This is article 2 in a 3 part series. 

This story is about a few officers in Seattle, WA, but their narrative is a strong reminder that there are good cops everywhere solving heinous crimes and putting their lives on the line for citizens around the world.

Detective Ian Polhemus and his dog, Bear, work as a team to find digital devices hidden by child-exploitation offenders at crime scenes. (Credit: Seattle PD)

The officers you are about to meet work for the Seattle PD, a department that saw its city turned upside down last summer in the wake of George Floyd’s death and, more recently, when protests arose over the presidential election. Yet despite the chaos around them and the anti-police rhetoric that followed, these officers have remained steadfast in their duty to save children from the horrors of sexual abuse.

Detectives Randy Kyburtz and Ian Polhemus have served with the Seattle PD for 29 years. Like most officers, they came up through the ranks starting first as patrolmen. But their “calling” ultimately lead them in a different direction—first to forensics and, eventually, to the Internet Crimes Against Children (ICAC) unit, a special branch of the Seattle PD dedicated to solving cases involving the sexual exploitation of children.

It’s not an easy job, but as Michael Edwards, Captain for the High-Risk Victims Section and Statewide Commander for the Washington State ICAC Task Force said recently, “If not us, then who?”

The Fight To Save Children

The latest statistics from the National Center for Missing & Exploited Children (NCMEC) tell the dark truth: crimes involving children are reaching pandemic proportions.

NCMEC reports that in 2019, their CyberTipline received more than 16.9 million reports related to apparent child sexual abuse material, online enticement (including “sextortion”), child sex trafficking, and child sexual molestation.

Of those reports, 150,667 came from the public while 16.8 million were from electronic service providers.

Globally, the number is even more shocking with the International Labor Organization estimating that 1.8 million children are being exploited in prostitution or pornography worldwide.

“I mean, these are true victims. These kids, who are apparently being put in these positions, they are the true victims. And it’s very, very rewarding when you have a case and you find out that you were part of something where kids are getting rescued.”

Dealing with these crimes isn’t easy, but Detectives Kyburz and Polhemus take the challenges in stride. Like many of us, the two are hard-working employees who own homes, pay bills, and love their families. What sets them (and the millions of officers just like them) apart, however, is that they’ve dedicated their lives to helping and protecting others.

Welcome to Seattle ICAC

Seattle PD’s ICAC unit has a big job. Not only are they responsible for addressing the needs of their local department, but their office is also the lead agency for the entire state in addressing crimes against children. This makes them responsible for triaging any cases relating to Washington state that come in from NCMEC. They also assist with outside law enforcement requests as well as those made by foreign agencies.

ICAC Internet Crimes Against Children Task Force program makes a significant impact on solving more child exploitation cases faster (Credit: www.icactaskforce.org/)

The unit works closely with the national ICAC program (there are 60 additional ICAC agencies scattered across the US) and their task force group includes members from critical investigative arms of the Department of Homeland Security, FBI, US Postal Service, and several other agencies. They also work with smaller agencies that may not have the staffing or technical capabilities in their Sexual Assault Units to solve child-related sexual offenses.

Training investigators in crimes against children is also their responsibility, and they work seamlessly within both the state and federal prosecution arenas.

In his 40 years with the department, Captain Edwards has seen major shifts in the investigation landscape, changes that have made a profound difference in the way his team conducts investigations, the workflow they use, and the digital solutions that are now providing the majority of evidence in ICAC cases.

“We’re utilizing technology in a much broader way than we ever have in the past.”

One constant, however, has been his team’s dedication to their mission: finding and rescuing children and assisting in the prosecution of sexual predators to ensure that justice is served.

The Changing Landscape

Managing this two-pronged mission creates a huge burden; a load made even heavier by the many challenges Captain Edwards and his team members face.

Rescuing children and prosecuting sexual predators are the primary goals for Captain Michael Edwards, Statewide Commander for the Washington State ICAC Task Force. (Credit: Auburn-reporter)

Increased caseloads: Like police departments everywhere, the growth in the population base and the rapid rise in technological advancements has fueled a steep rise in child sexual abuse cases. As Captain Edwards recently recalled, back in 2014 his team averaged 125 to 150 referrals a month. (This didn’t include those who walked into the police station to lodge complaints). Today, his team averages 425 to 450 referrals a month with some months topping 1000.

More devices: As Detective Polhemus described, “When I started in ICAC seven or eight years ago, you’d go into a search warrant and you’d come out with this big old tower of a desktop computer, a cell phone, and maybe one or two other devices. Jump drives, SD, and microSD cards were still not really a huge thing.

