2
Problem Paper 1: Cybercrime Assignment
Abstract
With advancements in technology, sexual exploitation of children has increased both through
online and contact offenses. This paper addresses several issues that occurred when detectives
failed to properly investigate an incident involving sexually explicit conduct between a fireman
and a female minor. First, this paper discusses the legal issues involved pertaining to violations
of Revised Code of Washington (RCW) Chapter 9.68A, Sexual Exploitation of Children.
Additionally, this paper addresses the policies that were violated with regards to the fireman, the
detectives, and the female minor. Finally, this paper discusses the technical issues pertaining to
the failure to preserve evidence. This paper concludes by providing recommendations on how to
address the issues and the steps necessary to move forward with a proper investigation.
Key terms: sexual exploitation of children, misconduct, policy violations, investigations, digital
forensics, data recovery
3
Problem Paper 1: Cybercrime Assignment
Background
Two detectives in Kennewick, Washington, responded to a report wherein a mother
accused a local fireman of raping her sixteen-year-old daughter. When the detectives arrived at
the residence, the daughter appeared apprehensive about reporting the incident but was
ultimately encouraged by her boyfriend and mother to provide a statement. The daughter stated
that she initially met the fireman on a social media site where he invited her to meet with him in
person at the fire station. The daughter informed detectives she voluntarily went to the station
under the impression she would receive a tour. However, when she arrived at the station, the
daughter claimed she was forced to dress in department issued attire and pose for explicit
photographs. Additionally, the daughter reported the fireman in question forced her to engage in
sexual intercourse on top of a fire engine
Once the detectives gathered the daughter’s statement, they traveled to the fire station to
interview the fireman; however, he provided a different account of the incident. The fireman
admitted to being married and told detectives that he met the sixteen-year-old via Adult Friend
Finder, a chat website that allows individuals to connect who are interested in confidential sexual
encounters. The fireman stated he used the fire department’s computer to access the website and
that the female initially reached out to him; however, he was unaware that she was a minor
because she portrayed herself as twenty-one years old. After conversing with the female for
some time online, the fireman said they exchanged phone numbers and began texting.
Eventually, the female agreed to meet the fireman in person at the station where the two engaged
in consensual intercourse. When the detectives confronted the fireman about the explicit
photographs, he was cooperative and showed the detectives the photos on his digital camera. The
detectives reviewed the photos and confirmed the female portrayed was the alleged victim who
4
Problem Paper 1: Cybercrime Assignment
appeared to be consenting to the sexual acts and poses in the photographs. Additionally, the
fireman showed detectives messages between him and the daughter prior to the meet. After a
review of the elements of sexual exploitation of children under Revised code of Washington
(RCW) 9.68A, and consultation with the prosecutor’s office, the detectives determined that the
fireman had not committed a crime. The detectives deleted the images of the daughter from the
fireman’s camera and returned it to him. When the mother of the female minor learned the
detectives had dismissed the case, she filed a complaint with internal affairs, which resulted in
the mayor’s demand for removal of the detectives from the police department.
Issues
This situation clearly indicates issues regarding how the detectives conducted their
investigation, specifically regarding legal, policy, and technological (forensic) issues. Before
establishing the issues involved in each category, items of evidence must be identified to better
comprehend the severity of such issues. The first and most obvious items are the fireman’s
cellphone and camera. The camera contained the illegal images, and the cellphone contained the
text messages between the fireman and the alleged victim. Also, the fireman’s cellphone could
have contained more evidence of communication via the chat website if he had accessed it from
his phone. In addition to the fireman’s devices, due to his admission, the fire department’s
computer is also evidence as it contains the fireman’s login information for the chat website. As
for evidence pertaining to the female minor, her cell phone would be the primary device of
concern along with any other devices that she may have used to communicate with the fireman.
Legal Issues
5
Problem Paper 1: Cybercrime Assignment
Prior to discussing any legal issues, one must understand certain terms as defined in the
Revised Code of Washington (RCW) Chapter 9.68A, Sexual Exploitation of Children.
