Chiapas Cyber Crime Unit Uses Digital Evidence to Tie Suspect and Clients to Sexual Exploitation of Minors

Text Messages Lead to Human Trafficking Bust
The rapid adoption of cellphone usage worldwide and the growing number of device models is both a blessing and a curse for law enforcement agencies investigating child sexual exploitation cases. While the number of possible evidence sources such as smart phones, computers, Cloud and Apps continue growing, the ability to access, manage and analyze the terabytes of incoming data is overwhelming many crime labs.

Investigative teams need tools that can streamline the process, preserve digital evidence in a forensically sound manner and allow the output of easy-to-read reports so prosecutors can make their cases stick in court. Cellebrite’s Digital Investigative solutions, which support thousands of mobile devices and more than 31,000 device profiles, are helping law enforcement agencies across the globe solve more cases faster as a recent child exploitation case in Chiapas, Mexico illustrates.

“Crimes Against Human Dignity” Increasing in Chiapas
Chiapas is Mexico’s southernmost state and shares a border with Guatemala. It is also the Mexican state most vulnerable to human trafficking.

Rapid growth in mobile device and internet use has been helping fuel the expansion of “crimes against human dignity” in Chiapas, including human trafficking, child pornography and the digital dissemination of intimate content, according to Inspector General Levi Pineda. He heads the forensic lab for the Cybercrime Police Unit of the Secretaría de Seguridad y Protección Ciudadana, Gobierno de Chiapas and is a well-known and respected investigator in Mexico. He often shares best practices with his peers on how to approach investigations and use technology like Cellebrite’s in their work.

Solving crimes against women and minors in Chiapas and tracking the overall scope of this activity has been challenging due to data irregularities in investigations that make it difficult to prosecute criminals and ensure that charges stick. One way government officials in the state are working to address this issue is by strengthening the state’s overall forensics capability.

Inspector General Pineda and his team are on the front line in helping the government of Chiapas collect and document data more effectively in criminal investigations. And they are using Cellebrite’s solutions to gather and analyze digital data from an increasingly diverse range of mobile devices that they encounter in their investigations — and provide clear and compelling reports to prosecutors that are helping them send — and keep — criminals in prison.

A Mandate to Uncover Recruiting Methods for Human Trafficking
The Cybercrime Police Unit, established by the district attorney’s office, is where Inspector General Pineda leads a multidisciplinary team of 13 investigators. Many of the investigators have IT backgrounds and certifications.

“Our team is extremely resourceful,” said Inspector General Pineda. “And our professional certifications help to further validate the work that we do, especially when we need to collect digital data manually in investigations.” He said his team has also been receiving direct training from the forensic lab of Mexico’s National Guard since 2015. In 2021, they plan to engage in Cellebrite’s training to earn certifications.

The Chiapas police force, which has 15 officers, partners with the Public Ministry on investigations. They tap the Cybercrime Police Unit for cases that require digital investigations collection and digital forensics analysis. Fraud and extortion are crimes the Chiapas police must investigate regularly. Often, organized crime actors are involved in these cases. Since these crimes can inflict a heavy psychological toll on victims, Inspector General Pineda said the Cybercrime Police Unit must often work closely with psychologists and attorneys during their investigations.

The Chiapas police and the Cybercrime Police Unit are tasked with identifying the means of recruitment for human trafficking – in fact, it is part of their mandate. To fulfill that mandate, Inspector General Pineda said his team closely monitors and analyzes social media to detect posts that might be related to human trafficking. “We identify a suspicious post and collaborate with the Public Ministry to investigate it,” he explained, adding that the district attorney provides feedback on that “first evidence” and authorizes whether the police can investigate further.

The Need to Gather Compelling Evidence in a Very Short Time Window
Sometimes, the Chiapas police collaborate with the private nonprofit organization, National Center for Missing and Exploited Children (NCMEC), which is based in the United States. NCMEC serves as the national clearinghouse and resource center for information about missing and exploited children. NCMEC’s worldwide database is an invaluable resource for investigators working on child exploitation cases. While NCMEC does not actively participate in investigations, copies of seized materials can be sent through law enforcement liaisons who can compare seized data to information in NCMEC’s database to determine whether an exploited victim has appeared in any other cases in the U.S. or internationally.

