25-May-2010. 30-August-2010

Description of document: Requested date: Released date: Posted date: Date/date range of documents: Source of document: Department of Defense (DoD) Inspector General (IG) final report and closing memo for Defense Criminal Investigative Service (DCIS) Operation Flicker, 2007-2010 25-May-2010 30-August-2010 06-September-2010 06-June-2007 08-April-2010 DoD IG FOIA Requester Service Center Office of Freedom of Information 400 Army Navy Drive, Suite 1021 Arlington, VA 22202-4704 Fax: 703-602-0294 The governmentattic.org web site ( the site ) is noncommercial and free to the public. The site and materials made available on the site, such as this file, are for reference only. The governmentattic.org web site and its principals have made every effort to make this information as complete and as accurate as possible, however, there may be mistakes and omissions, both typographical and in content. The governmentattic.org web site and its principals shall have neither liability nor responsibility to any person or entity with respect to any loss or damage caused, or alleged to have been caused, directly or indirectly, by the information provided on the governmentattic.org web site or in this file. The public records published on the site were obtained from government agencies using proper legal channels. Each document is identified as to the source. Any concerns about the contents of the site should be directed to the agency originating the document in question. GovernmentAttic.org is not responsible for the contents of documents published on the website.

INSPECTOR GENERAL DEPARTMENT OF DEFENSE 400 ARMY NAVY DRIVE ARLINGTON, VA 22202-4704 Ref: 10-00246-F August 30, 2010 OCCL This is the final response to your electronic Freedom of Information Act (FOIA) request dated May 25, 2010, seeking "a copy of the final report and closing memo for DCIS Project Operation Flicker (Case Control Number 200701 199X). " We received your request on May 26,2010, and assigned it case number 10-00246-F. The enclosed documents are responsive to your request. I am, however, withholding port~ons of the records under the provisions of Exemptions 6 and 7(C) of the FOIA, specifically 5 U.S.C. 552 (b)(6), which pertains to information, the release of which would constitute a clearly unwarranted invasion of personal privacy and 5 U.S.C. 552(b )(7)(C), which pertains to information compiled for law enforcement purposes, the release of which could reasonably be expected to constitute an unwarranted invasion ofthe personal privacy of third parties. If you are not satisfied with this action, you may submit an administrative appeal to Mr. John R. Crane, Assistant Inspector General, Office of Communications and Congressional Liaison, Room 1021,400 Army Navy Drive, Arlington, VA 22202-4704. Your appeal should be postmarked within 60 days of the date of this letter, should cite case number 1O-00246-F, and should be clearly marked "Freedom of Information Act Appeal." There are no fees associated with the processing of this request in this instance. Enclosures: As stated Sincerely, \~?faf~ Chief, Freedom of Information and Privacy Office

(Investigations) DEPARTMENT OF DEFENSE OFFICE OF INSPECTOR GENERAL DEFENSE CRIMINAL INVESTIGATIVE SERVICE ARLINGTON RESIDENT AGENCY 20112 th STREET SOUTH, SUITE 712 ARLINGTON, VIRGINIA 22202-5408 REPORT OF INVESTIGATION 200701199X-29-MA Y -2007-60DC-WIIF January 24,2008 PROJECT: OPERATION FLICKER DISTRIBUTION: DCIS Headquarters, National Security Program (03NS) Immigration and Customs Enforcement, Cyber Crimes Center"'_ U.S. Attorney's Office, Eastern District of Virginia, Alexandria Division (AUSA G. Smagala) b(8} b(7}{c) FOR OFFl61Al YSE ONLY LAW ENF9A6EMENl' SENSll'llJE This ral and is on loan to your agency. any party under investigation nor may this do outsi e.. without specific prior o the Deputy Inspector General for Investigations.

200701199X-29-MA Y-2007-60DC-Wl/F January 24, 2008 NARRATIVE: 1. In April 2007, _. DCIS, Arlington Resident Agency received information from Assistant U.S. ) Gerald Smagala, U.S. Attorney's Office (USAO), Eastern District of Virginia (EDVA). AUSA Smagala provided information concerning a national investigation being conducted by ICE. ICE had identified over 5,000 individuals who subscribed to websites that were known to contain child pornography. ICE designated their operation as PROJECT FLICKER. 2. Several individuals identified under Project Flicker used their DoD/government e-mail address, Fleet Post Office (FPO) military address, or Army Post Office (APO) military address to register for the child pornography websites. AUSA Smagala requested that DCIS assist in the identification ofindividuals affiliated with the DoD. Initiation of a joint project into this matter was initiated to provide short term assistance to EDVA and ICE. As DoD subjects were identified, information was provided to the DCIS office within the appropriate area of responsibility for action deemed appropriate. Coordination was made throughout the project with the appropriate Military Criminal Investigative Organizations.. 3. obtained a complete list identifying all U.S. based subjects from the ICE. The list contained the name, e-mail address, telephone number, and postal address of each subject. Queries of subjects were conducted through Autotrack, the Joint Personnel Adjudication System, the Defense Central Index oflnvestigations, and the DoD Employee Interactive Data System to obtain additional identifying information and establish a DoD nexus. In total, 20 states and D.C. were vetted. 4. As a result of the database queries, 264 individuals affiliated with DoD were identified, including 39 individuals within the Eastern District of Virginia. Of those identified, 9 individuals possessed a Top Secret Sensitive Compartmented Information security clearance, 13 possessed a Top Secret security clearance, 8 possessed a NATO Secret security clearance, 42 possessed a Secret security clearance, and 4 possessed an interim Secret security clearance. S. The subject information containing DoD query results were divided by location and forwarded to the appropriate ICE and DCIS office for action. 6. To date, 31 spin-off cases have been initiated and 52 subjects have been titled: 200701 274Z - 20070I277C- 200701301F -...,,,."..,,,.",, 200701340S- 200701341 T - Campbell, Cameron Morrison 20070 1402H - Kartes, Thomas Edward 2007014031- I11III A-I b(8} b(7){c) F9R 9FFl6IAL Y6E 9NLY LAW ENF9R6EMEN:r 6ENSI:rI'JE on under investigation nor without specilk; prior

200701199X-29-MA Y-2007-60DC-WIIF January 24, 2008 20070 1463Q - Jones, Paul Burnell 200701511R 200701512S - 200701516W 200701517X- 20070 1553H - 200701558M 200701620B Mullen, Shawn 200701623E - Lindimore, Shane Brewster 2007016531-200701665U 200701667W Targets 200701690T - 200701691U- 200701692V- 200701756M- 200701765V - (Western Division)-WDKY-EDKY 200800031 G - Demoulin, Stanley P. 200800080D Operation Flicker 7. Six Information 200800159J - 200701539T were completed, to include 200800168S- 2008001581-2008001 and 200701 8. Two subjects were convicted of violating Title l8, U.S. Code, Section 2252A, Attempted Receipt of Child Pornography (200701402H - Kartes, Thomas and 200701463Q - Jones, Paul). Each subject received 60 months incarceration and 120 months probation. Five subjects are currently pending criminal prosecution in the USAO, EDV A. 9. Due to the short term nature of this project and the need to focus more resources on other DCIS investigative priorities, this project is closed as "finished." All cases generated from this project will be pursued to conclusion. A-2 b(8} b(7)(c) FeR efflelal I:JSE 8NLY LAW ENF8R6EMENl 8EN811'1 1i