According to Section 011 of RCW 9.68A, the sexual activities referenced throughout the chapter
involve intercourse, including anal, oral, and genital. These acts can occur between individuals
of the same or opposite sex or between humans and animals (Sexual Exploitation of Children,
2023). Additional sex acts include vaginal or anal penetration by any object, masturbation,
sadomasochistic abuse, defecation or urination for the viewer’s sexual pleasure, depiction of a
minor’s unclothed genitals, pubic area, or, if female, breasts, or touching of an individual’s
genitals, pubic area, buttocks, or breasts (Sexual Exploitation of Children, 2023). Another
important definition is that of a minor, which RCW 9.68A identifies as anyone under the age of
eighteen.
Based on these definitions, there are several legal issues that occurred in the incident
involving the fireman and the minor female. First, the detectives stated they reviewed RCW
9.68A and determined no crime had occurred. Additionally, the detectives stated they consulted
with a prosecutor who agreed with their determination. However, there are several sections under
RCW 9.68A wherein the incident meets the elements of a crime. First, Section 040(b) of RCW
9.68A states that one of the elements of sexual exploitation of a minor involves aiding, inviting,
employing, authorizing, or causing a minor to engage in sexual activities with the knowledge that
such activities will be photographed (Sexual Exploitation of Children, 2023). Additionally,
Sections 070 and 075 of RCW 9.68A state it is illegal to knowingly possess or view visual or
printed images of minor individuals engaged in sexual acts (Sexual Exploitation of Children,
2023). These sections clearly apply as the fireman himself exposed images of the minor using his
own camera. Although the fireman claimed he was unaware the female was a minor, Section 110
6
Problem Paper 1: Cybercrime Assignment
of RCW 9.68A states that being unaware of a minor’s age is not a valid defense, and that the
fireman must prove that he did not have any facts on which he could reasonably have known the
female was a minor (Sexual Exploitation of Children, 2023).
Another violation of RCW 9.68A occurred through the communications between the
fireman and the female minor. According to Section 090, the fireman violated RCW 9.68A when
he communicated with the female minor because he did so for immoral purposes. Although true
intent is difficult to establish for any crime, it is reasonable to assume the fireman possessed
immoral purposes when communicating with the female minor due to the purpose of the website
used to initiate the communication. As previously mentioned with possessing or viewing images
of minors engaged in sexual acts, Section 110 of RCW 9.68A does not accept the defense of
being unaware of a minor’s age (Sexual Exploitation of Children, 2023). According to
Subsection 3 of Section 110, such a defense may only be accepted if the fireman proved that he
did not solely rely on the female’s allegations or apparent age, and that he made reasonable
attempts to verify her age via production of a driver’s license or other form of educational or
governmental identification (Sexual Exploitation of Children, 2023).
A third violation of RCW 9.68A occurred; however, this violation was conducted by the
detectives. Section 120 addresses the seizure and forfeiture of property involved in the sexual
exploitation of minors, and states that any tangible personal property used or intended for use in
manufacturing or processing visual or printed images of minors engaged in sexual activities are
to be seized (Sexual Exploitation of Children, 2023). The property owner must know of the
seizure or provided consent, and the property can be seized on arrest with the understanding that
legal process for seizure is initiated within ten days of the arrest (Sexual Exploitation of
Children, 2023). Based on Section 120 and the fireman’s admission, the detectives should have
7
Problem Paper 1: Cybercrime Assignment
immediately seized the camera once the images were verified to contain sexually explicit
conduct involving the female minor. Additionally, the detectives should have placed the fireman
under arrest and seized his cellular device and the fire department’s computer to preserve
evidence of the communications between the fireman and the female minor. The detectives
would have had ten days from the date of arrest to submit a warrant to cover the seizure of the
fireman’s devices.