“NCMEC will send evidence to us, through the Mexican National Guard, about tracking and pornography cases,” Inspector General Pineda said. “Our organization will do the preliminary, desk-based investigation. And then, if there’s a field investigation, the Cybercrime Police Unit is often called in to handle digital forensic analysis. We work under an approved model that was created and is governed by the Mexican National Guard, through the General Scientific Division.”

For that work, the Cybercrime Police Unit will often use Cellebrite Inseyets (formally known as UFED) to access and extract digital data from mobile devices and Cellebrite Physical Analyzer to turn encrypted data into actionable intelligence for investigations. These tools have been invaluable for gathering evidence in many human-trafficking cases, according to Inspector General Pineda, especially when there’s only a short time window available to extract data.

He points to a recent case involving the prostitution of minors. The Prosecutor’s Office in Tuxtla Gutiérrez, which is the capital of Chiapas, reached out specifically to the Cybercrime Police Unit for assistance with a “communication intervention” in the investigation. That investigation centered on one individual, whom the Public Ministry described as someone “engaged in prostituting minors and transporting them aboard a motorcycle taxi” to local motels where they would meet clients.

“Under Mexican law, judicial authorization of any type of communication intervention is required for evidence discovered or extracted to be considered valid by the courts,” said Inspector General Pineda. “We were tasked with providing evidence that the suspect was engaging in the activity described. And the Public Ministry allowed us only five days to extract and analyze the data from four mobile phones.”

After explaining how they would investigate, and what tools they would use — namely, Cellebrite Inseyets (formally known as UFED) and Cellebrite Physical Analyzer — the Cybercrime Police Unit set to work collecting digital data from the devices: two Samsung phones, one LG, and one Azumi. By using Cellebrite’s technology, the team was able to extract the type of information they were looking for very quickly, said Inspector General Pineda, “We were able to see text messages relating to the child exploitation, which we were able to report on and then share with the lead investigators.”

One of the text messages from a client to the suspect read, “They recommended you, very cool. A thousand varos for the güerita.” Another read: “I’m in the hotel … bring me a cool morra.” With these and other messages that the Cybercrime Police Unit surfaced from the devices by using Cellebrite’s technology, the investigators were able to pinpoint exactly where the meetings were happening, what price the suspect was asking for the encounters with the children (less than $50 per child), and other critical details.

“These texts were proof that the sexual exploitation of minors and human trafficking were occurring,” said Inspector General Pineda. “And the investigators were able to identify the customers, as well, because their phone numbers were visible.” Most important, he said, is the investigation led to the rescue of three victims: two minors, and a young woman whom the criminal had taken as his wife but was still prostituting.

Technology That Made a “Special Difference” in a Time-Sensitive Investigation
As of August 2020, the main suspect in this case was in “preventive detention, awaiting his final hearing, which had been postponed due to the COVID-19 pandemic. Inspector General Pineda said he fully expects that, given the digital evidence his team collected in the investigation, the individual will be sentenced. The customers who are still under investigation are likely to be prosecuted, too, he said.

Inspector General Pineda emphasizes that Cellebrite’s technology was critical in this particular case because it allowed his team to do a reliable data extraction on the Azumi phone, which is a device they don’t commonly encounter in their investigations. “Cellebrite supports many different devices, more so than competing solutions, which is a reason our team prefers to use the technology,” he said.

Cellebrite Physical Analyzer also “made a special difference” in the case because of the extraction report the team was able to create. “We opted for the PDF format for our report, because we can present that at a judicial hearing and clearly show the mobile devices involved, the messages we located, and so on,” said Inspector General Pineda. “Essentially, all the evidence that was needed to prove the case.”

Reflecting on the investigation, Inspector General Pineda said he is convinced that if the Cybercrime Police Unit had not been able to use Cellebrite’s solutions, the team would have had to resort to manual methods — and likely, would not have been successful in the five-day time frame they were allotted. “Time is very important in this type of extraction when we’re under a court order,” he explained. “However, with Cellebrite, complying with the judicial mandate was not an issue. We were able to get the information from the four devices in about an hour and start analyzing it.”