) that are in the Columbus Resident Agency area of responsibility and are suspected of involvement in child pornography. In addition to the information provided by fCE Columbus, six additional DoD related subjects in the Cleveland, OR and Detroit MI area were identified by the PHS-ICE Detroit, MI field office and through the efforts of the Mid-Atlantic Field Office (MAFO) in Project Flicker. The persons identified are. active and retired military service members, DoD oivi lians, and DoD contractor employees; several of the individuals have Secret or higher' clearances and some may have used .mil e-mail addresses to register for access to child pornography websites,

2. In Aptil2006, the Immigration and Customs Enforcement/Cyber Crimes Center/Child Exploitation Section (ICE/C3/CES) initiated an investigation of a criminal organization operating a commercial' child pornography website known as "Horne Collection." The investigation revealed that the. same organization is' operating numerous commercial child pornography websites, In addition; the organization utilized various Payf'al accounts to process the payments for access to the member-restricted websites, The is a joint investigation with ICE/C3.!CES, ICE/RAe/Birmingham, the U.S. Postal Inspection Service, the U'S, Department of Justice/Child Exploitation. and Obscenity Section, and multiple USAO offices, including the USAO for the Northern District of Alabama. ICE designated this effort Project Flicker. DCISMAFO and neIS field office representatives assisted ICE after determining that DoD personnel and/or contractor personnel may have been involved in accessing and obtaining child pornography.

3. ICE/C3!CES conducted over 60 undercover transactions at the advertising websites associated with this investigation. The investigation determined that a specific criminal organization operates approximately 18 commercial child pornography portal websites that provide' access to approximately 18 childpornography member-restricted websites, using a specific and identifiable payment website known as "i West." The investigation identified that the. criminal organization (1) uses various Payl'al accounts to facilitate the customer payments; (2) uses specific subject identifiers within the PayPal accounts 'to. identify purchasesinto the various member-restricted web sites; and, (3) uses specific administrative e-mail accounts to distribute access to the member restricted websltes.

4. Project Flicker data 'Was sorted to identify indi viduals who used their .mil e-mail address, Fleet Post Office (FPO), or Army Post Office (APO) military zip codes to register for the Payf'al service for access to the child pornography websltes, The suspects identified in the Columbus RA AOR will be titled as subjects if the investigation determines the individuals were involved in acquiring and/or transmitting child pornography. The priority for investigating suspects win be assessed based on their security clearances, position in their 000 organizations 1 whether their DoD position provides' access to children, and whether they are a recidivist.

S. Prior to opening this investigation, the agent met with Immigration and Customs

Enforcement (ICE) Special Columbus, OH regarding Operation Flicker.

An investigative plan was provided identifying information on

Department of Defense employees. that are . the Columbus Resident Agency area of responsibility and are suspected of being 'involved in child pornography. _ offered ICE cooperation in this investigation.

b(B} 1l(7}{C)

I

. .

6. Due to DelS Headquarters' direction and other nels investigative priorities, this investigation is cancelled. No subjects were formally titled in the DCIS IDS System. No judicial or administrative action will occur. There, is no less 'to the U.S. Government. Then": were no management control deficiencies identified during the course of this investigation,

Prepared by S~

Columbus RA

b{6} b(1}{C)

INSPECTOR GENE.RAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE DAYTON R.ESIDENT AGENCY

3055 KETTERING BLVD, #205 DAYTON.! OH ·4543·9

(Investigations)

2008001 57H-02-NOV-2 007-40DY-W 1

02~ November-Ztltl?

INFORMATION REPORTI REFERRED: The Dayton Resident Agency (RA) received information from the Kansas City RA regarding a project that was initiated based upon information provided by the United States Attorney's Office (USAO), Eastern District of Virginia, Alexandria Division that advised the Immigration and Customs Enforcement (ICE) ofa national investigation that identified over 5,00Q individuals who subscribed to predicated child pornography websites, Asa result of this information ICE and the U. S. Department of Justice/Child Exploitation and Obscenity Section designated this operation as Project Flicker.

As a result of Project Flicker and the initiative from the USAO, ICE identified individuals under Project Flicker associated with the military by either providing their .mil emall addresses, Fleet Post Office (FPO),. or Army Post Office CAPO) military zip codes. DCIS was requested to assist in identifying additional Department of Defense (DoD) affiliated individuals and provide investigative assistance. Targets of Operation Project FLicker that are affiliated with the military put national security at risk by compromising computer systems/email systems and individuals with security clearances from the DoD compromise their clearance and put themselves and the interests of DoD at risk of blackmail, bribery, and threats.

