Project Flicker investigation exposes vast child pornography ring

ShareThis

A four-year international investigation into the backers of hundreds of child pornography Websites has identified 30,000 customers in 132 countries, led to hundreds of American convictions, and landed the ring running the sites in Eastern European jails.

Law enforcement officials from around the world pulled back the curtain on the previously undisclosed probe in extraordinary detail for Scripps Howard News Service.

The agents revealed the workings of what they call the most significant commercial child porn bust in the Internet’s history, in which authorities from the United States, Canada, England, Italy, Belarus, Ukraine, Australia and other countries, plus Interpol and Europol banded together to close down 230 websites, dismantling what is believed to be the most sophisticated commercial child porn operation to date.

Since the websites -- with names like “Excited Angels” and “Boys Say Go” -- went offline in January, the number of active commercial child porn sites has nosedived from perhaps 300 to the single digits, said Matt Dunn, of the Department of Homeland Security’s Immigration and Custom’s Enforcement (ICE), which was the lead law enforcement agency.

“You've taken an organization that was distributing large scale child porn and removed them,” said Dunn, of the Child Exploitation Section of ICE’s Cyber Crimes Center.

FBI special agent Michael Dzielak investigated the ring with Dunn and other international partners. Like Dunn, he believes the bust has dealt a fatal blow to the child-porn-for-money market -- at least for now.

“It is a game changer,” Dzielak said of the importance of the international dragnet. “It probably puts commercial child pornography to bed, almost entirely.”

Eleven members of the child porn ring were located in Belarus and arrested in 2008. In January of this year, Ukrainian authorities arrested five more.

The ring used a variety of online and traditional payment methods, elaborate defense measures and a franchise business model one Interpol agent compared to a fast-food chain to make millions of dollars providing 10,000 Americans and 20,000 others across the globe access to images and videos of sexually exploited boys and girls, some reportedly as young as 3 years old.

Among the U.S. child-porn buyers identified by the investigation were doctors, police officers, sheriff's deputies, school teachers, attorneys and church preachers. Also snared were Department of Defense personnel or contractors, including several with top-secret security clearances. On September 15, Pentagon officials announced they were reopening their child porn investigation into 264 Defense employees or contractors based on Flicker evidence.

Leads on the American purchasers triggered more than 500 search warrants and at least 280 convictions involving ICE. Others were convicted by state or local authorities. Insufficient evidence or lack of manpower prevented other prosecutions.

Outside the U.S., other purchasers came from just about everywhere: From Andorra to Thailand, Azerbaijan to Uganda.

Where the pornographic pictures came from -- and who the young victims are -- is unclear. Dunn, section chief in the Child Exploitation Section of ICE’s Cyber Crimes Center, says many of the images were recycled from LS and BD studios, giant Ukrainian producers of child pornography raided in 2004.

When some images from the recent investigation were submitted to a national database of known child porn victims, there were no matches, records show.

Efforts to identify the children are usually unsuccessful. “The problem we have with these types of images is some are very old and there is no context to help with the identification,” Dunn said.

While the global bust is being hailed as a powerful blow against the moneymaking operation, there are no illusions that the supply of, or appetite for, such material has subsided.

Child exploitation experts say that the lion’s share of these images and videos are disseminated for free between individuals, who often belong to trust-based clubs.

But the now-revealed global investigative assault -- known by law enforcement around the world by an assortment of code names, including Project Flicker, Myosis and Tornado -- has, at least for now, eviscerated the marketplace for commercial child pornography, Dunn said.

Since 2006, the National Center for Missing and Exploited Children has seen a 50 percent reduction in commercial child pornography websites referred to its information clearinghouse, known as the CyberTipline, according to John Shehan, Executive Director for the organization’s Exploited Children Division.

A tip Dunn received in 2006 from the CyberTipline prompted the investigation into these websites.

But when the investigations started, it was far from clear that they’d net anything.

In exclusive interviews, Dunn and other authorities describe the lucky breaks -- and boneheaded choices by the criminals -- that helped them score such a major victory for anti-child porn authorities.

