Opinion ID: 811893
Heading Depth: 2
Heading Rank: 3

Heading: ICAC Seizes Cameron's Computers

Text: On August 3, 2007, NCMEC sent a report (CyberTipline Report) of child pornography found in the lilhottee00000 Yahoo! account to the Maine State Police Internet Crimes Against Children (ICAC) unit. NCMEC later sent another CyberTipline Report to ICAC, this time regarding child pornography found in the Yahoo! Photo account of user harddude0000. Both CyberTipline Reports listed the same IP Address, 76.179.26.185, in the Suspect Information section. Each report also noted that [t]he IP included in this report is the most recent file or image upload IP available, and then listed the date and time of the most recent upload.3 ICAC detective Laurie Northrup (Northrup) determined that the IP address 76.179.26.185 was part of a pool of IP addresses that Time Warner, an Internet Service Provider (ISP), distributed to its Internet access customers. Through a subpoena to Time Warner, Northrup determined that the IP address 3 Moreover, the IP Address contained in each of the CyberTipline Reports matched the Suspect IP Address contained in its corresponding Yahoo! CP Report, although we do not know whether this is by pure coincidence or if both IP Addresses really refer to the computer that originated the most recent image upload. As we mentioned earlier, the Yahoo! CP Reports did not state whether the Suspect IP Address contained therein was the one from which the most recent image had been uploaded, a representation which was in fact made by in the CyberTipline Reports. -8- 76.179.26.185 had been assigned to the Cameron residence in Hallowell, Maine during the relevant time periods. On December 21, 2007, Maine police executed a search warrant at the Cameron residence. Officers found four computers at the residence: a Compaq desktop, a Dell laptop, an HP desktop with an external hard drive, and an eMachines desktop with an external hard drive. ICAC also executed a search warrant at Cameron's workplace and seized his office computer. ICAC's preliminary examination of the computers in Cameron's home (conducted on site) indicated possible child pornography on the HP desktop. This examination also indicated that certain Yahoo! accounts had been accessed from the eMachines computer. Northrup later requested information from NCMEC related to these accounts. In March of 2008, forensic examiner Scott Bradeen (Bradeen) examined Cameron's five computers and external hard drives. For each computer, Bradeen determined the IP addresses from which the computer had accessed the Internet. Bradeen found evidence that someone had accessed seventeen different Yahoo! accounts, including those that were the subject of the reports that NCMEC originally sent to ICAC, from various computers in Cameron's home. In addition, Bradeen found child pornography images and transcripts indicating that someone using Cameron's computers had signed into Google Hello using one or more usernames to send and receive child pornography images. Bradeen found child pornography -9- images on Cameron's Dell laptop and on his HP desktop. Bradeen found no child pornography on the Compaq desktop or on the eMachines desktop. However, the Internet history stored on the eMachines desktop showed that someone had executed Internet searches for terms related to child pornography.