“Fast-forward to 2020 and we go into a search warrant, and sometimes come out with 30, 40, or 50 pieces of evidence that may include a substantial number of those smaller devices—the SDs, the micro-SDs, the thumb drives that often don’t even look like thumb drives…We’re not talking about an 8MB SD card anymore. We’re talking about SD cards that rival the size of hard drives of eight to 10 years ago.”

Device sophistication: As technology has advanced, the types of devices (many are now highly encrypted, which adds extra hurdles to data collections) coupled with the ability of devices to hold far more data than ever before (up to a terabyte or more depending on the model) slows the investigation process.

Today’s cell phones hold more data than ever before. Cellebrite Pathfinder automates the ingestion, analysis, and visualization of data to quickly surface leads from mountains of information.

More apps mean more data: As Detective Kyburz said, “there’s so much more being reported by the ESPs (Electronic Service Providers) out there because there are so many more apps and chat methodologies and things like that that the perpetrators are using that didn’t even exist before.”

All of this adds up to mountains of data that digital investigators must sift through, and this process needs to be handled carefully. Having the right protocols and trained personnel in place is critical to ensure that data collection from devices is performed in a forensically sound manner that preserves the chain of evidence so that all relevant evidence is permissible at trial.

How DI is Helping

To address the sheer volume of cases coming in while meeting the rising demand for digital evidence, departments like Seattle’s ICAC unit have had to transform the way they handle digital investigations.

“We’re utilizing technology in a much broader way than we ever have in the past,” Captain Edwards remarked. “That said, we also have it localized to unique units within the agency as a whole.”

And it turned out [that evidence] immediately helped rescue a little girl in Australia. And it also then broke a little bit more globally…it was kind of a ring of people sharing information and doing this, and they [law enforcement] rescued a few other children in some other countries. All from what started out as just a random case [and] just a few cell phones.”

Cases are now triaged so that the most time-sensitive cases are addressed first. “Time is our enemy. And anything that increases that time profile makes it so much more difficult. So everything from storage, encryption, the fact that now even the storage itself is no longer just on the device itself, it’s up in the Cloud, [or] it’s internationally-based… There are all of these other things that we’re dealing with that we weren’t dealing with a few years ago that are causing us to now elongate that time period.”

For a child who’s in trouble, having the right training and tools is critical to attacking these cases quickly and developing actionable intelligence fast. This is why the Seattle ICAC Unit relies on a full suite of Cellebrite solutions to handle everything from mobile phone and computer data collections to data analytics.

Cellebrite Physical Analyzer enables users to decrypt, decode, analyze, and validate data from the broadest range of mobile applications, digital devices, warrant returns, and the Cloud. (Credit: Cellebrite)
Cellebrite Physical Analyzer enables users to decrypt, decode, analyze, and validate data from the broadest range of mobile applications, digital devices, warrant returns, and the Cloud. (Credit: Cellebrite)

Mobile device data collection is handled by Cellebrite UFED 4PC and Cellebrite UFED Premium. Cellebrite Physical Analyzer allows the team to decrypt, decode, analyze, and validate data from the broadest range of mobile applications, digital devices, warrant returns, and the Cloud.

On the computer side, Cellebrite Digital Collector handles all Mac-related data recoveries while Cellebrite Inspector provides a quick and comprehensive analysis of macOS and Windows computer volumes.

Cellebrite Inspector provides a quick and comprehensive analysis of macOS and Windows computer volumes. (Credit: Cellebrite)

While technology provides critical evidence that might be missed by manual reviews, solving cases still requires the human thought process to put all the pieces together.

“Coming into the job from being a detective first, rather than just coming in from the outside and trying to learn how to put the pieces together [is a big advantage],” Detective Kyburz said. “Obviously, there’s a lot of training involved, both before actually doing any work on the forensics side as well as what we consider to be the ‘business side’ of it https://cellebrite.com/en/law-enforcement/investigation/. How do the perpetrators act? What do they do? How are they going about what they do that’s the illegal activity? What device or devices were they using to do this?”

Finding evidence by asking the right questions and utilizing the latest digital technologies has helped Seattle PD’s ICAC rescue hundreds of children, sometimes on the other side of the world. A case four years ago that Detective Kyburz helped solve followed the typical pattern of investigations he’s involved with, but its ending had far-reaching consequences.

Freeing Captured Children a World Away

It started with just a couple of cell phones. “No big deal,” Detective Kyburz began.

His instructions were straightforward—collect the data and provide the report to the case detective who, in turn, submitted his findings to NCMEC.

