The Secretariat of Security and Citizen Protection of the Government of the State of Chiapas Logo
The Secretariat of Security and Citizen Protection of the Government of the State of Chiapas Logo

Text Messages Lead to Human Trafficking Bust
The rapid adoption of cellphone usage worldwide and the growing number of device models is both a blessing and a curse for law enforcement agencies investigating child sexual exploitation cases. While the number of possible evidence sources such as devices (smart phones and computers), Cloud and Apps are huge and growing, having the ability to access, manage, and analyze the terabytes of incoming data from them is overwhelming many crime labs.

Investigative teams need tools that can streamline the process, preserve digital evidence in a forensically sound manner, and allow the output of easy-to-read reports so that prosecutors can make their cases stick in court. Cellebrite’s Digital Intelligence (the ability to access, manage and analyze digital data to accelerate investigations) solutions, which now support thousands of mobile devices, and more than 31,000 device profiles, are helping law enforcement agencies worldwide solve more cases faster as a recent child exploitation case in Chiapas, Mexico illustrates.

“Crimes Against Human Dignity” Increasing in Chiapas
Chiapas is Mexico’s southernmost state — and a land of contrasts. It is rich in natural beauty and history, but its citizens struggle with both food and material poverty. And while the state was recently ranked as the safest in the country, based on low rates of high-impact crime like homicide, vehicle theft, and home and business robberies, femicide has been on the rise.[1] Chiapas, which shares a border with Guatemala, is also the Mexican state most vulnerable to human trafficking.[2]

Inspector General Levi Francisco Pineda Rueda (Inspector General Levi Pineda)
Inspector General Levi Pineda and his team are on the front line helping the government of Chiapas to collect and document data more effectively using modern technologies (Inspector General Levi Pineda).

“Cellebrite supports many different devices, more so than competing solutions, which is a reason our team prefers to use the technology.”

Rapid growth in mobile device and internet use has been helping to fuel the expansion of “crimes against human dignity” in Chiapas, including human trafficking, child pornography and the digital dissemination of intimate content, says Inspector General Levi Pineda. He heads the forensic lab for the Cybercrime Police Unit of the Secretaría de Seguridad y Protección Ciudadana, Gobierno de Chiapas.[3] He is a well-known and respected investigator in Mexico, who often shares best practices with his peers on how best to approach investigations and use technology like Cellebrite’s in their work.

Solving crimes against women and minors in Chiapas and tracking the overall scope of this activity has been challenging due to data irregularities in investigations that make it difficult to prosecute criminals — and ensure that charges stick. One way that government officials in the state have been working to address this issue is by strengthening the state’s overall forensics capability.[4]

Inspector General Pineda and his team are therefore on the front line in helping the government of Chiapas to collect and document data more effectively in criminal investigations. And they are using Cellebrite’s Digital Intelligence solutions to gather and analyze digital data from an increasingly diverse range of mobile devices that they encounter in their investigations — and provide clear and compelling reports to prosecutors that are helping them to send, and keep, criminals in prison.

A Mandate to Uncover Recruiting Methods for Human Trafficking
The Cybercrime Police Unit, established by the district attorney’s office, is where Inspector General Pineda leads a multidisciplinary team of 13 investigators. Many of the investigators have IT backgrounds and certifications. Inspector General Pineda’s own list of cyber credentials includes the Certified Ethical Hacker (CEH) and Computer Hacking Forensic Investigator (CHFI) designations

“Our team is extremely resourceful,” says Inspector General Pineda. “And our professional certifications help to further validate the work that we do, especially when we need to collect digital data manually in investigations.” He says his team has also been receiving direct training from the forensic lab of Mexico’s National Guard since 2015. And in 2021, they plan to engage in Cellebrite Digital Intelligence training to earn Cellebrite certifications.

The Chiapas police force, which has 15 officers, partners with the Public Ministry on investigations. They tap the Cybercrime Police Unit for cases that require digital intelligence collection and digital forensics analysis. Fraud and extortion are crimes the Chiapas police must investigate regularly. Often, organized crime actors are involved in these cases. And because these crimes can inflict a heavy psychological toll on victims, the Cybercrime Police Unit must often work closely with psychologists and attorneys during their investigations, says Inspector General Pineda.

The Chiapas police and the Cybercrime Police Unit are tasked with identifying the means of recruitment for human trafficking – in fact, it is part of their mandate. To fulfill that mandate, Inspector General Pineda says his team will closely monitor and analyze social media, for example, to detect posts that might be related to human trafficking. “We identify a suspicious post and collaborate with the Public Ministry to investigate it,” he explains, adding that the district attorney provides feedback on that “first evidence” and authorizes whether the police can investigate further.

The Need to Gather Compelling Evidence in a Very Short Time Window
Sometimes, the Chiapas police collaborate with the private nonprofit organization, National Center for Missing and Exploited Children (NCMEC), which is based in the United States. NCMEC serves as the national clearinghouse and resource center for information about missing and exploited children. NCMEC’s worldwide database is an invaluable resource for investigators working on child exploitation cases. While NCMEC does not actively participate in investigations, copies of seized materials can be sent through law enforcement liaisons who can compare seized data to information in NCMEC’s database to determine whether an exploited victim has appeared in any other cases in the U.S. or internationally.