To be sure, the material for sale was vile. One picture on a site called “Sexy Angels” showed two naked prepubescent girls lying on a bed, legs open and vaginas showing, according to one description in an application for a search warrant based on the Flicker investigation.

The girls appeared to be very young. One teaser advertisement page for a site called "Nymphets Studio" shows four pre-pubescent girls -- the youngest perhaps seven or eight years old -- completely bare except for a tiny icon over their lower private parts.

Other pornographic images show toddlers.

"They're in diapers," Dunn said.

As Dunn’s office got more tips, they focused on the seemingly related sites.

Though different sites provided images and videos focusing on different fetishes, they held many similarities. For one, they had a common design and method of payment.

Initially, buyers visiting different sites were steered to a common credit-card processing website. But that site was actually a sham. After purchasers provided personal detail and credit card information on this fake payment site, they were led to a PayPal account to make the real payments.

Law enforcement officials said PayPal was not involved in the child-porn operation, and stressed the company has worked closely with investigators on the cases.

PayPal officials declined to speak about their role in the investigation, saying they are still working closely with law enforcement.

“PayPal has zero tolerance for the use of its system for any illegal materials and services,” said Amanda Pires, spokeswoman for eBay, which owns PayPal. “Because we have some of the most sophisticated detection methods in the industry, anyone who tries to use PayPal for this type of activity will be found and reported."

Mick Moran, an Interpol detective based in Lyon, France, who investigates online child exploitation, described the business structure behind the sites as a franchise model, comparing it to the burger giant McDonald's.

“These guys had out-of-the box websites. They're the exact same websites,” Moran said. “All they had to do is find a way to get paid.”

And the ring got paid very well -- making somewhere between $5 million to $8 million from early 2006 until late 2007, according to Dunn.

Details about the ring are sketchy. Aside from operating in Belarus then in Ukraine, few details about the individuals or their ties to each other have been revealed.

But what was discovered was that the ring used an elaborate system to extract cash, including:

-- Countless free “teaser” sites, which had a few images of mostly or completely naked children, and were meant to lure child-porn seekers to pay for "memberships" that gave them access to the images. The sites cost between $79.95 and $99.95 a month.

-- A fake payment processing company. On its face, it looked like a legitimate charge-card transaction processor, but its only purpose was to gather credit card information, which was then used to pay for hosting other child porn websites;

-- Between 14 and 40 American unsuspecting “mules” who unknowingly processed some 65,000 child porn transactions over PayPal and funneled the money back to the ring. Because law enforcement believes they were duped into participating, they have not been prosecuted.

Now, as the operation winds down, Dunn and others involved in the global investigation described to Scripps how they tackled an amorphous, international network that went to great lengths to protect itself.

When Dunn got a tip to check out an apparent child pornography site, he determined that images were clearly focusing on children. When Dunn’s office purchased a subscription to the material they were sent to a payment processor.

What this processor provided is the same type of service that many small merchants use when they go into business on the Internet: A third-party company, which can take credit card payments on behalf of the small business.

As Dunn’s team at ICE was considering how to proceed, they got another tip about the same website. They decided to make another purchase. This time, when they tried to pay, they were directed to a PayPal account.“This piques our interest a little bit more, for the plain and simple fact that we know that PayPal has great records and works very diligently with law enforcement,” Dunn said.

Using fake names and doctored accounts, Dunn’s team had started making undercover child porn purchases. Using fake credit card accounts and bogus names, officials at ICE would eventually make 175 undercover buys. The FBI made another 50, and authorities from other nations also contributed.

Not all the purchase attempts were successful. When Canadian authorities tried to make buys, they frequently were rejected. That’s because if a credit card tries to make too many purchases, the card automatically gets kicked out.

“You have to understand that the people who run these websites also have their security measures in place to ensure that the police aren’t coming through," said Sgt. Jackie Basque, of the Royal Canadian Mounted Police’s National Child Exploitation Coordination Center, which helped investigate.