Policy Issues
There are two primary policy issues that occurred during this case. First, most
departments and agencies have policies in place to prevent employees from conducting
themselves inappropriately or in a manner that could negatively affect the departments or
agencies’ reputations. In this case, violations of such policies apply to both the fireman and the
detectives. With regards to the fireman, it is standard policy for any professional work
environment to not engage in sexual activities in the workplace or during work hours. More
specifically, several department policies specifically prohibit first responders from solicitating or
participating in sexual conduct or activity while on-duty, in department-controlled vehicles, and
in or at any government facilities, including the department itself (Ritchie & Jones-Brown,
2017).
In addition to the policies the firefighter violated, the detectives violated some of their
own. First, the detectives failed to conduct a thorough investigation, which could have produced
evidence pertaining to the chats and text messages that occurred between the firefighter and the
minor prior to their meet. Additionally, an extraction of the fireman’s cell phone and camera
could have determined if he was a repeat child sex offender and possibly identified other victims.
8
Problem Paper 1: Cybercrime Assignment
Another policy the detectives failed to adhere to is a universal policy wherein law enforcement
officers do not destroy or manipulate evidence. When the detectives determined a criminal act
had not occurred, they deleted the photos of the minor on the firefighter’s camera. Regardless of
the narratives provided to the detectives, policy should have required the detectives to seize the
camera immediately to prevent loss of evidence (i.e. chats, photos, text messages, etc.).
Personnel entrusted with public service positions – such as firefighters and law
enforcement – are also naturally expected to behave professionally and in a manner that
maintains the public’s trust and the department’s reputation. According to Walsh et al. (2003),
public employees are subject to greater scrutiny and disciplinary action for their conduct due to
uniformed association with their departments and thereby their departments’ reputations.
However, although the conduct of the firefighter and the detectives are of primary importance
regarding policy violations, there is another, less noticeable violation that warrants mentioning –
the minor knowingly and willingly lied about her age. After creating a profile on a platform used
to establish sexual encounters between users, the minor knowingly and willingly claimed she
was over eighteen to comply with the platform’s policy regarding user age requirement. This
also implies that the minor knew what she was doing and understood her actions to be wrong. It
is important to remember that being a victim does not imply innocence.
Technical Issues
In addition to legal and policy issues, this situation presents technical issues pertaining to
forensic evidence. The primary and most obvious technical issue occurred when the detectives
failed to preserve digital evidence by deleting the images of the minor female on the fireman’s
digital camera. Although the images would be recoverable despite deletion, the detectives
9
Problem Paper 1: Cybercrime Assignment
granted the fireman the opportunity to permanently delete the images when they returned the
camera to him. According to Javed et al. (2022), deleted data is recoverable if not overwritten.
With a decent understanding of digital forensics, the fireman could easily overwrite the deleted
images or even destroy the camera’s memory card altogether.
Another similar technical issue occurred when the detectives failed to seize all devices in
question pertaining to the incident, including any devices the minor may have used to interact
with the fireman. By not collecting the devices involved in the incident, detectives risked the
fireman and the female minor deleting pertinent evidence, or, as a considerably worse
alternative, wiping or destroying the devices. According to Ceci et al. (2021), most devices
contain sanitizing functions that result anywhere from deleting user data and applications to
wiping encryption keys. Once a device is wiped, it is restored to factory settings wherein any
data pertaining to the user is extremely difficult to recover.
Recommendations
Considering the many issues that occurred pertaining to the incident, there are several
options on how to proceed. Priority should be preservation of what evidence remains, including
the chat website account information for both the fireman and the female minor, and the
messages, both text and website chats, between the two. According to Cinar and Bharadiya
(2023), digital architecture emphasizes the preservation of information that may be pertinent to
an investigation, including logs, proof of data custody, and timestamps. Henceforth, preservation
requests should be immediately submitted to the website Adult Friend Finder (or the company
under which Adult Friend Finder falls) to ensure the fireman and female minor’s accounts and
their associated data are properly secured. Once the accounts are preserved, investigators can
10
Problem Paper 1: Cybercrime Assignment
submit subpoenas to obtain the preserved account information and confirm ownership. Once
account ownership is confirmed, warrants can be served to retrieve detailed communications
between the fireman and the female minor, even those that may have been deleted but are stored
in the website’s server.