(Investigations) u.s. DEPARTMENT OF DEFENSE OFFICE OF INSPECTOR GENERAL DEFENSE CRIMINAL INVESTIGATIVE SERVICE Mid-Atlantic Field Office Arlington Resident Agency 201 12111 Street South, Suite 712 Arlington, Virginia 22202-5408 200701239Q-07-JUN-2007-60DC-W11R (lr) June 6,2007 SSN:_ INFORMATION REPORTIREFERRED: On May 29, 2007, the Defense Criminal Investigative Service (DCIS), Mid-Atlantic Field Office (MAFO), initiated a project based on infonnation provided by Assistant United States Attorney (AU SA) Gerald Smagala, United States Attorney's Office (USAO), Eastern District of Virginia, Alexandria Division (DCIS Case Control Number 200701199X). AUSA Smagala advised that the Immigration and Customs Enforcement (ICE) is conducting a national investigation that has identified over 5,000 individuals who subscribed to predicated child pornography websites. Among the 5,000 names ICE identified under Operation Flicker, several individuals used their.mil e-mail address, Fleet Post Office (FPO), or Army Post Office (APO) military zip codes. AUSA Smagala requested that the DCIS assist in identifying any additional Department of Defense (DoD) affiliated individuals and provide any investigative assistance. Additional background infonnation on Operation Flicker is included as Attachment 1. The Reporting Agent (RA) utilized infonnation contained within the DoD Employee Interactive Data System (DEIDS) and the Joint Personnel Adjudication AS) to identify DoD affiliated individuals. Among those identified, was _ Retired Navy Captain (0-6). np1'~nn of special interest because, according to DEIDS, The RA spoke with ICE Special Agent (SA) briefed her on DCIS' efforts on Operation DCIS can can be reached by telfmhlone.. or in Tampa, Florida and welcomed any assistance _, extension Given the nature of the allegations, the potential for possi bility of harm to the children, and the subject's location in the Tampa area, the MAFO is referring this case to the DCIS, Tampa Bay Resident Agency, for review and any action deemed appropriate. OFFICIAL USE OHLY T" of the Department of Defense Inspector General and is on loan to our " " b(8} b(7){c)

200101 239Q-01-JUN-2001-60DC-WIIR (IR) 2 The investigative databases contained in National Crime Information Center (NCIC), Defense Clearance and Investigations Index (DCII), Treasury Enforcement Communications System (TECS) were queried for relevant information concerning the subject. No criminal information was found in NCIC or TECS. However, there is a record within DClI. The DClI results are included as Attachment 3. Attachments: 1. Project Flicker Summary 2. DEIDS/JPAS Results 3. DCII Results Prepared by Special Agent DISTR: Mid-Atlantic Field Office APPR:_ SAC DC _) W/tml91G afthe Department of Defense Inspector General and is on I b(b} b(7){c) OPfICb'tL USH Q)JIsY. I uted outside the receiving agen"y ts

INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE TAMPA RESIDENT AGENCY 400 North Tampa Street, Suite 1130 Tampa, Florida 33602-4707 (Investigations) -200701 277C-15-JUN-2007-20TB-WllU June 5, 2008 DISTRIBUTION: National Security Program Manager Southeast Field Office Mid-Atlantic Field Office Immigration and Customs Enforcement-Tampa per efflelal vee enlv W/.1lt11l loan to your agency. roperty of the Depa~nt of Defense I on under Investigation nor may til.. docu without the specific prior e Deputy Inspector Genet'lll fof Investigations. b(8} b(7}{c)

20070 1277C-15-JUN-2007-20TB-WIIU June 5, 2008 NARRATIVE: 1. On June 7, 2007, the Reporting Agent (RA) received an Information Report (IR), Case Control Number (CCN) 200701239Q, from the Defense Criminal Investigative Service (DCIS), Mid-Atlantic Field Office (MAFO). The IR advised that on May 29, 2007, DCIS MAFO initiated a project titled Operation Flicker (CCN 200701 199X), based on information provided by Assistant U.S. Attorney (AU SA) Gerald Smagala, Eastern District of Virginia, Alexandria Division. AUSA Smagala advised that the Immigration and Customs Enforcement (ICE) was conducting a national investigation that identified over 5,000 individuals who subscribed to predicated child pomography websites. 2. Among the 5,000 names, ICE identified several individuals who used their.mil email address and/or their Fleet Post Office or Army Post Office military zip code. AUSA Smagala requested that DCIS assist in identifying any additional Department of Defense (DoD) affiliated individuals and provide investigative assistance. 3. The DCIS MAFO utilized information contained within the DoD Employee Interactive Data System (DElDS) and the Joint Personnel Adjudication in order to identify DoD affiliated individuals. Among those identified was a Retired U.S. '-'AIJ'U:UU (0-6). 4. The DCIS MAFO spoke with ICE Special Agent briefed her on the DCIS joint efforts with Operation Flicker. to exploitation cases, requested investigative assistance from Tampa, FL, and who was assigned 5. On June 18,2007, the RA telephonically contacted assistance with the investigation. During the CUIIVerSaUQI1, previously received from the IR and subsequently was mciudf~d did not use a.mil e-mail address and/or a Fleet Post Office or while SUbSCriblii.iiif bsites. Sentterrlber 19,2007 the RA conducted a DEIDS check to verify _ was still The DEIDS check revealed on 7. On September 27, 2007, the RA coordinated with Investigative Service (NCIS), Resident Agency, Y execution of a search warrant residence. FeR efflel... BE en... A-I b(8} b(7){c) under Investigation nor without the specific prior

200701277C-15-JUN-2007-20TB-Wl/u June 5,2008.!!!!!!I!anese _ residence. _ agreed to coordinate with the ICE, Attache r l..'n<ll-trn.. nt in order to obtain a search warrant for 8. On October 15, 2007, the NCIS executed a search warrant on located in During the execution of the search UfH'rrHlrn ~ve the computer to access the Internet to A Putty Tower Computer Millennia, serial UUJ"V''''~ residence. 10. On January 14.2008, provided the RA a copy of two computer forensic exams. The first forensic exam was laptop computer, which was seized during the execution of the search located in Japan. The second forensic exam was performed computer which was seized during the execution of the search warrant on residence in _III The examination of both computers did not of any child pornographic image files or movie files. However, the examination of the desktop computer indicated that a user of the computer had regularly used one or more privacy applications which wiped most of the history of Internet websites visited and any incriminating files that may have been viewed. Despite using the privacy applications, the examination did find traces that a user had accessed questionable Internet sites that appeared to be child pornographic in nature. 11. Due to the fact that no child pornographic images were found on the computers, this investigation is closed with the submission of this report. There were no fraud vulnerabilities identified during the course of this investigation. A-2 b(8} b(7){c) _I and Is on any party under InYBStlgatlon nor specific: prior

200701277C-15-JUN 2007-20TB-WllU June 5, 2008 IDENTITY OF SUBJECT: IDENTIFYING DATA Name Alias Social Security Number DatelPlace of Birth Race Sex Height Weight Hair Eyes Residence Employment/Occupation Telephone Number Drivers License Number Education - Prepared by_. ClASSIFICAnON: B-1 APPR:_ b(s} b(7)(c) 1110. OI=IIIICIAL U ONL This document s loan to your agency. Contents m ma tho outside the receiving a ~""I\II4""'UlllUI!~~~ or tlon of the Deputy Inspector General tor Investigations.