As Dunn and others were making buys, they realized the sites all seemed to follow the same pattern: A website advertising child porn with a few teaser images of children on it, claims of a paid site with some 5,000 images, and a 30-day subscription for $79.95. The sites also shared a common payment company, called iWest. Or at least, that’s how it looked.

iWest, another payment processor, appeared to take credit card payments. It took child porn purchasers’ information, including their name, address, telephone number, and e-mail address, along with charge card information.

But it was a sham. iWest didn’t exist, and the information entered wasn’t used to purchase website access. Rather, it was simply sleight of hand. The site was a fake front door, so that the Eastern European crime ring could gather detail on who their customers were – and steal their credit card information.

Dunn said that one of his undercover credit card accounts was used to pay for web hosting, which he believes was used to propagate the child porn scheme.

When customers filled out all the information and submitted payment to iWest, they would get a message saying their registration was being processed, and that their card hadn’t been charged. It said that to complete payment, customers must go to another page.

In reality, customers were being directed to the actual mechanism for transferring money, a PayPal page.

Just as PayPal would become the crucial link for investigators to make their case, it was also the essential ingredient for the ring. It was their way of accessing American customers – and American-sized bank accounts.

But the ring either couldn’t or didn’t want to open PayPal accounts themselves. They sought help.

Their solution: Get Americans to accept the PayPal payments, then funnel the money back through traditional financial channels to Europe. The ring enticed Americans by describing the opportunity as a get-rich-quick work at home scheme, with child porn never mentioned. One investigator called these American PayPal account holders “mules,” a term normally associated with drug transporters.

Law enforcement descriptions of the get-rich-quick scheme differed. Some say the mules were enticed by promises of easy cash, others duped by being asked to be good Samaritans. What’s clear, though, is the American PayPal account holders provided the necessary link for the child porn business to work.

The sites and their PayPal system were in place by the summer of 2006. That August, as ICE agents continued to detect more sites following this pattern, they asked PayPal for help. They wanted to figure out who held the involved accounts -- especially the ones accepting the proceeds.

The success of the investigation hinged on PayPal’s willingness to collaborate with law enforcement and on their recordkeeping, regarded by Dunn, other investigators and financial experts as exceptionally good.

“They understand their system better than anyone else,” Dunn said. “They can look through and see if they find things we’re missing."

Investigators and PayPal officials identified 40 accounts that may have been linked to the child porn ring. The investigators had a decision to make: Should they close the accounts immediately, stopping the payments but also tipping off the criminal ring?

“If we had done that, we never would have found the rest of the group,” Dunn said.

That kind of decision is one that investigators often face. As with any investigation where a crime is ongoing, law enforcement must balance the long-term goal -- dismantling the criminal activity and prosecuting those behind it -- with the immediate need to limit the perpetuation of the crime.

In this case, officials decided to close most of the accounts and allow 14 to stay open, as the case developed.

One of the PayPal account holders was Michelle McCary, of Birmingham, Ala. McCary says she processed $400,000 in what turned out to be child porn subscription fees. She thought she was working for a software company.

She insists she had no idea what she was involved in, and she feels no guilt. “I didn't know about it in the beginning but had I had any knowledge of it, I would’ve felt guilt,” she said. “I am sorry I did it.”

McCary made $35,000, which was seized by authorities.

McCary was approached for the job from a posting she had placed on CareerBuilder.com. She was told she would be processing payments for a software company. Every time she asked her overseas contact to see the website for the alleged software company, her question was avoided.

Nonetheless, she kept the job for a year, between 2006 and 2007. McCary was instructed to open a PayPal account. All she had to do was watch the funds grow in her account. Once it reached $2,000, she would wire the funds to a Bank of America account controlled by someone presumably linked to the ring.

As this decision was being made, another major concern was cropping up: Law enforcement’s need to act on information before it got too out of date and thus unusable to obtain search warrants.