(SSN: _, OOB_ was identified by

Proj ect . as one of these targets. Information he provided to an online website for

subscribed child websites listed an address •

(attachment 1).

A DElOS Report o~Tevealedthathe is an enlisted 05, active

at Fgrt . . It providesa

AREOD R~wsthat_" .••• '."' •• _ •

• _---(attachment3).. ~

A National Comprehensive

"1 •• _-

from Choice Point was generated and lists address abovementioned (attachment 4) ..

OLASSIFICATlON: . ----~---~~-----.-----------------~-

b(6} b(7}{C)

I=QR. OFFICIAl. Utili gNI.¥

I

Contact with office revealed that he was referring because ~ resides in Clarksville, Tennessee.

. ICE Bowling Green, Kentucky lCE Nashville, Tennessee office

'. does not have a current Kentucky driver') s license.

Criminal Investigation Division (CID), Fort Campbell, Kentucky, Special Agent

advised that~des off-base and prdvid~d thea,ddress _

teleph~ __ advised that because off-

would not be involved in the investigation as it would mostI be,

handled by the United States Attorney's Office, unless Information Was, gleaned that~ was participating in criminal activity on-base.

This Information is being forwarded to the Nashville Post of Duty (POD) for further action since Clarksville, Tennessee falls under Nashville POD Area of Response. Any further questions regarding this report should be directed to the undersigned at telephone nuhJ.ber~

-

Attachments:

1) Flicker Targets in Kentucky, 1 page

2) DErDS Report, 1 page

3) REDD Report, 1 page

4) National Comprehensive Report, 26 pages-

Prepared by

Dayten Ra

APPR:_

b(8} b(,7}{C)

CLASSIFICA']U·ON::

I

3

DISTR: 40SLl20F0!20ATI20NV (electronically only)

I

INSPECTOR GENERAL 'DEPARTMENT OF DEFENSE' DEFENSE CRIMINAL INVESTIGATIVE SERVICE DAYTON RESIDENT AGENCY

3055 KETTERING BLVD • .#:205 DAYTON .• OH 45439

(Investigations)

2008001 S81-02 .. NOV~2007-40DY-Wl

02-November-2007

. SSN;_ . Unknown

Campbell, KY

INFORMATION REPORTI REFERRED: The Dayton Resident Agency (RA) received information from the Kansas City RA regarding a project that was initiated based upon information provided by the United States Attorney's Office (USAO), Eastern District of Virginia, Alexandria Division that advised the Immigration and Customs Enforcement (ICE) ofa national investigation that identified over 5,000 individuals. who subscribed to predicated child pornography websites, As a result of this information ICE and the U.S. Department of Justice/Child Exploitation and Obscenity Section designated this operation as Project Flicker.

As a result of Project Flicker and the initiative from the USAO~ ICE identified individuals under Project Flicker associated with the military by either providing their .milemail addresses, Fleet Post Office (FPO), or Army Post Office (APO) military zip codes. DCIS was requested to assist in identifying additional Department of Defense (DoD) affiliated individuals and provide investigative assistance. Targets of Operation Project Flicker that are affiliated with the military put national security at risk by compromising computer systems/email systems and individuals with security clearances from the DoD compromise their clearance and put themselves and the interests of DoD at' risk of blackmail, bribery, and threats.

(SSN:_, Do.B:_) was identified

by Project as one of these targets. Information he provided to an online payment website

for subscribed child '. websites 1isted an address of __ ~_' .•

A check with the DElDS database revealed no record '0f_

A REDD Report; shows that end date with the Army was 1).

. date with the Army was".~ and his was an enlisted 05 with the: Army (attachment

an address

provided from Choice Point was generated 'and Iists ._ (attachment 2) ..

_ does not have a current Kentucky driver's license,

CLASSIF1QATIO'N:

b(8} b{7}{C)

FeR eFFI61AL YBE eN."¥'

Contact with ICE Bowling Green, Kentucky

office revealed thathe was . ng this LU.~'''U'''''L to the ICE Nashville, Tennessee office

because_ resides in ClarksviUe, Tennessee.

This information is: being forwarded to the Nashville Post of Duty (POD) for further action since Clarksville, Tennessee falls under Nashville POD Area of Response ... Any further questions regarding this report should be directed to the undersignedat telephone number II1II

-

Attachments:

1) REOD'Repert, 1, page

2) National Comprehensive Report, 5 pages

APPR:_

b(6) b(7}(C).