(Investigations) DEPARTMENT OF DEFENSE OFFICE OF INSPECTOR GENERAL DEFENSE CRIMINAL INVESTIGATIVE SERVICE ARLINGTON RESIDENT AGENCY 2011211'1 STREET SOUTH, SUITE 712 ARLINGTON. VIRGINIA 22202 5408 REPORT OF INVESTIGATION. 200701340S-26..JUN-2007-60DC-WIID February 27, 2Q08 DISTRIBUTION: DCIS Headquarters, National Security Program (03NS) Immigration and Customs Enforcement, SAC Washington, D.C. U.S. Anny Criminal Investigation Command 902 nd Military HJl"'111I'!... U..,'"' FOR OFFIGIAL YSE ONLY LAW ENreReEMEN:r S&NSR=PJIi WAitNH-iG of lile Department of Defense Ins be b(8} b(7){c)

200701340S-26-JUN-2007-60DC-WIID February 27,2008 NARRATIVE: 1. This case was initiated based on information derived from DCIS Project: Operation Flicker (Case Control Number 200701199X). As background, ICE initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection." The investigation revealed "Home Collection" was operating nwnerous commercial child pornography websites. In addition, the organization utilized various PayPal accounts to process the payments for access to the member restricted websites. 2. This criminal organization utilized a specific and identifiable payment website known as "iwest." The information developed during the course of the investigation identified that the organization (1) used various PayPal accounts to facilitate the customer payments; (2) used specific subject identifiers within the PayPal accounts to identify purchases into the various member restricted websites; and (3) used specific administrative e-mail accounts that were used to distribute access to the member restricted websites. 3. _. utilized information contained within the DoD Employee Interactive Data System Joint Personnel Adjudication Systems (JPAS) to identify DoD personnel and contract employees who joined the member restricted sites. Among those -- identified Lieutenant Colonel (0-5), with the U.S. Army Reserve (USAR). was on active duty. A query of JPAS revealed he was a -- 4. On June 27, 2007, agents from the DCIS, ICE, and the Fairfax,"-,VlUUY (FCPD) executed a search warrant on_s residence located 5. Concurrent to the execution of the search ICE and. FCPD, attempted to to pornography websites. However, Invoked his right to legal counsel and the interview was termi~ left his during the execution of the search warrant. Media seized fro~dence was sent to the Defense Computer Forensics Laboratory (ncfl) for analysis. 6. consent to observed computer, Hotmail email account. To... >u<>n1 instructed _ to step was going to see a lawyer. 7. The DCFL's analysis of_ media did not recover any child pornography images (Exhibit 1). However, the DCFL recovered 25 docwnents and one movie that was classified A-I b(b} b(7){c) FeR 8FFleiAL '=lee 8NLY LA~V ENF9RSEMEN-T SENSI=FI"'E

200701340S-26-JUN-2007-60DC-WIID February 27, 2008 secret. The classified documents were recovered from compact discs that were seized from _ residence. 8. On September 17,2007, two additional search warrants were obtained; a warrant for _ work computer and a warrant for_ personal email. 9. A review of_ personal email did not recover any evidence related to the receipt of ~ Before the analysis of_ computer could be performed, AUSA declined to criminally prosecute _ for violations relating to possession and/or receipt of child pornography, due to insufficient evidence. ] O. The matter relating to the mishandling of classified information will be referred to the USACIDC for action(s) deemed necessary. No fraud vulnerabilities were identified. DCIS will take no further criminal, civil, or administrative actions on this matter. No fraud vulnerabilities were identified. This case is closed as "declined." A-2 b(b} b(7){c) FOR OFFl61AL yee ONLY LAW ENFOR6EMENT 6EN611'1\'E

20070 1340S-26-JUN-2007-60DC-WIlD February 27, 2008 IDENTITY OF SUBJECTS: Name Alias Social Security Number DatelPlace of Birth Race Sex Height Weight Hair Eyes Residence Employment/Occupation Telephone Number Driver's License Number and Issuing State Education B-1 b(!} b(7}(c) FOR OFFlQIAL Y6E ONLY LAW ENFORQEMEN:r 8iN81:rPJIii

20070 1340S-26-JUN-2007-60DC-WIlD February 27, 2008 EXHIBIT: 1. DCFL Digital Forensic Analysis Report Prepared by Special Agent. Arlington Resident Agency APPR: _ C-I b(8) b(7}(c) FOR OFFl6IAl.. SIi ONI. LAW ENF9ASIiMIiNl" SIiNSI'fI)"(1i -'VAftfHNG. the property of the Department of Defense Inspector General and.. notbed. nor.. cy without spediic prior Deputy In~ General for InvestigaliOii.

(Investigations) DEPARTMENT OF DEFENSE OFFICE OF INSPECTOR GENERAL DEFENSE CRIMINAL INVESTIGATIVE SERVICE ARLINGTON RESIDENT AGENCY 20112 111 STREET SOUTH, SUITE 712 ARLINGTON, VIRGINIA 22202 5408 REPORT OF INVESTIGATION 200701402H-09-JUL-2007-60DC-W11F February 25, 2008 KARTES, THOMAS EDWARD DISTRIBUTION: ncls Headquarters, National Security Program (03NS) Immigration and Customs Enforcement, SAC Washington, D.C. b(b} b(7)(c) FOR OFFISIAL.,8& 9NL baw &NFQRQ&MIiN+ linir'"iuii

200701402H-09-JUL-2007-60DC-W11F February 25, 2008 NARRATIVE: 1. This case was initiated based on infonnation derived from DCIS Project: Operation Flicker (Case Control Number 200701199X). As background, ICE initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection." The investigation revealed "Home Collection" was operating numerous commercial child pornography websites. In addition, the organization utilized v:.arious Pay Pal accounts to process the payments for access to the member restricted websites. 2. This criminal organization utilized a specific and identifiable payment website known as "iwest." The information developed during the course of the investigation identified that the organization (1) used various PayPal accounts to facilitate the customer payments; (2) used specific subject identifiers within the PayPal accounts to identify purchases into the various member restricted websites; and (3) used specific administrative e-mail accounts that were used to distribute access to the member restricted websites. 3. _. utilized information contained within the DoD Employee Interactive Data System and the Joint Personnel Adjudication Systems (JP AS) to _._- identify DoD employees who subscribed to the websites. 1-U1:IUIilll Edward Kartes, Major (0-4), with the U.S. Army A query of JP AS revealed Kartes was on active 4. On July 11,2007, agents from the DCIS, ICE, and the Fairfax County Police n..,,,,,,,rt,,..p,nt ~ a search warrant on Kartes's residence located 5. Concurrent to the execution of the search warrant, ICE _ conducted a non-custodial interview subscription to child pornography websites. Kartes admitted to the subscribing to commercial child pornography sites and possessing child pornography images on his computers. Based on his admissions, Kartes was arrested and charged with violation of Title 18, U.S. Code, Section 2252A, attempted receipt of child pornography. 6. On August 29, 2007, Kartes pled guilty to a single count of attempted receipt of child pornography, a violation of Title 18, U.S. Code, Section 2252A. 7. On December 19,2007, Kartes was sentenced to 60 months incarceration, 120 months supervised release, $3,000 fine and a $100 special assessment, for the attempted receipt of child pornography, a violation of Title 18, U.S. Code, Section 2252A. 8. No fraud vulnerabilities were discovered during the course of this investigation. DCIS will take no further criminal, civil, or administrative actions on this matter. This case is closed as 'finished. " A-I b(8} b(7){c) FOR OFFl8tAl HeE ONLY LAW ENFOR6EMENT SENSITIVE on ll'lvestigation nor III1CY without specific prior