Another consideration for preservation of evidence would be to obtain the devices the
fireman and the female minor used to communicate in order to extract and examine the contents
and data of those communications. Despite the possibility that evidence of communications
through both the website and text messages may have been deleted by both parties, there are
several tools that can be used to extract deleted data on digital devices. According to Spranger et
al. (2022), certain tools, such as MoNA, can even compare extractions of backups with current
main databases to restore or recognize deleted messages or entire chat histories. The
communication devices, including both parties’ cell phones and the department’s computer,
should be seized either on consent or through a warrant in accordance with RCW 9.68A.
Additionally, although initial information did not reveal other devices used by the female minor
to communicate with the fireman, efforts should be made to discover any other possible devices,
such as a laptop, and seize them as deemed appropriate. At the time of seizing the fireman’s
devices, he should also be immediately placed under arrest due to his admission of sexually
explicit acts with the female minor, initial confirmation that the images were of a minor, and lack
of validity in the defense of being unaware of the female minor’s age (Sexual Exploitation of
Children, 2023).
A third focus of evidence preservation would be the camera which the fireman utilized to
expose sexually explicit photographs of the female minor. Although the detectives deleted the
images from the camera’s memory card, it is possible to recover them through certain forensic
11
Problem Paper 1: Cybercrime Assignment
tools and methods, similar to those used in recovering chats and text messages. Therefore,
detectives should seize the fireman’s camera along with his phone and the fire department’s
computer. With certain tools, recovering the images from the camera’s memory card may not
only provide proof of the sexual encounter between the fireman and the female minor, but it
could also provide additional information pertinent to the investigation, since, despite deletion,
associated content and relevant information are often left behind (Javed et al., 2022). According
to Yang et al. (2021), tools such as FTK Imager and EXIF analysis software can identify and
analyze data such as timestamps. Additionally, tools such as Autopsy can recover several other
forms of information from memory cards that can assist in criminal investigations, including
historical data that may have been deleted through formatting or erasing (Nyak et al., 2023).
An issue detectives should bear in mind moving forward in the investigation is the
possibility that the fireman recovered the images once the camera was returned to him. Through
open-source research, anyone with a basic understanding of technology can recover images from
a memory card. Depending on the length of time between returning the camera to the fireman
and initiating a formal investigation, detectives should not rule out the possibility that the
fireman recovered the images. If evidence leads to image recovery being likely, detectives
should also consider the possibility that the fireman moved the images from the memory card to
another storage method(s). According to Pasquali and Kaliyadan (2021), it is good practice to
back up files and images via a physical drive, a cloud storage provider, or even a secondary
memory card. Additionally, according to Choi and Lee (2023), offenders often hide and store
Child Sexual Abuse Material (CSAM) evidence in multiple locations. If the fireman recovered
the images, detectives should consider the images may not only be stored in multiple locations,
but also in diverse forms (i.e. digital and physical).
12
Problem Paper 1: Cybercrime Assignment
Another primary issue to address is the lack of investigative competence displayed by the
detectives. The investigation should immediately be reassigned to different detectives and the
initial detectives be placed on administrative leave until a full investigation into their actions can
be completed. Unfortunately, despite the blatant disregard for the statutes outlined in RCW
9.68A, it is likely the detectives will return to duty once the investigation is completed. Historical
cases of police misconduct have determined that it is difficult for departments to hold officers
and detectives accountable due to arbitrators habitually ruling in favor of the officers or
detectives (Rad et al., 2023).
For final consideration, and to cover all aspects of the situation, the department should
investigate the fireman’s possible patterns of possessing CSAM and committing contact
offenses. According to Steel et al. (2021), information pertaining to collection behaviors,
deletion of any past CSAM, and the underlying reasons of both may assist in revealing an
offender’s mindset, as well as an understanding of triggers that resulted in re-engagement. This
could assist in understanding any previous offenses as well, should the investigation find the
fireman is a repeat offender. Additionally, if messages reveal that the fireman was aware of the
female’s age prior to meeting, it is important to understand the reason for transitioning from
using the internet to acting on it (Steel et al., 2023).