CLASSIFICATION;

''_

INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE DAYTON RESIDENT AGENCY

3055 KETTERING BLVD, #205 DAYTON, OH 45439

(Investigations)

200800 159J-02~NOV -2001-40DY-W 1

02-November-2007

INFORMATION REPORT! REFERRED: On June 25, 2007, the Dayton Resident Agency (RA) received information f~om the Kansas City RA regardinga project that was initiated based upon information provided by the United States Attorney's Office (USAO), Eastern District of Virginia, Alexandria Division that advised the 'Immigration and Customs Enforcement (ICE) ofa national investigation that identified over 5,000 individuals who subscribed to predicated child pornography websites .. As a result of,this information ICIS and the U.S. Department of Justice/Child Exploitation and Obscenity Section designated this operation as Project Flicker.

Asa result 'of Project Flicker and the initiative from the USAO, ICE identified Individuals under Project Flicker associated with the military by either providing their .mil e~ mail addresses, Fleet Post Office (FPO),. or Army Post Office (APO) military zip codes. DClS was requested. to assist in identifying additional Department of Defense (DoD) affiliated individuals and provide investigative assistance. Targets of Operation Project Flicker that are affiliated with the military put national security at risk by compromising' computer systems/email systems and individuals with security clearances fromthe 000 compromise their clearance and 'put themselves and the interests of DoD at risk of blackmail, bribery, and threats.

revealed that he is an enlisted 03, active duty Army"

Bliss, Texas 79916. It provides a home address of_.

and hi's end date

with the Army is

begin date was

C~'-'VJJ..lU"'·JU 3 ).

b(6} b(7){C),

CLASSIFICATION:

FDR QFFICIAL USIi ONLY

A National Comprehensive Report provided from Choke Point was generated and lists

_ at • (attachment 4).

_ does not have a current Kentucky driver's license.

A criminal history was: run for _ which revealed a charge of "wrongful use of

marijuana" by the US ',' at ' Belvoir on February 2" 2005. It 11st_ as being a

.II~_ (attachment 5).

. Auny Criminal Investigation Division (CID), Fort Campbell, Kentucky, Special Agent

__ advised tha_ never resided on-base while stationed at Fort Campbell, Kentucky and that he is currently stationed at Fort Bliss, Texas. em forwarded this mformation to em Fort BUss, Texas.

This information is beingforwarded to the El paso Post of Duty (POD) for further action since Fort Bliss, Texas falls under HI Paso POD Area of Response. Any further questions regarding this report should be directed to the undersigned at telephone number"_

Attachments:

1) Flicker Targets in Kentucky, 1 page

2) DETDS Report, 1 page .3) RED D Report, 1 page

4) National Comprehensive Report, .1 0 pages

5) Criminal History" 5 pages

Prepared by • __ • Dayton RA DISTR: 4QSL!30FO/jOHS!30EP (electronically only)

APPR:_

b(6} b(7){c:;)

CLASS I F.ICJ\'l' ION ;

I

INSPECTOR. GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE SACRAMENTO POST OF DUTY

2800 COTTAGE WAY, SUITE W~1946 SACRAMENTO, CA 95825

(Investigations)

200800 168S-0.5-NOV ~2007-50SM-UO!X (lR) SSN:_ UNK

5- November-2007

INFORMATION REPORT: The DCIS Arlington Resident Agency. referred identifying information for persons with ties to the Department of Defense (000) that are in the DelS Sacramento Post of Duty (POD) area of respcnsibility (AOR) and are suspected of involvement in child pornography. The DCIS Arlington Resident Agency initially received the information from the United States Attorney's Office (USAO). Eastern. District of Virginia. The persons identified are active .. and retired military members, DoD civilians and DoD contractor employees, several of whom have or had Top Secret security clearances and all of whom used

. mil e-mail addresses to register tor access to child pornography websites.