Though at the time there was still scant detail about who was running these sites, federal officials in May 2007 sent a dossier of purchaser names to law enforcement agencies around the United States for them to pursue the suspects. Five thousand individuals were included then. Even more Americans would be identified later.

Distributing those leads raised the same worries as shutting down PayPal accounts: tipping off the child porn ring that they were being tracked. “When we have an ongoing large-scale investigation like that, we try to sever everything,” Dunn said. However, their media blackout wasn’t perfect. “That’s why you see little things in the press, because little things have come out."

Ultimately, the decision to send out leads was driven by the concern that the PayPal records not be “stale.” They needed fresh information for search warrants, which allow investigators to find out if the suspect has child porn images on his computer's hard drive – a discovery that greatly strengthens the likelihood of conviction.

Those leads have so far resulted in 500 search warrants and at least 280 American convictions. Neither ICE nor Justice officials say they know the exact conviction numbers for Project Flicker. While they generally keep tabs on child porn conviction numbers, their records don’t indicate which probe led to a particular conviction.

Even as investigators knew who the child porn ring’s customers were, they still were having difficulty getting to those behind the enterprise. American investigators had trouble tracing the millions of dollars of proceeds out of the United States.

“Monetary flow, when it leaves the United States, becomes much more difficult to track,” Dunn said. Finding out where the funds were going could have taken years, he said.

Dzielak, the FBI Special Agent, was more blunt: “There was no ability on our end to trace the money back there” to the ring in Belarus and the Ukraine.

That’s when investigators got a lucky break. Dunn received word through the FBI, which was working with Ukrainian officials, that Belarus authorities were tracking a potential money laundering case. It sounded like there was overlap with Dunn’s investigation.

“That was a lot of luck. There’s so much information out there -- you can’t know everything that’s going on,” Dunn said. The Belarus investigation revealed the destination of the money. “We didn’t have to spend years issuing a mutual legal assistance request for this account or for that account."

The fact that Belarus investigators had their sights on the ring itself also bore an element of luck. Initially, the Belarusans weren’t even pursuing the ring for child pornography, says Moran, the Interpol agent.

Rather, authorities were investigating them for money laundering offenses, Moran said, because Belarus laws against exploiting children at the time weren’t tough enough.

“Countries over there are weak legislatively,” Moran said. “They wouldn’t necessarily have very big operational capacity in child exploitation cases."

Dunn disputes this, and says the Belarus individuals were nabbed for child pornography offenses.

Dzielak, the FBI Special Agent, says Belarus investigators may have been pursuing the ring for other more common cybercrimes, like receiving stolen property.

Belarus and Ukraine authorities, contacted through their embassies, did not return requests to comment for this story.

The Belarus part of the ring was busted up in early 2008. Between January and May 2008, Belarus officers arrested 11 individuals who controlled the sites and were involved in the payment mechanisms. All 11 have been convicted, though some are set to be released from prison in the next year after their sentences are served.

One gray area remaining is the PayPal account holders who took payment and funneled millions of dollars overseas. Because they unintentionally facilitated the child porn ring, they weren’t prosecuted. Investigators interviewed almost all the individuals, and concluded they didn’t have a case because they had no way to show that the PayPal "mules" had knowledge of what they were participating in.

“Being foolish doesn't always equal having criminal knowledge and intent,” Steve Grocki, assistant deputy chief for litigation at the U.S. Justice Department’s Child Exploitation and Obscenity Division, said of those account holders. “Showing knowledge of criminal purpose is the key. That is difficult when you know the people are just not asking questions -- they really are playing dumb or not thinking enough to ask the questions."

When the child porn ring started, it was clear that none of the PayPal account holders knew what they were supporting, Dunn said. It’s unclear how much the account holders later learned, he added.

Authorities shut down several accounts, and seized $180,000 to $200,000, Dunn said.

But the PayPal account holders are not in the clear.

“All of the individuals that have been identified as PayPal account holders are still under investigation, are still part of the investigation,” said Daniel Fortune, Assistant U.S. Attorney for the Northern District of Alabama.

