Understanding Child Predators: Hidden Clues and Investigation Strategies
Child predators hide in plain sight. Unless we’re presented with explicit proof, we would not naturally suspect the average person within our community to harbor a dark secret. Offenders who commit internet crimes against children and possess Child Sexual Abuse Material (CSAM) often leverage this incognito effect to remain unscathed, keeping their appalling pursuits hidden from friends, family, colleagues and community members.
Yet there will be signs. Telltale signs exist in the behavioral traits and digital footprints of such individuals. And if we are astute, law enforcement can combine these clues with the right strategies to push investigations forward.
Profiling Offenders
We first have to form an idea of the perpetrator and their defining characteristics. After conducting hundreds of investigations involving child sexual abuse material including suspect interviews, I observed there are three distinct types or phases of child predators.
- Gawkers: An offender who has realized a sexual attraction to children and uses the Internet to locate images and videos to satisfy sexual desire. Gawkers often know their behavior is wrong and do not talk about it with anyone.
- Validators: An offender who is a Gawker but seeks out others with similar sexual interests to validate their feelings as normal and okay. This person may belong to groups that share files, may be actively sexually abusingchildren or may be an opportunistic abuser.
- Believers: An offender who has no concern about a sexual attraction to children and believes societal norms around child sexual abuse are close-minded. The offender will sexually abuse children and rationalize the behavior. They are convinced that children are sexual beings and need to be taught the proper way to engage in a sexual, loving relationship with an adult. These offenders can be violent, vicious sociopaths.
Most offenders do not simply begin and end with the possession and distribution of child sexual abuse material (CSAM). The Butner Study of 155 in-custody sex offenders (incarcerated for CSAM possession only) across 18 months saw a vast number of offenders disclose hands-on abuse of at least one child.
It drives home the importance of pursuing online crimes against children.
The Burtner Study challenges a particular notion—that CSAM offenders are “only involved with pictures”*. This notion implies that the actual likelihood of the offender committing a sexual offense against a child is low.
The evidence suggests otherwise.
By knowing the signs, we can stay vigilant to said offenders, who might otherwise pass unnoticed.
Know the Signs
Child offender can exhibit some combination of the following lifestyle habits and traits:
Spends longer than normal periods of time in isolation - Is often a socially awkward adult male, possessing no apparent motivation, who lives with his parents
- Has limited sexual contact with his partner or spouse
- Is controlling and defensive
- Spends long periods of time on the computer and internet
- Is an adult man or older teen who prefers to spend his time with children
- The offender may say something unusual about children or try to engage his spouse in conversations about child sexual abuse
- The offender may have been accused of sexual abuse of children in the past
These characteristics are not exhaustive or conclusive in themselves, yet these are the commonalities observed and knowing them will inform your senses for detecting bad actors if a concern about child safety arises.
Strategies for Investigators
You want to combine wisdom and strategy when handling delicate investigations.
The prevailing wisdom amongst career veterans is to maintain a calm and professional demeanor. Throughout the execution of a search warrant, be it at a residence, a public location or a privately owned space, a detailed and methodical approach should be the modus operandi.
To begin with, when serving search warrants upon a residence or business, forced entries should be avoided if possible. Remember to read the Miranda warning to everyone with an individual acknowledgment that they understand their Miranda rights. Miranda should be executed before reading the search warrant to ensure you are operating well within your legal capacity.
Once on site, scan the premises for electronic devices: computers, smartphones, servers, flash drives and other electronic devices. Make note of anything unusual—oddly placed objects and pinholes where miniature cameras could be hidden.
Today’s cameras have gotten so inconspicuous, they’ve become a common low-risk tool for predators to produce CSAM content. A quick online search would show you the various disguises they take: phone chargers, smoke detectors and clocks. Some cameras are even hidden within power outlets. These devices are interfaced with a micro-SD card or storage drive—which could contain evidence of CSAM activity. To illustrate how indiscriminate these offenders can be, recall the incident where a San Jose man installed a hidden camera in a Starbucks restroom, under the sink facing the toilet. The offender captured material from over 90 victims between the ages of four and 85.
Uncovering Information and Working with Others
Although clues can potentially be found from all occupants and witnesses, the spread of information is often asymmetrical. Identifying key individuals to interview can accelerate your investigation. As professionals, investigators also ought to be mindful of children and secondary victims, and ensure premises are not damaged during the search.
When you get around to collecting electronic evidence (i.e., smartphones) for further analysis with your Cellebrite tools, these tips come in handy:
- Attempt to get the PIN or passcode from the user or family member and if provided, write it into the search warrant
- Obtain identifiers from suspects such as date of birth, Social Security number and other significant numbers (license plates, anniversary dates, etc.)
- Lawfully collect older phones to unlock with Cellebrite Inseyets Premium
- Many of the older phones have the same passcode or something close to it
- Discuss collected information with your colleagues and get creative with passcode guesses
- Try and make a connection with the secondary victims (typically the spouse of the alleged perpetrator) who could offer valuable information to help understand the alleged offender and build your case
Direct Clues Within Emails and Messages
CSAM collectors take measures to hide their material. Predators use inconspicuous names or codes to obscure folder/file names or hide material deep within nested subfolders. However, you could still find signs of criminal activity in their social digital footprint.
As history shows, Internet crimes against children and the possession of CSAM often involve the exchange of information between like-minded predators (recall Validators and Believers). Their correspondence on emails and messaging apps could reveal clues. So, look out for:
- Friend requests or other notifications often sent to email
- Old postings, long since deleted from the native application
- Suspicious user account information
- Bonus tip: It’s not uncommon for people (also true for predators) to screenshot their messages. You can leverage Optical Character Recognition technology on Cellebrite Pathfinder to automatically extract text information from screenshots.
Staying Professional to Protect Children
The best investigators set their personal feelings aside when interviewing suspects and instead, focus on who matters: the children impacted and future children who will never have to be victimized. It is wise to pair this mission-driven attitude with the highest level of collaboration. Investigative Units (IU) and Digital Forensics Units (DFU) have to work in sync to identify the most elusive predators—who actively obscure their tracks and obfuscate evidence. If you can, share what you learn with others, including the public. They may offer you missing information and live updates on unfolding incidents, thereby giving your team a more complete picture. Because when it comes to protecting children, investigators cannot afford to miss a single detail.
Page McBeth is a veteran of the Oregon Internet Crimes Against Children Task Force where his investigative work secured the convictions of dozens of offenders. As a Customer Success Manager at Cellebrite, Page helps law enforcement professionals understand how to leverage digital investigative solutions, particularly Cellebrite Pathfinder, to connect the dots in criminal cases. Page regularly offers best practices to law enforcement when investigating crimes against children, particularly internet crimes against children. He’s well-versed in the investigative process and is a major proponent of digital forensic unit and investigative unit collaboration for the most successful case outcomes. Page’s work throughout his 30-year career helped countless victims get the justice they deserved.
** https://www.nbcbayarea.com/news/local/south-bay/san-jose-hidden-camera-starbucks/3487175/