200701402H-09-JUL-2007-60DC-WI/F February 25, 2008 IDENTITY OF SUBJECTS: Name Alias Social Security Number DatelPlace of Birth Race Sex Height Weight Hair Eyes Residence Employment/Occupation Telephone Number Driver's License Number and Issuing State Education Kartes, Thomas Edward None Prepared by Special Agent Arlington Resident Agency APPR: _ 8-1 b(8} b(7}(c) FeR effl6htcll:lse enly LAW ENFeA6EMENl' 6EN6FFI

200701511 R-24-JUL-2007-1 OPB-ZO/Z (Investigations) INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE PITISBURGH RESIDENT AGENCY. 1000 LIBERTY AVE, STE 1310 PITISBURGH, PA 15222-4004 REPORT OF INVESTIGATION 20070151 1 R-24-JUL-2007-1 OPB-ZO/Z April8,2010 DISTRIBUTION: DCIS HQ - 03S0 Northeast Field Office DCIS-IOPB ICE - Pittsburgh CLASSIFICAnOH: III ",.".. lfnil roperty of the Department of Defense lnepec:ll!!: b(8) b(7)(c) per efflela...,8e 8NI: ' your agency. Con I nvestlglltlon nor may this document bill d n lfie prtor authoriution of the r General for Investigations.

20070151IR-24-JUL-2007-10PB-ZO/Z NARRATIVE 1. On July 11, 2007, the Reporting Agent received a lead referral from Special Agent_ DCIS Mid-Atlantic Field Office, regarding the Immigration and Customs EnJtorc:em.ent (ICE) initiated Operation Flicker. Operation Flicker is a nationwide investigation that has identified over 5,000 individuals who have subscribed to predicated child pornography websites. A listing was provided detailing individuals residing in the Western District of Pennsylvania who are employed by the Department of Defense and/or U.s. Military and have subscribed to websites that contain child pornographic images or other material that exploit children via the internet. was 2. Among the 5,000 names ICE identified, several individuals used their.mil e-mail address, Fleet Post Office or Army Post Office military zip codes. DoD databases were queried to identify individuals that may be_' n ossession of child pornographic material. One subject identified is currently enlisted in the Marine Corps Reserve as a Corporal (Pay ratm grade E-4, Enlisted). Unit'. data was not available. Also according to DEIDS and REDD da1:abllse:s, 3. ~ coordinated with... _, Supervisor, ICE Pittsburgh, and ~ that he would assign an ICE agent to the case and agreed to work jointly with DCIS. Based upon previously established protocols, ICE will be the lead investigative agency for this matter and will prepare the Report of Investigation. Based on the agreement, the Reporting Agent initiated the case on July 24, 2007 (Exhibit 1). 4. On August 9, 2007, Reporting Agent received photo ID and. driver's license information o~ 5. On January 14, 2008,... I.lVH... U~ files and records requested and later received military personnel Reporting Agent reviewed military personnel files provided on was unable to determine _ global location, let spe:cltlc '''''''"L~V'' during the time period when he purchased access to the pornography websites. Additionally, records did not indicate that a laptop computer and/or cell phone was issued to_. 6. From discussion with Special Agent NCIS along with personal experience as a Naval Officer, Reporting Agent aware multiple computers and cell phones are accessible by enlisted personnel whether onboard a ship or shore installation. Further discussion with _ former Computer Crimes Coordinator and former RAC, led to the decision to close the case. Case closure was based upon the lack of any concrete evidence and the lack of probable cause that _ may have downloaded photos and to which, if any, computer was utilized for such purpose. Further, the location of such computer and establishing that_ alone used such computer was unlikely to be determined. Finally, due to the fact that this type of case is not a DCIS priority, case b(b} b(7)(c)

200701S11R-24-JUL-2007-10PB-ZO/Z closure is the best use of current resources and best course of action for the nels Pittsburgh RA. 7. Based upon the above, it is recommended that matter be closed. 3 FeR efflelala U81i ONL

200701511 R-24-JUL-2007-1 OPB-ZO/Z IDENTITY OF SUBJECTS IDENTIFYING DATA Name: Alias: Social Security Number: DatelPlace of Birth: Race: Sex: Height: Weight: Hair: Eyes: Residence: Employment/Occupation: Telephone No: Drivers License Number/State: Education: CLASSIFICAnON: b(8} b(7){c) FeR efflelai: wee eni:y your agency. contents document be "g Ig' r General for Investigations.

200701S11R-24-JUL-2007-10PB-ZO/Z EXHIBITS 1. DCIS Form 1; Case Initiation, July 24, 2007 2. DC IS Letter to HQ USMC, Personnel Management Division, January 14, 2008 3. DCIS Form 1; Receipt of_ Personnel File, January 18,2008 CLASSIFlCA non: ""RIIING nt Is the property or the Department of Defense lnapactor Genel'lll and bel} b(7){c) FaR afflela.. we. ON...,,our.gene,. 10Md to n nor ma, this document be dlatrl... 1 for Investigations. c rior authorization of the

(Investigations) INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE SYRACUSE POST OF DUTY 441 S. SALINA ST, STE 602 SYRACUSE, NY 13202-2400 REPORT OF INVESTIGATION 200701512S-24-JUL-2007-1 OSY-Wl.. IF 09-MA Y -2008 DISTRIBUTION Headquarters, Investigative Operations Directorate Northeast Field Office Pittsburgh Resident Agency b(8) b(7){c) IlIlIa... ent is the property of the Department of Defense Ins General an to your agency. Content ~sclosed t any party under investiga ccwment be distributed outside the' cy without the. or authorization 0 ant Inspector General for Investigations.

200701S12S-24-JUL-2007-10SY-ZO May 9, 2008 NARRATIVE 1. On July 11,2007, the reporting agent received a lead referral from Special Agent. DCIS Mid-Atlantic Field Office regarding the Immigration and Customs Enltorloonnerlt (ICE) initiated Operation Flicker. Operation Flicker is a nationwide investigation that has identified over 5,000 individuals that have subscribed to predicated child pornography websites. sent a list of individuals in New York State that are employed by the Department.S. Military, that have subscribed to websites that contain child pornographic images or other material that exploit children via the internet. 2. On May 17,2007, regarding Operation information: attended a briefing at ICE, Fairfax, Virginia The briefing included the following background 3. In April 2006, the ICE/Cyber Crimes Center/Child Exploitation Section (lce/c3/ces) initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection." The investigation has revealed that the same organization is operating numerous commercial child pornography websites. In addition, the organization utilizes various Pay Pal accounts to process the payments for access to the member restricted areas of these websites. The investigation is being worked jointly with ICE/C3/CES, ICElRAClBirmingham, the U.S. Postal Inspection Service, the U.S. Department of Justice/Child Exploitation and Obscenity Section, and the USAO for the Northern District of Alabama. ICE has designated this operation as PROJECT FLICKER. 4. ICE/C3/CES has conducted over 60 undercover transactions at the advertising websites associated with this investigation. The investigation has identified that a specific criminal organization is operating approximately 18 different commercial child pornography advertising websites which provide access to approximately 18 child pornography member restricted websites. This criminal organization has utilized a specific and identifiable payment website known as "iwest." The information developed during the course of the investigation has identified that the organization (1 ) uses various Pay Pal accounts to facilitate the customer payments; (2) uses specific subject identifiers within the Pay Pal accounts to identify purchases into the various member restricted websites; and (3) uses specific administrative e-mail accounts that are used to distribute access to the member restricted websites. 5. Among the 5,000 names ICE identified under Project Flicker, several individuals used their.mil e-mail address, Fleet Post Office (FPO), or Army Post Office (APO) military zip codes. advised the U.S. Attorney's Office and ICE that the DCIS will assist any additional Department of Defense (DoD) affiliated individuals and provide any investigative assistance. A-2 _I.- b(b} b(7){c) ment is the property of the Department of Defense I General an our agency. Con e disclosed t any party under investi 1S document be distributed outside t. gency without t rior authorization 0 t s1stant Inspector General for Investigations.

20070 1512S-24-JUL-2007-1 OSY -ZO May 9, 2008 6. conducted queried DoD databases to identify individuals that may be in pornographic material or access, and has forwarded the results of his res:pec~tnre DCIS office for consideration for possible DCIS case initiations. attached a spreadsheet for subjects of Operation Flicker in the state of a DoD affiliation. One subject identified on the spreadsheet includes an individual identified as " is a retired U.S. Army, Army National Guard Staff Sergeant (E-6). 7. 8. also queried the Re-Enlistment Eligibility Data J...,.v.."y V'-'-'JlJJJ and obtained the following l1li_ inlomnation.. Army National Guard, 9. The reporting agent contacted Special Agent ICE Alexandria Bay, NY regarding Operation Flicker. _ subsequently forwarded the reporting agent a spreadsheet that identifies all New York subjects of Operation Flicker, and pertinent information regarding subscriber information related to the child exploitation websites. _ advised that he would be reviewing the list of subjects for possible investigation. The reporting agent advised that the DCIS would review the list, and initiate an investigation of DoD related personnel in the Syracuse Post of Duty area of responsibility. _ advised that another ICE agent would be assigned to specific investigation, but he would assist in the computer forensics part of the cases. 10. Upon review of the spreadsheet sent by _, the reporting agent determined that.. made four payments utilizing PayPal to the restricted access websites. The payments were for $79.95 each, and occurred on the following dates: November 7, 2006, November 21,2007 (2 transactions), and December 16,2006. The "trans.ltem Title" was either listed as an invoice number or for "TV-2 collection 30 Days access." (Agent Note: this is the subject line identifier which indicates which member restricted site a specific customer purchased. In the Project Flicker Overview report, it stated that in November 2006, the criminal organization dropped the subject line identifiers, and began using Invoice numbers. The ICE agent stated that the Pay Pal accounts still identify the specific member restricted sites an individual purchased). A-3,a.11111 b(1s} b(7){c) ent is the property of the Department of Defe r General an ~ to your agency. not be disclosed t any party under investi a is document be distributed outside th agency without rior authori~ation 0 Lstant Inspector General for Investigations.

200701512S-24-JUL-2007-10SY-ZO May 9, 2008 11. This investigation was anticipated to be conducted jointly with Immigration and Customs Enforcement, Massena, NY. As ICE was determined to be the lead agency, and the fact that there was only a loose affiliation between the subject and the DoD, this investigation was deferred to ICE Massena for any action they deemed appropriate. 12. This investigation is closed. CLASSIFICA'l'ION: A-4 _DUIDi' cument is the property of the Department of Defense General an to your agency. Co be disclosed t any party under investi a s document be distributed outside t agency without the s authorization 0 s~stant Inspector General for Investigations.

IDENTITY OF SUBJECTS Name Alias Social Security Number Date of Birth Sex Race Height Weight Eyes Hair Residence - per efflelat: yee eniiy C-I b(6} b(7}{c)!sid 1U11J18 roperty of the Department of Defense Ins C oan to your agency. Con er Investigation nor may this doeument be distrlb v ng a c rior authorization of the eneral for Investigations.

200701512S-24-JUL-2007-10SY-ZO May 9, 2008 EXHIBITS 1 - Excel Spreadsheet titled "Flicker New York" identifies l1li as a subject.. Prepared by: Syracuse Post of Duty APPR:_ A-2 b(8} b(7){c) 1..._. ument is the property of the Department of Defense Inspector General an 0 our agency. Contents osed t any party under investiga ~ nt be distributed outside the rec.. ~t out the sp authorization 0 Inspector General for Investigations.

(Investigations) INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE PITTSBURGH RESIDENT AGENCY 1000 LIBERTY AVE, Room 2101 PITTSBURGH, PA 15222-4004 REPORT OF INVESTIGATION 200701517X-25 JUL-2007 lopb-zo/z 18 FEBRUARY 2008 DISTRIBUTION: DCIS HQ 03S0 Northeast Field Office DCIS lopb ICE Pittsburgh b(b) b(7){c) CLASSIFICAnON: rer err.eia... & 8NI. ' your agency. C document be dlatrt r W:... IIII. of the Department of Defense Inspector on nor may this rior authorlzauon of the

20070 1517X-25-JUL-2007-1 OPB-ZO/Z February 08,2008 TABLE OF CONTENTS SECTION NARRATIVE IDENTITY OF SUBJECT(S) EXHIBIT(S) A B C FeR effisia.. YSE eni:o iii enlll1l8 perty of the Department of Defense Inspector Gene,.1 lid on nor may this c or authortzatlon of the

NARRATIVE 1. On July 11, 2007, the Reporting Agent received a lead referral from Special Agent_ DCIS Mid-Atlantic Field Office, regarding the Immigration and Customs ErutOI'lCeIlneIlt (ICE) initiated Operation Flicker. Operation Flicker is a nationwide investigation that has identified over 5,000 individuals who have subscribed to predicated child pornography websites. A listing was provided detailing individuals residing in the Western District of Pennsylvania who are employed by the Department of Defense and/or U.S. Military and have subscribed to websites that contain child pornographic images or other material that exploit children via the internet. 2. Among the 5,000 names ICE identified, several individuals used their.mil e-mail address, Fleet Post Office or Anny Post Office military zip codes. DoD databases were queried to identify individuals that may be in of child pornographic material. One subject identified was is enlisted in the Anny Reserve as a 3. The Reporting Agent contacted Special Agent ICE Pittsburgh, who agreed to jointly work the case, with ICE serving as agency. Based on the agreement, the Reporting Agent initiated the case on July 25, 2007 (Exhibit I). 4. On September 7, 2007, the Reporting Agent received copies of subpoena returns for subpoena's served on l1li email address and Internet service provider from Special Agent _ Also on that date, Special Agent _ requested that the Reporting Agent ~ military personnel file (Exhibit 2). 5. On November 16,2007, the Reporting Agent obtained l1li personnel file and contacted Special Agent _ but received no response. Since then, the Reporting Agent has attempted numerous times to contact Special Agent through email and phone calls but he has continued to be non-responsive. In Resident Agent in Charge, contacted Pittsburgh, and advised him of the situation. speak with. _howeverto 6. Based upon the complete non-responsiveness ofice, who has been named the lead agency regarding all Operation Flicker spin off cases, it is recommended that matter be closed. OPPICIAL YSE ONL b(8} b(7}{c) A-I 'Nlll.,Q ocument is the property of the Department of e Inspecto and is on loan to your. Contents may not be disclose er investigation nor may this document u "de the receiving agency w e specific prior author f the ant Inspector General for InVestigations.

20070 1517X -25-1UL-2007-1 OPB-ZO/Z February 08,2008 IDENTITY OF SUBJECTS: is enlist... iiiiliiiililiiiil. CLASSlFICAnON: FaR afflala.. yee an... B-1 b(b} b(7}{c) V'A".. tlui roperty of the Department of Defense Inspector VUtIgatIon nor may uu. e pi'ior authorization of the for Investigation.

EXHIBITS: 1. DCIS Form 1; Case Initiation, July 25, 2007 2. DCIS Form 1; Receipt of Subpoena Returns, October 3, 2007 3. DC IS Form 1; Receipt o~ Personnel File, November 16,2007 b(6} b(7){c) Prepared by SA_I_, Pittsburgh Resident Agency APPR: _

(Investigations) INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE DAYTON RESIDENT AGENCY 3055 KETTERING BLVD, #205 DAYTON, OH 45439 200701539T-26-JUL-2007-40DY-WlIIR 26-July-2007 ---- INFORMATION REPORT: On July 26, 2007, information was received from the Fedeml Bureau of Investigation, Oh concerning a telephonic complaint they received alleging illegal activity (child pomogmphy) by a DoD employee. The complaint is summarized below (see attachment for complete details). This information is being furnished to the SEFOlNashville RA and the Western Fa for any action deemed appropriate and to the MAFO (Operation Flicker) for information only. (Note: The complainant does not want to get involved beyond this initial reporting ~ see attached). Attachment 1) FBI Complaint Form, July 9, 2006 2) DElOS Report, 7/26/07 3) Autotrack on 4) Autotrack on 5) REDDReport, Prepared by S DISTR: 20NV., I... APPR:_!FB], Dayton, OH (w/~nts) 'N "1111.8 perty of the Department of Defen.. Inspector Gene,.1 IUId b(b} b(7}(c) FOR OFFICIAL we. 8NL ed n nor may We If\c prior authorization of the

- (Investigations) 200701553H-31-JUL-2007-40SX-YOIU INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE SIOUX FALLS POST OF DUTY P.O. BOX 139 CASTLEWOOD, SO 57223 March 17, 2008 REPORT OF INVESTIGATION --- 200701553H-31-JUL-2007-40SX-YOIU 17-MARCH-2008 DISTRIBUTION DCISHQ (03NS) Central Field Office (40FO) b(8} b(7}{c) FeR efflala.. "ali ONLY e roperty of the Department of Defense Inspec:tor to your sgency. Con 0 nvntlgation nor may this document be dis v ng eclftc prior authorization of the r eneral for Investigations.

200701553H-31-JUL-2007-40SX-YOIU March 17, 2008 NARRATIVE I. This investigation was initiated based upon information received from the Defense Criminal Investigative Service (DCIS) Project, Operation Flicker. The DCIS Mid-Atlantic Field Office initiated Operation Flicker based on information provided by Assistant United States Attorney Gerald Smagala, United States Attorney's Office, Eastern District of Virginia, Alexandria Division, regarding a national investigation conducted by the United States Immigration and Customs Enforcement (ICE). This investigation has identified over 5,000 individuals who subscribed to predicated child pornography websites. The ncls Sioux Falls Post of Duty was notified of one of these identified individuals, who is a full time Army National Guard member_. tha_ 2. A database check through the Defense Manpower Data Center was conducted which revealed is a Sergeant First Class and works with the North Dakota Army National Guard 3. According to the ICE Cyber Crimes Center, on December 18, 2006, _ made a purchase through his PayPal account for $79.95 that was processed Ull''''''I'.U identified target PayPal account utilizing the email address transaction follows virtually the exact same pattern as the led to child pornography web sites, and was purchased through a PayPal account that appeared to be used almost exclusively for processing payments to these types of sites. 4. A search of the IP address identified during the transaction revealed it belonged to the internet service provider ND Telephone Company located in Devils Lake, ND. A summons to ND Telephone was served by ICE, Grand Forks, ND, on August 7, 2007, which requested subscriber information for the identified IP address for the date and time of the transaction in question. Pursuant to the summons, ND Telephone identified the subscriber as l1li_ residing i~". Camp Grafton, NDANG, was contacted and agreed advised that he has had several with 6. The Reporting Agent (RA) coordinated with _ regarding the internet history file on the government computer used by _ On October 24, 2007, the reporting agent received a memorandum for record from the Joint Force Headquarters, North Dakota Army National Guard (NDARNG), regarding a cursory computer check conducted on the government computer used b~ The review was conducted remotely and consisted of a check of the computer's Internet Explorer internet favorites directory, temporary internet files, internet POR OPFleIA.. uali 8NIr'( A-2 b(8) b(7){c) WAflIlIU. the property of the Department of Defense lnapactor O8n... 1 and to cloll8 nor may this ItIc prior authorization of the

200701553H-31-JUL-2007-40SX-YOIU March 17, 2008 history, and internet cookies. A general review of files and directories was also conducted. Nothing was found outside of the NDARNG's acceptable use policy. 7. On December 5, 2007, the RA and Special Agent_ ICE, Grand Forks, ND, interviewed at Camp Grafton Army National Guard Headquarters building, Camp Grafton, was cooperative and related that he enjoyed watching young female models progress their career. _ related that occasionally he would come across images that depicted young girls naked but he would immediately delete those images. _ states that he bought memberships to a handful of pay sites and advised that most of those sites dealt with young modeling. He claimed that ifhe bought into a site that contained anything offensive, he wouldn't return to that site. 8. _ subsequently provided consent to search his home computer. A search of the cornpllter included the internet history file which was commensurate with the kinds of images claimed interest in, including teen and preteen modeling sites. While looking at these again related that if he visited a web site with inappropriate content, he would leave imjrne(iiatelv._ had a shortcut on his desktop to a file containing approximately four subfolders. Two of these sub folders contained images that were very similar in nature to what Grove described would be on his computer. Most depicted young females and appeared to be in either photo shoot type settings or in swimwear. There were some images of naked females in each of the folders, but these females appeared to be over the age of eighteen. SA _ used a "pre search" software program to view all of the image files o~ computer. A couple of images located in the "temporary internet files" area of the computer appeared to be females of questionable age, possibly younger than eighteen. These images and the location of the images on the computer appear to be consistent with_ description of his internet interests and acti vities. 9. Based on the information developed during the course of this investigation, the DCIS, Sioux Falls Post of Duty and ICE, Grand Forks, ND, consider this investigation closed. All investigative leads have been covered and no further investigative aptivity is anticipated. per effi8... BE 8N... your agency. document be d A-3 r eneral for Investigllli0la!' amiiii of tile Department of Defense Inspector b(8) b(7){c)

200701553H-31-JUL-2007-40SX-YOIU March 17, 2008 IDENTITY OF SUBJECTS Name Alias Social Security Number Date of Birth Race Sex Residence Employment/Occupation IDENTIFYING DATA Telephone Number ClASSIFICATION: FeR efflel... we. ONI. ' B-1 b(8} b(7}(c) '11'.11.18 ":~=~~~n;rtyr-:0f;:th~e~d::epa:rtment of Defense Inspector G to V~.. gation nor may this uthorldtion of the

r 200701 553H-31-JUL-2007-40SX-yotu March 17, 2008 EXHIBITS None. Previously submitted. CLASSIFICATION; Prepared by: rer errlgiai. U81i ONL Sioux Falls Post of Duty C-I APPR:_ b(b) b(7)(c) '(I"Allltl.. property of the Department of Defen.. Inspedor a.n I ves atlon nor may th. IfIc prior authol1zlltion of the

(Investigations) INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE WESTERN FIELD OFFICE 26722 PLAZA ST, STE 130 MISSION VIEJO, CA 92691-6300 REPORT OF INVESTIGATION 200701606N-08-AUG-2007-50LA-WI November 17. 2009 GRANT, GARY DOUGLASS DISTRIBUTION DCIS, Headquaters (03NS) ICE. Santa Ana. CA CLASSlFlCAllON: FeR effle.a... ee en... C-l b(8} b(7}{c)

20070 I 606N-08-AUG-2007-S0LA-W IIF November 17,2009 NARRATIVE 1. On July 18, 2007, _. DCIS Arlington Resident Agency, referred identifying information for sixteen persons ties to the Department of Defense (DoD) who are in the DCIS Mission Viejo Resident Agency area of responsibility (AOR) and are suspected of involvement in child pornography. initially received the information from Assistant United States Attorney United States Attorney's Office (USAO), Eastern District of Virginia. The persons identified are active and retired military members, DoD civilians and DoD contractor employees, several of whom have Top Secret or higher clearances and all of whom used ".mil" e-mail addresses to register for access to child pornography websites. 2. In April 2006, the Immigration and Customs EnforcementfCyber Crimes Center/Child Exploitation Section (ICE/C3/CES) initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection." The investigation revealed that the same organization is operating numerous commercial child pornography websites. In addition, the organization utilizes various PayPal accounts to process the payments for access to the member restricted websites. The investigation was worked jointly with ICElC3/CES, ICEIBirmingham, the U.S. Postal Inspection Service, the U.S. Department of Justice/Child Exploitation and Obscenity Section, and the USAO for the Northern District of Alabama. ICE designated this operation as Project Flicker. 3. ICElC3/CES conducted over 60 undercover transactions at the advertising websites associated with this investigation. The investigation determined that a specific criminal organization operated approximately 18 commercial child pornography portal websites which provided access to approximately 18 child pornography member-restricted websites, using a specific and identifiable payment website known as "iwest." The investigation identified that the criminal organization (l) used various PayPal accounts to facilitate the customer payments; (2) used specific subject identifiers within the PayPal accounts to identify purchases into the various member restricted websites; and (3) used specific administrative e-mail accounts that are used to distribute access to the member restricted websites. 4. Project Flicker data was sorted to identify individuals who used their.mil e-mail address, Fleet Post Office, or Army Post Office military zip codes to register for the PayPal service to access the child pornography websites. Gary Grant, Captain, U.S. Army Reserves was one of the individuals identified from this data. Grant is a JAG assigned to the Judge Advocate detachment at the Los Alamitos Army Reserve Base, Los Alamitos, CA. 5. On August 28,2007, a search warrant was conducted at Grant's residence. The investigation revealed that Grant sent, through the Internet, an image depicting minors engaged in sexually explicit conduct as set forth in California Penal Code Section 311 1). Specifically, on sent America Online users and an email with image "YGP5A A9.jpg" depicts a nude...",u.a.", l",alulllk back in the sand and facing the viewer. The minor female has her left leg bent and is exposing her genitals. A-I b(8} b(7){c)

200701 606N-08-AUG-2007-50LA-Wl IF November 17, 2009 6. On August 5, 2008, Grant was arrested pursuant to a State of California warrant. The arrest occurred at Grant's residence located at 55 Bluff Cove Drive, Aliso Viejo, CA, 92656. Also participating with DCIS in the arrest were Special Agents from Immigration and Customs Enforcement (ICE) and investigators with the Orange County, CA Sheriffs Department. Grant was arrested for three counts of California Penal Code 311.11 (a), possession of obscene matter of a minor in a sexual act (Refer to Exhibit 1). 7. On April 8, 2009, Grant pled guilty in Superior Court of California, County of Orange, to possession of obscene matter of a minor in a sexual act, California Penal Code 311.l1(a). Grant was sentenced to 90 days confinement and three years probation (Refer to Exhibit's 2 & 3). 8. In light of the successful prosecution of Grant, this investigation is considered formally closed. The DCIS, Mission Viejo Resident Agency, will devote no further resources to the matter. This case was conducted jointly with the ICE, Santa Ana, CA. The Orange County District Attorney's Office, handled the criminal prosecution. 9. No operational readiness or safety issues were identified during the investigation, and no systemic weaknesses were revealed. Therefore, no Fraud Vulnerability Report will be generated. A-l

200701606N-08-AUG-2007-50LA-WIIF November 17, 2009 IDENTITY OF SUBJECT IDENTIFYING DATA NAME ALIAS DOD SSN HEIGHT WEIGHT HAIR EYES ADDRESS PHONE DRIVERS LICENSE # STATUS OCCUPATION Gary Douglass Grant Gary Dougalss Grant; Gary Dougals Grant fi1i111957 1701bs. Brown Lawyer 8-1 b(8} b(7){c)

200701606N-08-AUG-2007-50LA-WIIF November 17,2009 EXHIBITS 1. DCIS Fonn 1, "Arrest Report," dated August 5,2008, with attachments. 2. DCIS Fonn I, "Significant Incident-Guilty Plea & Sentencing," dated April 27, 2009, with attaclunent. 3. DCIS Fonn 1, "People Vs Grant Minute Order," dated November 11,2009, with attaclunent. Prepared by Special Agent ~_ Mission Viejo Resident Agency APPR: -cb(8) b(7}{c)

- (Investigations) INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE KANSAS CITY RESIDENT AGENCY 500 STATE AVE, STE 565 KANSAS CITY, KS 66101-2453 REPORT OF INVESTIGATION 20070 1620B-l 0-AUG-2007-40KC-YOIF SEPTEMBER 7, 2009 SHAWN MULLEN JAMES MA TIES DISTRIBUTION DCISHQ (03NS) DC IS Central Field Office (40FO) CLAS8IFlCA non: rty of the Department of DefanH Inspector GIl your agency. C nor may this document be d riution of the

200701620B-IO-AUG-2007-40KC-YOIF SEPTEMBER 7, 2009 TABLE OF CONTENTS SECTION Synopsis.... Statutes.... Background.... Narrative.... Identity of Subjects.... Law Enforcement Records.... Evidence.... Status of Investigation.... Prosecutive Considerations.... Exhibits.... A A B B C D E F F G FeR efflelal lise anl your agency. C document be Y!A"'Ut... roperty of the Department of Defenee Inspector General n nor IIIIIY this authom.tton of the General for Investigations.