What was unusual was that NCMEC came right back to the detective and asked her for more information on where the pictures she had submitted in her report came from.

I provided that information,” Detective Kyburz said. “We kind of did this whole thing. And it turned out [that evidence] immediately helped rescue a little girl in Australia.

“And it also then broke a little bit more globally, beyond even just the U.S. and Australia. From what I understand, it was kind of a ring of people sharing information and doing this, and they [law enforcement] rescued a few other children in some other countries. All from what started out as just a random case [and] just a few cell phones.”

Training is Key

When it comes to fighting crimes based on Digital Intelligence, the data that is accessed and collected from digital sources and data types—smartphones, computers, and the Cloud—and the process by which agencies access, manage, and leverage data to more efficiently run their operations, training is key. Having a manager like Captain Edwards, who emphasizes training and new ways to improve the skills of others, gives Seattle’s ICAC unit a big advantage. Their annual Northwest Regional ICAC Conference (now in its 7th year) is a case in point.

“Working in ICAC, you honestly feel like ‘This is great work.’… Nowadays, if you look at the political environment and everything, especially in this area [Seattle], there are things that the public deem not necessary for police to work on for better or worse. This [solving child sexual exploitation cases] is not one of those things.”

The ICAC Conference expands the efforts and knowledge base of law enforcement investigators, digital forensic examiners, and prosecutors by providing highly specialized training focused on investigating and prosecuting technology-facilitated crimes against children. (Credit: ICAC)

This five-day event (spearheaded by Detective Polhemus) provides a forum for investigators, prosecutors, forensic examiners, industry professionals, and academics to come together to learn, collaborate, and share their knowledge of digital crime investigations into child sexual exploitation cases.

Unlike years past, this year’s event was completely virtual, but it was also a total success. Participants enjoyed 42 sessions over two days and the 571 attendees represented 43 U.S. states and eight foreign countries. “It gets bigger and bigger every year,” Detective Polhemus said proudly. “We incorporate more U.S. states, more foreign entities. So what started out as a Washington/Oregon/Idaho Conference has now grown internationally.”

For The Greater Good Of All

Being a law enforcement officer under any circumstances is difficult, but there is something about dealing with cases that involve crimes against children that is deeply challenging. It takes a special kind of individual to dedicate themselves to this kind of work and in the end, most investigators don’t make a career of it.

According to Captain Edwards, the average life span of an ICAC investigator is five to seven years. Why? Because having to review evidence that shows the exploitation of innocent children is simply too big a burden for officers to bear.

Knowing this made my final question to the two detectives inevitable: Why are you still doing this? Both answered in different ways but struck a common chord: it’s about protecting kids.

Detective Kyburz: “Working in ICAC, you honestly feel like ‘This is great work.’… Nowadays, if you look at the political environment and everything, especially in this area [Seattle], there are things that the public deem not necessary for police to work on for better or worse. This [solving child sexual exploitation cases] is not one of those things.

“Trying to find people that somehow believe that going after these people is not a good thing is obviously [not an issue]… We joke about it being the last bastion of socially acceptable police work. And to some degree it kind of is that, not to be flippant about it. But it is very important work.

“I mean, these are true victims. These kids, who are apparently being put in these positions, they are the true victims. And it’s very, very rewarding when you have a case and you find out that you were part of something where kids are getting rescued.”

Detective Polhemus: “We obviously are very impacted by the negative impressions regarding law enforcement in general, which I think, just from a morale perspective, whether you’re from Seattle or you’re from a 10-person agency in the middle of the country somewhere, is very degrading. It’s very hard to deal with day in and day out.

“Not to sound too clichéd about it, but I think the vast majority of us who come into law enforcement do so out of a calling. It’s that wanting to do good for the community, wanting to help others who are less able or adept at helping themselves [that draws us].

“I describe my tenure in ICAC as singularly the most rewarding. And that is because we’re dealing with children. Every case we investigate involves children; it involves felonies. And really, when you look at wanting to help and make a difference, the most vulnerable parts of our communities in my opinion are children and the elderly. So anything that we can possibly do to positively impact the lives of those particular parts of our community, again, I find it very rewarding.

“And despite all of the anti-police/defunding rhetoric that continues…I find that the overall reward in what we do far outweighs the negative politics that are going on around us.”

K-9’s are helping too – Sniffing electronic devices are key to keeping kids safe online. Read more here.

Read Part 1: The Power Of A Calling: Seattle PD ICAC Unit Puts Digital Intelligence To Work To Stop Crimes Against Children

Part 3: Training: The Most Important Investment Agencies Can Make