Opinion ID: 4561170
Heading Depth: 2
Heading Rank: 3

Heading: Croghan’s Conduct

Text: During the 13-day period, the FBI successfully identified a user in Council Bluffs, Iowa. The user was “Beau2358.” The e-mail address associated with Beau2358 was cbbarscene@gmail.com, and Beau2358’s password for the Playpen account was gargoyle62. Beau2358 registered with Playpen on September 27, 2014. Beau2358 logged in to Playpen on four dates during the FBI’s 13-day operation: February 20, 2015; March 1, 2015; March 3, 2015; and March 4, 2015. Beau2358 was actively logged in to Playpen for over 13 hours between September 27, 2014, and March 4, 2015. Beau2358 accessed 51 topics with over 600 images of child pornography while the NIT was active. Through the NIT, the FBI “obtained the real IP address that Beau2358 was using to access the Playpen website.” Trial Tr., Vol. I, at 77–78. The IP address associated with this user was 68.227.166.242 and was operated by Cox Communications. The IP address was registered to Croghan at his residence in Council Bluffs, Iowa. The host name for the computer was “Beaus.” The MAC address4 for the computer used to access Playpen was the 12-character unique address, 24FD523B41C0. SA Alfin confirmed that the MAC address from the NIT 4 “All . . . network adapters have a unique identifier associated with them called a MAC address, and those are 12 digits long, and they are unique to a particular device.” Id. at 75. Each computer has “a network adapter with a MAC address. It’s not going to match the MAC address in . . . any other computer . . . . It’s unique.” Id. As a result, “a MAC address can identify a particular computer within someone’s home.” Id. at 74. -5- matched the Toshiba laptop computer seized from Croghan’s residence on July 21, 2015. SA Alfin confirmed that Beau2358 “accessed” or “looked at” several different sections of Playpen: Preteen HardCore, Infants and Toddlers, Incest, and Jail Bait. Trial Tr., Vol. II, at 121. SA Alfin testified that, for example, “Beau2358 went into the Pre-teen hard core section” and “clicked on a topic.”5 Id. at 113. SA Alfin confirmed that Beau2358 “received . . . child pornography” once he “click[ed] on to the next screen” where the “first image c[ame] up or a group of images.” Id. “[A]ll of the images in the posting [were] downloaded to [Beau2358’s] computer over the Internet.” Id. at 114; see also id. at 142 (confirming that once a user “click[s] on an image and view[s] it, [the user has] received it,” “whether or not [the user] save[s] a copy to look at later”). These images “depict[ed] prepubescent children engaged in sexual activity.” Id. at 114. Special Agent Jacob Foiles (“SA Foiles”) was assigned as the case agent for Beau2358. SA Foiles had to verify that “the subscriber, Beau Croghan, still reside[d] at [the Council Bluffs] address.” Id. at 150. SA Foiles conducted “basic database checks, employment checks, driver’s license checks,” and “limited surveillance” and learned that Croghan and his wife still resided at the address provided by Cox Communications. Id. During the surveillance, SA Foiles located a wireless network that was password protected and associated with Croghan’s residence and the Cox Communications subscriber subpoena. SA Foiles also conducted an open-source internet search on Beau2358 and discovered that a user account on PrimeJailbait.com matched the user name from Playpen. Beau2358 had uploaded five images on PrimeJailbait.com. The open-source 5 “[P]re-teen means prepubescent children, and hard core means some type of penetrative sexual activity.” Id. at 113. -6- internet search also uncovered “a blog posting that was reportedly authored by a Beau Croghan.” Id. at 151. In that blog post, the author mentioned that he was interested in computers, interested in web development, and had three children. SA Foiles also subpoenaed Google for the e-mail address cbbarscene@gmail.com and learned that the e-mail account had a recovery e-mail address of Beau2358@gmail.com. SA Foiles conducted open-source internet searches for cbbarscene and found Facebook pages, a LinkedIn page, and YouTube videos related to cbbarscene. In addition, SA Foiles received employment information, including Croghan’s social security card ending in 2358. These digits matched the last four numbers of the Playpen user Beau2358. SA Foiles also obtained Croghan’s work history and confirmed that Croghan was not at work during any of the times that Beau2358 accessed the Playpen network during the 13-day period. Law enforcement executed a search warrant at Croghan’s residence on July 21, 2015. In the master bedroom, law enforcement found a Toshiba laptop on a computer desk. SA Foiles identified items on the computer desk indicating that Croghan was “a computer savvy individual.” Id. at 166. First, SA Foiles found a computer fan that was either removed or purchased. Second, he discovered four internal hard drives typically found inside of a laptop or desktop computer. He noted that “the average user [does not] typically remove[] those or know[] how to remove those from a computer.” Id. at 167. Third, SA Foiles found a Linux operating system, which, “generally speaking,” “more technologically savvy individual[s]” use. Id. Programs running on a computer store data in random access memory (RAM). A computer’s RAM is “a small portion of storage that is used to hold information in an effort to speed up the user’s performance on that computer.” Id. at 204. “RAM is considered volatile, which means if it loses power, then it will be flushed, and there will be no data there.” Id. At the time of the search warrant, the Toshiba laptop was on; the desktop displayed a folder and shortcut for, among other things, the Tor -7- browser. Because the laptop was on, FBI Computer Forensic Examiner Jordan Warnock was able to retrieve the computer’s RAM data through a forensic procedure and save that data. Trooper Scott Haugaard of the Nebraska State Patrol, an investigator specializing in computer forensics, forensically examined an exact copy of Croghan’s hard drive and “RAM dump.” Id. at 207. Based on his examination, Trooper Haugaard was able to identify characteristics of the Toshiba laptop. He identified the MAC address and host name associated with the Toshiba laptop as being the same one that the FBI obtained with the NIT and provided to him. Trooper Haugaard conducted a keyword search for Beau2358 and found that the keyword was “used hundreds of times over and over again.” Id. at 238. Additionally, he conducted a keyword search for gargoyle62—Beau2358’s password on Playpen—and discovered that it was also the password for a flight simulator game linked to the Gmail account Beau2358@gmail.com. Trooper Haugaard’s forensic exam revealed that the Tor network was last accessed on the Toshiba laptop on July 19, 2015. A VideoLAN Controller (VLC) was downloaded on Croghan’s hard drive. A VLC is a third-party program downloadable from the Internet that plays videos without discriminating against file extensions. Once someone downloads a VLC, “it create[s] . . . subfiles in the computer that track the activity of the VLC.” Id. at 244. The VLC creates a log of its recent history. According to Trooper Haugaard, Croghan’s recent history included the video file name “Baby . . . 0yo suck penis.avi.” Id. at 247–48. Trooper Haugaard was unable to find this video or locate any other child pornography on the Toshiba laptop. He explained that what he found was “a history of a video that was loaded into the VLC program.” Id. at 248. Trooper Haugaard also identified a Windows media video file name with the keywords “pthc” (“preteen hard core”) and “opva” (“prepubescent child”). Id. And, he identified a video file named “6yrsgrl1.avi,” which stood for “6- year-old girl.” Id. at 249. In addition to these recent video file names, Trooper -8- Haugaard located a “bookmark” or “quick reference guide” in the computer’s browser under the Beau user name for a Russian website containing child exploitation material and adult pornography. Id. at 251. Trooper Haugaard was not surprised that he did not find any child pornography on Croghan’s Toshiba laptop. In his experience, “people who use Tor or networks like Tor want to be anonymous.” Id. at 262. While Trooper Haugaard did not locate any child pornography on the computer, he did locate “some child pornography artifacts” through, for example, the VLC. Id. at 276.