As background, in April 2006, the Immigration and. Customs Enforcement/Cyber Crimes Center/Child Exploitation Section. (ICE/C3fCES) initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection." The investigation revealed that the same organization Was operating, numerous commercial child pornography web sites, In addition, the organization utilized various Pay Pal accounts to process, the payments for access to the member restricted websites, The investigation is being worked jointly with ICE/C3/CES., ICE/RAC1Binningham, the U.S. Postal Inspection Service, the U.S. Department of Justice/Child Exploitation and Obscenity Section, and the USAO for the Northern District of Ala.bama,.ICE has designated this: operation as Project Flicker .. lCE/C3/CES conducted over 60 undercover transactions at the advertising web sites associated with this investigation, The investtgation determined that a specific criminal organization operates. approximately 18 commercial child pornography portal websites which provide access to approximately 18 child pornography member-restricted websites, 'Using a. specific and identifiable payment website known as "iWest," The investigation identified that the criminal organization (I) uses various Pay PaJ accounts to facilitate the customer payments;

(2) uses specific subject identifiers within the Pay Pal accounts to identify purchases into the various member restricted websites; and (3J uses specific administrative e-mail accounts that are used to distribute access to the memberrestricted websites, Project Flicl<~r data was sorted to identify individuals Wh0 used their .mil e-mail address; Fleet Post Office (FPO), or Army Post Office. (APO) military zip codes to register for the Pay Pal service to access the child pornography websites, The suspects' names were queried in Dell, Auto Track and other

b{8) b(7){C)

CLASS.IFICATION:

.F8R. ,8FFUllld: Y6E8NLY

'200800168S-05-NOV -2007-50SM-UOIX (IR)

5-Novetnber-2007 2

SUBJECT was advised of his rights in accordance with Article 31; (UCMJ). SUBJF,CT acknowledged his rights; declined legal counsel and agreed to answer questions. SUBJECT provided the following information in a signed, sworn statement: SUBJECT stated some time in the past he signed up for a pornographic website. SUBJECT did not remember the exact amount he paid for access to the site. SUBJECT stated he received a username and 'password via his HOTMAIL account, SUBJECT logged into the site and began browsing. SUBJECT stated he got to a page containing what appeared to be underage females. SUBJECT stated he immediately left the website and never went back aga~n. SUBJECT signed up using a Pay Pal online cash account. SUBJECT reported the loss €If his credit card number in the past and had unknown charges on the stolen card. SUBJECTreJated one of the charges was for "Video Professor" software which was mailed to his address. SUBJECT checked with the card company and they told hirn there were several other charges. SUBJECT stated he disputed the charges, cancelled the card and was issued a new card. SUBJECT believes he lost the card last year. SUBJECT stated he has never "surfed" for child. pam. SUBJECT has received several emails advertising porn sites but he just deletes them. The site he paid to access had adult women on the first page. On subsequent pages of the site. there were thumbnail images showing females approximately 10 years of age. SUBJECT stated he Jeft the site when he saw the underage females. SUBJECT stated he never looked at the. child porn images. Additionally, SUBJECT stated verbally he looked. at the website for "one or two hours" before noticing the underage females. Agents inquired. into the possibility ofa consent search of his' computer. SUBJECT stated he didn't feel comfortable with anyone looking on his computer. Consent was refused. Due to' SUBJECT currently being on terminalleave awaiting his retirement and 110 substantial evidence found concerning the allegation, no further investigation is warranted. SUBJECT provided investigatorswith a signed, sworn statement,

applicable databases. This investigation was coordinated with the Air Force Office of Special. Investigations, (AFOSI), Travis Air Force Base, ·CA.

In Summary, SUBJECT was identified by PROJECT FLICK.ER, as a possible paying m .. ember-of a website containing Child .. pomo~ Septem ... ber 2. 7., 2007, an interview Of. SUBJECT was conducted by"_~, DCIS, Sacramento POD, Sacramento,

CA. . APOSI Detachment 303, Travis AFB, CA. SUBJECT was advised of his

rights to 31, Uniform Code of Military Justice (UCM1). SUBJECT

acknowledged he understood his rights, declined legal counsel and stated he was willing to answer questions, SUBJECT admitted to paying approximately $97.00 through a Pay P~J account for access to a pornography website, SUBJECT stated he logged on and viewed the site for 1.-2 hours before noticing thumbnail images of females approximately 10 years of age. SUBJECT stated he. immediately left the site and never went back. ICE records indicate SUBJECT only visited the site once. SUBJECT was released to his supervisor with no further investigative steps planned.

b{6} b(7}{C)

CLAS'SIFlCAT.ION: .

I

200800168S-05-NOV-~WOT-50SM-UOIX OR)

5-Novembet-2001 3

-

-

Attachments

1. Rights Advisement form, September 27, 2007

2. Signed, Swam Statement of_,_ dated September 27,2007.

Prepared by: .... _; Sacramento Post of Duty

DISTR: 60DC .

AP,PR:_

b(6} b(7}{C)

CLASSIFICATION: