Fighting Child Exploitation With Digital Forensics

Why it matters

Who will listen to the hundreds, if not thousands, of silent children who cry out for justice after being victims of manipulators or authority figures?

You would think that the answer to the question “why does it matter?” would be obvious. But it is not, which I became aware of one afternoon when I was presenting on behalf of the Florida Office of the Attorney General Child Predator Cybercrime Unit, at a major conference for Law Enforcement administrators.

During the Q&A portion I had a Deputy Sheriff ask me “Why should we spend valuable resources on a Kiddy Porn picture case?”. The question came from a female officer and it caught me by surprise. At the end of this blog, I will give you my answer to her question. But first let us examine how decision-makers feel about Child Pornography cases. (We should never use the term “Child Porn” and “Kiddy Porn” to describe the horrific crime that is being committed against children).

Why does it matter?

Children are precious members of our society and are often forgotten when “adults” talk about issues related to them. Most often crimes against children are overlooked unless it happens to you or is a major community event.


Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.


Unsubscribe any time. We respect your privacy - read our privacy policy.

Just ask the Walsh family or the Ryce Family.  Better yet, talk to Alicia Kozakiewicz who at 13 years of age on a cold New Year’s eve was abducted by someone she was communicating with online and who she thought was her age but who turned out to be a 38 year old child predator.

So, when we see pictures of children being abused, it is vitally important to understand that these children are victims of a crime that is repeated every time the picture is resold or reshared. This repetition of the crime, time after time, makes these cases so difficult mentally for investigators. These are not just “pictures”, they are in fact crimes in their own right.

Perpetrators of crimes against children are “preferential sex offenders” as defined by the Nation Criminal Justice Reference Service. They either keep items that belong to the child or they memorialize their molestation by taking pictures or videos of the child as trophies. Every time that image or video is disseminated and viewed by other preferential sex offenders that child is once again abused and made a victim.

I remember my first case dealing with the sexual abuse of a child. It was a joint case with the FBI and legacy Custom. They brought Marvin Hersh case – the former Florida Atlantic University professor who preyed on young children around the world – to my attention.

The case showed me how individuals are capable of harming even the most innocent and vulnerable in our society. Mr. Hersh would travel to the poorest countries in Central and South America and befriend poor families with many children, giving them gifts and money. Once Hersh gained the trust of these families he would then sexually molest the children. He eventually brought a child to the US with a counterfeit birth certificate. The smoking gun in that case was the digital evidence recovered from Hersh’s computer together with the 15-year-old victim’s story.

The sexual molestation of children alters them in ways that we may never know.

In 1998, I helped start the first federally funded “Internet Crimes Against Children” Task Force (ICAC). The Broward Sheriff’s Office (BSO) received one of the eight original federal grants to start the ICAC. That was when I realized how important our roles as Investigators were in combating this heinous crime.

First off, we were initiating a new frontier as law enforcement officers, entering into the dark underbelly of the burgeoning Internet. Remember this was only a few short years after the Internet Browser first debuted in 1993. Secondly, we were in uncharted territory when it came to investigate digital crimes. There were no standard police practices to guide us. Thirdly, there was no case law or precedent dealing with digital evidence. And lastly, we were dealing with digital technology like Bulletin Boards Systems (BBS), Internet Relay Chat (IRC), and News Groups, that most of our supervisors, prosecutors or judges just did not understand. On top of that we were aware that because of the global nature of the Internet we would have to deal with jurisdictional issues both within and outside the United States. This became painfully apparent in the case of Angel Mariscal on which I worked with the United States Postal Investigative Service. Here is an excerpt from the documentation of that case:

COMMITTEE ON ENERGY AND COMMERCE SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS UNITED STATES HOUSE OF REPRESENTATIVES CONCERNING “SEXUAL EXPLOITATION OF CHILDREN OVER THE INTERNET: WHAT PARENTS, KIDS AND CONGRESS NEED TO KNOW ABOUT CHILD PREDATORS”.

The Angel Mariscal case: 100-Year sentence

The second example I’d like to share with you is the Angel Mariscal case. In that case, Angel Mariscal received a 100-year prison sentence on September 30, 2004, after being convicted on seven charges including conspiracy to produce, importation, distribution, advertising, and possession with intent to sell child pornography. As with the first example I mentioned, this case was international in scope: Mariscal traveled repeatedly over a seven-year period to Cuba and Ecuador, where he produced and manufactured child pornography, including videotapes of himself sexually abusing minors, some under the age of 12. But our efforts did not stop with the arrest and prosecution of Mariscal. We launched Operation Lost Innocence to target Mariscal’s customers across the country. To date, Lost Innocence has resulted in 107 searches, 55 arrests/indictments, and 44 convictions. (Read more here)

As a Law Enforcement Against Child Harm (LEACH) and ICAC Task force member and together with Postal Investigator SA Beth Bendel, I investigated Angel Mariscal who, as the Congressional testimony indicates, resided in South Florida. Mariscal was in possession of and distributing thousands of pictures and videos of the sexual molestation of children to other like-minded child predators across the United States and globally. As the digital forensic examiner in the Mariscal case, that case showed me the volume of still images and videos created by Mariscal was daunting. Each item needed to be examined and viewed by a law enforcement officer who could then testify that in fact the individual in the images and video were minors. In 2004 the only tools I had to shield me from the screams of the children being anally or vaginally violated by these sexual predators was to turn off the sound. To make matters worse Mariscal was HIV positive and he exposed his child victims to the horrible disease.

Thankfully that is no longer the case. Today we have tools like Project VIC and VIC II which help prevent us from victimizing these children over again by having to view these images and videos.

Over the years programs such as the Wyoming Toolkit – the predecessor of Grid Cop, CPS, Roundup, ShareazaLE and National Center for Missing and Exploited Children (NCMEC) LE Portal and others – have employed the use of hashing algorithms to determine if an image or video is in fact the sexual molestation of a child. This protects both the victim and the investigator. The exploitation of children is still prevalent online and now has gone mobile and law enforcement has to keep vigilant on what media the child predator is using.

So, my answer to the Deputy Sheriff’s question. I told her about the Mariscal cases. I asked her how many officers they had investigating crimes against children. She told me they had one (1) and that Kiddy Porn pictures or videos are not “Pornography” as that image or video is a just a crime scene photo or video of the sexual molestation of a child. I then asked her how many investigators do you have conducting drug investigations? She said 20+.

I believe that drug investigations are important but to have only one investigator conducting investigations where a predator is seeking children online to molest and having over 20 investigators doing cases doesn’t make sense to me. Especially when the target is arrested and then released even before the paperwork is done and you’re arresting the same targets over and over again.

Putting time and resources into investigating child abuse images and videos is an excellent way to “serve and protect”. It defends some of the most vulnerable members of society and helps take out predators who may escalate from viewing images to physically damaging children. It deals with a real and present danger. But unless and until we viscerally understand that the images and videos are crimes in and of themselves and not just “crime scene photographs” we may never give them the serious consideration (and budget) they need and deserve.

It matters!

Author:  Wil Hernandez has extensive experience as an investigator, digital forensic examiner and as a trainer. He joined MSAB in 2015 after retiring from the Florida Department of Law Enforcement (FDLE) after over 30 years in law enforcement with over 25 of those as a digital forensic examiner. His path to the rank of Captain included assignments on multiple task forces investigating computer and Internet related crimes as well as participating in the Internet Crimes Against Children (ICAC) task force, supervisory roles in Cyber High Tech and Cybercrime Units, and teaching courses for FBI CART.

You can read more on: https://www.msab.com/blog

Leave a Comment

Latest Videos

Digital Forensics News Round Up, March 27 2024 #dfir #digitalforensics

Forensic Focus 23 hours ago

Digital Forensics News Round-Up, March 21 2024 #digitalforensics #dfir

Forensic Focus 21st March 2024 6:15 pm

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feeds settings page to add an API key after following these instructions.

Latest Articles