While American authorities pursued the case under the codename Project Flicker -- named after the Yellowtail Flicker, the state bird of Alabama, where the case was first prosecuted -- Belarus and British authorities also investigated the ring.

But there were questions about the veracity of the evidence dug up by the Metropolitan Police of London and Belarus authorities, Moran said.

In these investigations, authorities had located the trove of fake credit card processing records. However, because the information posted on the fake credit card site could have been put there by anyone, it couldn’t be fully trusted.

“Flicker intelligence was of such high quality -- it was coming from an irrefutable source,” Moran said.

PayPal’s importance in this case was pivotal.

When prosecutors build child porn cases, they tend to rely on two types of proof: Records from payment companies or IP addresses. Then, investigators seek search warrants to inspect the suspect's computer for child-porn files.

In this investigation, the PayPal records held the case together. “It's what gets us in the door,” Grocki, the Justice official said. The challenge with Project Flicker was the efforts that the ring made to mask child porn purchases, he said.

When making a purchase, the name of the website wasn’t included in the transaction. Instead, they sometimes used technical terms from the software industry.

But the ring’s efforts weren't foolproof. Each website buy, though masked with a fake type of purchase, also came with a unique invoice number. The invoice numbers were recorded in PayPal transactions, and they had an important function for the criminal ring: Keeping tabs on which sites were big sellers and determining how to split the profits.

It also provided a code for Dunn to crack. Through undercover purchases, Dunn and other investigators were able to match these unique invoice numbers with specific websites.

Without this cross referencing system -- and without the ring’s decision to include these invoice numbers, let alone PayPal’s decision to keep the invoice records -- the purchasers might never have been caught.

“We couldn’t have identified these leads without their assistance,” said Alabama federal prosecutor Fortune, who was instrumental in handling much of the legal paperwork associated with an international case.

But after the Belarus suspects were arrested and the PayPal accounts closed, something peculiar happened. The vast majority of the child porn sites remained in operation, as if in a game of whack-a-mole.

“A simple analysis of the websites showed they were coming back up again fresh and that there were new attempts being made to get money, cash,” said Moran, the Interpol agent. “Obviously it was the same gang. But it couldn't be the same gang if they were locked up in Belarus."

Authorities around the world continued to investigate. They banded together under an organization known as the Virtual Global Task Force, an already-existing international law enforcement coalition to fight online child abuse. Members from the group -- which includes the United States, the United Kingdom, Australia and Canada -- collaborated to investigate who took over running these child porn sites.

They quickly identified five Ukrainians, who were arrested in January 2010. Finally, the child porn sites fell.

One of the lasting legacies of the global investigation is the growing relationship between law enforcement officials from member countries, according to Grocki, the Justice official.

“You begin to essentially learn intelligence from what they're seeing and what they're encountering in the commercial child pornography world,” he said.

That feedback loop has benefited investigators. “It gives you better confidence that we've actually had a pretty big dent in the system,” Grocki said.

Many officials involved in Flicker lamented the patchwork of legal systems, and the fact that extradition from some countries is prohibited.

“We work with foreign partners, and we have to respect the fact their own legal systems have to be used,” Grocki said.

But some of the ring’s backers will be out of prison soon. At least one of the convicted offenders could be released from Belarus prison in the next year or so, according to Dunn.

Investigators in the United States and around the world are watching closely to see if commercial activity resumes.

“If it starts to come back up, we’re in a much better position than historically we have been because we have this global understanding of how it works and have made successful partnerships,” ICE's Dunn said. “It’ll be easier to combat commercial child pornography if it does resurge into something like what it was."

Dunn considers this the most significant commercial child porn bust in history, but has no illusions that others won't see the busts as an opportunity to set up their own enterprise to traffic in the lucrative images. He knows, too, that there remains no shortage of content available.

“Nothing’s ever dead. Someone will come up with the idea, and they’ll do it again,” he said.

(E-mail SHNS reporter Isaac Wolf at wolfi(at)shns.com.)