Conclusion
Advancements in technology have allowed the internet to provide increased anonymity
and accessibility, encouraging internet crimes, including possession of CSAM and sexually
explicit communications (Christensen & Tsagaris, 2020). The incident that occurred between the
fireman and the female minor presented several issues involving legalities, policies, and
13
Problem Paper 1: Cybercrime Assignment
technical forensics. Although multiple issues occurred, including deletion of evidence and failure
to follow legal statutes, there are tools and methods that could be utilized going forward to
address these issues and retrieve any deleted or lost evidence.
References
Ceci, J., Khan, H., Hengartner, U., & Vogel, D. (2021). Concerned but ineffective: User
perceptions, methods, and challenges when sanitizing old devices for disposal. UNISEX
Seventeenth Symposium on Usable Privacy and Security (SOUPS), 455–473.
Choi, K.-S., & Lee, H. (2023). The trend of online child sexual abuse and exploitations: A
profile of online sexual offenders and criminal justice response. Journal of Child Sexual
Abuse, 1–20.
Christensen, L. S., & Tsagaris, G. S. (2020b). Offenders convicted of child sexual exploitation
material offences: Characteristics of offenders and an exploration of judicial censure.
Psychiatry, Psychology and Law, 27(4), 647–664.
Cinar, B., & Bharadiya, J. P. (2023). Cloud computing forensics; challenges and future
perspectives: A Review. Asian Journal of Research in Computer Science, 16(1), 1–14.
Javed, A. R., Ahmed, W., Alazab, M., Jalil, Z., Kifayat, K., & Gadekallu, T. R. (2022). A
comprehensive survey on computer forensics: State-of-the-art, tools, techniques,
challenges, and future directions. IEEE Access, 10, 11065–11089.
14
Problem Paper 1: Cybercrime Assignment
Nayak, S. C., Samanthula, B. K., & Tiwari, V. (2023). Investigating drone data recovery beyond
the obvious using Digital Forensics. 2023 IEEE 14th Annual Ubiquitous Computing,
Electronics & Mobile Communication Conference (UEMCON), 1–7.
Pasquali, P., & Kaliyadan, F. (2021). Photography in dermatology: Basic concepts.
CosmoDerma, 1(43), 1–5.
Rad, A. N., Kirk, D. S., & Jones, W. P. (2023). Police unionism, accountability, and misconduct.
Annual Review of Criminology, 6(1), 181–203.
Ritchie, A. J., & Jones-Brown, D. (2017). Policing race, gender, and sex: A review of law
enforcement policies. Women & Criminal Justice, 27(1), 21–50.
Sexual Exploitation of Children, R.C.W. 9.68A (2023). https://app.leg.wa.gov/rcw/default.aspx?
cite=9.68A
Spranger, M., Xi, J., Jaeckel, L., Felser, J., & Labudde, D. (2022). Mona: A forensic analysis
platform for mobile communication. KI - Künstliche Intelligenz, 36(2), 163–169.
Steel, C. M. S., Newman, E., O’Rourke, S., & Quayle, E. (2021). Collecting and viewing
behaviors of child sexual exploitation material offenders. Child Abuse & Neglect, 118, 1–
11.
Steel, C. M. S., Newman, E., O’Rourke, S., & Quayle, E. (2023). Lawless space theory for
online child sexual exploitation material offending. Aggression and Violent Behavior, 68,
1–13.
15
Problem Paper 1: Cybercrime Assignment
Walsh, W. J., Vicars-Duncan, S., & Robinson, S. (2003). Firefighters’ off-duty misconduct and
“just cause” for discipline: A Review of Arbitration Cases. Journal of Collective
Negotiations (Formerly Journal of Collective Negotiations in the Public Sector), 30(3),
199–208.
Yang, C.-C., Chuang, H., & Kao, D.-Y. (2021). Drone forensic analysis using Relational Flight
Data: A case study of DJI spark and mavic air. Procedia Computer Science, 192, 1359–
1368.