“NCMEC will send evidence to us, through the Mexican National Guard, about tracking and pornography cases,” Inspector General Pineda says. “Our organization will do the preliminary, desk-based investigation. And then, if there’s a field investigation, the Cybercrime Police Unit is often called in to handle digital forensic analysis. We work under an approved model that was created and is governed by the Mexican National Guard, through the General Scientific Division.”

For that work, the Cybercrime Police Unit will often use Cellebrite UFED to access and extract digital data from mobile devices and Cellebrite Physical Analyzer to turn encrypted data into actionable intelligence for investigations. These tools have been invaluable for gathering evidence in many human-trafficking cases, according to Inspector General Pineda, especially when there’s only a short time window available to extract data.

Extraction summary in Cellebrite Physical Analyzer. (Pic: Cellebrite)
Extraction summary in Cellebrite Physical Analyzer. (Pic: Cellebrite)

He points to a recent case involving the prostitution of minors. The Prosecutor’s Office in Tuxtla Gutiérrez, which is the capital of Chiapas, reached out specifically to the Cybercrime Police Unit for assistance with a “communication intervention” in the investigation. That investigation centered on one individual, whom the Public Ministry described as someone “engaged in prostituting minors and transporting them aboard a motorcycle taxi” to local motels where they would meet clients.

“Under Mexican law, judicial authorization of any type of communication intervention is required for evidence discovered or extracted to be considered valid by the courts,” says Inspector General Pineda. “We were tasked with providing evidence that the suspect was engaging in the activity described. And the Public Ministry allowed us only five days to extract and analyze the data from four mobile phones.”

After explaining how they would investigate, and what tools they would use — namely, Cellebrite UFED and Cellebrite Physical Analyzer — the Cybercrime Police Unit set to work collecting digital data from the devices: two Samsung phones, one LG, and one Azumi. By using Cellebrite’s technology, the team was able to extract the type of information they were looking for very quickly, says Inspector General Pineda, “We were able to see text messages relating to the child exploitation, which we were able to report on and then share with the lead investigators.”

“These texts were proof that the sexual exploitation of minors and human trafficking were occurring. And the investigators were able to identify the customers, as well, because their phone numbers were visible.”

One of the text messages from a client to the suspect read, “They recommended you, very cool. A thousand varos for the güerita.” Another read: “I’m in the hotel … bring me a cool morra.” With these and other messages that the Cybercrime Police Unit surfaced from the devices by using Cellebrite’s technology, the investigators were able to pinpoint exactly where the meetings were happening, what price the suspect was asking for the encounters with the children (less than $50 per child), and other critical details.

Conversation view of text messages in Cellebrite Physical Analyzer (Pic: Cellebrite)

“These texts were proof that the sexual exploitation of minors and human trafficking were occurring,” says Inspector General Pineda. “And the investigators were able to identify the customers, as well, because their phone numbers were visible.” Most important, he says, is that the investigation led to the rescue of three victims: two minors, and a young woman whom the criminal had taken as his wife but was still prostituting.

Technology That Made a “Special Difference” in a Time-Sensitive Investigation
As of August 2020, the main suspect in this case was in “preventive detention, awaiting his final hearing, which had been postponed due to the COVID-19 pandemic. Inspector General Pineda says he fully expects that, given the digital evidence his team collected in the investigation, the individual will be sentenced. The customers who are still under investigation are likely to be prosecuted, too, he says.

Inspector General Pineda emphasizes that Cellebrite’s technology was critical in this particular case because it allowed his team to do a reliable data extraction on the Azumi phone, which is a device they don’t commonly encounter in their investigations. “Cellebrite supports many different devices, more so than competing solutions, which is a reason our team prefers to use the technology,” he says.

Generating a report in Cellebrite Physical Analyzer (Pic: Cellebrite)

Cellebrite Physical Analyzer also “made a special difference” in the case because of the extraction report the team was able to create. “We opted for the PDF format for our report, because we can present that at a judicial hearing and clearly show the mobile devices involved, the messages we located, and so on,” says Inspector General Pineda. “Essentially, all the evidence that was needed to prove the case.”

“Time is very important in this type of extraction when we’re under a court order. However, with Cellebrite, complying with the judicial mandate was not an issue. We were able to get the information from the four devices in about an hour and start analyzing it.”

Reflecting on the investigation, Inspector General Pineda says he is convinced that if the Cybercrime Police Unit had not been able to use Cellebrite’s solutions, the team would have had to resort to manual methods — and likely, would not have been successful in the five-day time frame they were allotted. “Time is very important in this type of extraction when we’re under a court order,” he says. “However, with Cellebrite, complying with the judicial mandate was not an issue. We were able to get the information from the four devices in about an hour and start analyzing it.”

Sources:
[1] “Mexico’s safest state? Chiapas, security watchdog says,” Mexico News Daily, June 1, 2018: https://mexiconewsdaily.com/news/mexicos-safest-state-chiapas-citizens-group-says/.
[2] “Trafficking of women and girls within Central America,” United Nations Office on Drugs and Crime report: https://www.unodc.org/documents/toc/Reports/TOCTASouthAmerica/English/TOCTA_CACaribb_trafficking_womengirls_within_CAmerica.pdf
[3] The Secretariat of Security and Citizen Protection of the Government of the State of Chiapas.
[4] “Data Discrepancies Anger Activists as Cases of Murdered and Missing Girls, Teens Rise,” by Marissa Revilla, Global Press Journal, September 7, 2019: https://globalpressjournal.com/americas/mexico/data-discrepancies-anger-activists-cases-murdered-missing-girls-teens-rise/.