200701620B-I0-AUG-2007-40KC-YOIF SEPTEMBER 7, 2009 SYNOPSIS Immigration and Customs Enforcement (ICE) conducted a national investigation that identified over 5,000 individuals who subscribed to predicated child pornography websites. The Reporting Agent (RA) utilized information contained within the DoD Employee Interactive Data System (DEIDS) and the Joint Personnel Adjudication Systems (JPAS) to identify DoD affiliated individuals. The RA identified 14 possible subjects with a DoD nexus, and with ties to the DCIS Kansas City Resident Agency areas of responsibility. After further interviews and data checks, two individuals were named as subjects in this case, Shawn Mullen (Mullen) and James Mattes (Mattes). A search warrant was executed at Mullen's residence. Analysis of the computers seized during the warrant identified images of child pornography. Mullen was indicted on one count receipt of child pornography in violation of 18 U.S.C. 2252(a)(2), and one count possession of child pornography in violation of 18 U.S.C. 2252(a)(4)(B) of which he pleaded guilty. Mullen was sentenced to 78 months confinement and 8 years supervised release. Mattes was interviewed and consented to a search of his personal computer. Analysis of the computer identified images of child pornography. Mattes was indicted on one count receipt of visual depictions involving the use of minors engaging in sexually explicit conduct by means of computer in violation of 18 U.S.C. 2252(a)(2), and one count possession of material involving sexual exploitation of minors, 18 U.S.C. 2252(a)(4)(B). Mattes pleaded guilty to Count 1 of the indictment, 18 U.S.C. 2252(a)(2), receipt. Mattes was sentenced to 65 months confinement, 5 years supervised release and $5,000 in restitution. The case was successfully prosecuted by the U.S. Attorney's Office, District of Kansas and District of Southern Iowa. STATUTES The following violations of the United States Code apply to this investigation: 18 USC 2252(a)(2) 18 USC 2252(a)(4)(B) (Receipt of Child Pornography) (Possession of Child Pornography) FaR afflelal "8E BNW A ViA.. II". of the Department of Defense In.pec:tor General a to a n nor may till. authorlzlltlon of the

20070 1620B-l 0-AUG-2007-40KC-YOIF SEPTEMBER 7,2009 CLASSIFICAnON: BACKGROUND This case was initiated based on information derived from Defense Criminal Investigative Service (DCIS) Project: Operation Flicker (Case Control Number 200701 1 99X). As background, on May 29, 2007, the DCIS, Mid-Atlantic Field Office (MAFO), initiated Operation Flicker based on information provided by Assistant United States Attorney (AUSA) Gerald Smagala, United States Attorney's Office (USAO), Eastern District of Virginia - Alexandria Division. AUSA Smagala advised that the Immigration and Customs Enforcement (ICE) conducted a national investigation that identified over 5,000 individuals who subscribed to predicated child pornography websites. AUSA Smagala specifically requested that DCIS assist in identifying Department of Defense (DoD) affiliated individuals and provide investigative assistance. The Reporting Agent (RA) utilized information contained within the DoD Employee Interactive Data System (DEIDS) and the Joint Personnel Adjudication Systems (JPAS) to identify DoD affiliated individuals. The RA identified 14 possible subjects (listed below) with a DoD nexus, and with ties to the DCIS Kansas City Resident Agency areas of responsibility. Search warrants and computer analysis were techniques used during the course of this investigation. NARRATIVE I. A search warrant was served on the residence of Shawn Mullen, DoD contractor. The computers and digital media seized from Mullen's house were submitted by the RA to the Defense Computer Forensics Laboratory (DCFL) in Linthicum, MD. 2. The RA and ICE SA conducted three interviews with and on September 4, 2007._ consented to an interview and a review of his admitted to subscribing to the child pornography website. The RA discovered of child pornography on his laptop and _ consented to. _seizing the laptop for further forensic review. ICE will continue the investigation involving _ without DCIS because he has since separated from the military and no longer has any DoD affiliation. The RA and interviewed _ who denied purchasing any subscriptions to child pornography has since retained an attorney. The RA contacted the Federal Bureau of Images to search their database for any information on _ his name and user name yielded no results. _ consented to an interview and a review of his computer. No images of child pornography were found and the agents will not continue the investigation on_ 3. The RA and _ interviewed James Mattes who admitted to possessing child pornography and consented to a review of his computer. The review showed that the computer B-1 'laiti.nt. ropertv of the Oepartment of Oef8nH Inspector General a b(8} b(7)(c) FeR effle.ai. U81i eni.y your agency. on nor may thi8 document be d. rlor authortzatlon of the

20070 1 620B-l 0-AUG-2oo7-40KC-YOIF SEPTEMBER 7, 2009 did have child pornography on the hard drive and Mattes consented to the seizure of the computer. The RA has been conducting a forensic examination of the computer and will submit the results to the National Center for Missing and Exploited Children upon completion to identify known victims. _ is coordinated the case with the U.S. Attorney's Office, Southern District of Iowa, which agreed to prosecute this case. Mattes was added as a subject. 4. The RA and ICE Springfield, MO interviewed review of his computer and no child pornography was _ consented to a 5. Mattes was indicted on January 23, 2008 on one count receipt of visual depictions involving the use of minors engaging in sexually explicit conduct by means of computer in violation of 18 U.S.C. 2252(a)(2), and one count possession of material involving sexual exploitation of minors, 18 U.S.C. 2252(a)(4)(B). 6. The computer analysis of Mullen's computers was completed by the Defense Computer Forensics Laboratory. Child pornography was identified. On May 21, 2008, Mullen was charged by a federal grand jury as part of a two count indictment in United States District Court, District of Kansas. Mullen was indicted on one count receipt of child pornography in violation of 18 U.S.C. 2252(a)(2), and one count possession of child pornography in violation of 18 U.S.C. 2252(a)(4)(B). 7. Mullen pleaded guilty to both counts of the May 21,2008 indictment, one count receipt of child pornography in violation of 18 U.S.C. 2252(a)(2), and one count possession of child pornography in violation of 18 U.S.C. 2252(a)(4)(B). 8. On October 3,2008, Mattes signed a plea agreement. Mattes pleaded guilty to Count I of the January 23,2008 indictment, 18 U.S.C. 2252(a)(2), receipt. Count 2 of the indictment, 18 U.s.C. 2252(a)(4)(B), possession, was dismissed at the conclusion of the sentencing hearing. 9. On April 6, 2009, Mullen was sentenced by U.S. District Judge John W. Lungstrum in United States District Court, District of Kansas. Mullen was sentenced to 78 months confinement, 8 years supervised release (to include sex offender registration) and was ordered to pay a $200 assessment fee. 10. On May 15,2009, Mattes was sentenced by Chief U.S. District Court Judge Robert W. Pratt, in United States District Court, Southern District of Iowa. Mattes was sentenced to 65 months confinement, 5 years supervised release (to include sex offender registration) and was ordered to pay a $100 assessment fee. Mattes was also ordered to forfeit the Dell Dimension com_ter 4600, Serial Number 14PKF31 used in the commission of the crime. The victim of the _ filed for $6 million dollars of restitution be paid. II. On June 22, 2009, Mattes was also ordered to pay restitution in the amount of $5,000 to the Marsh Law Firm, White Plains, New York. The Marsh Law Finn represents the victim from the which was among the images identified on Matt~s' computer. b(b) b(7){c) ~'YIIIIR"II.' roperty of the Department of Defenn ".. pector FOR OFFICIAL U81i ONI= your agency. Con vistlglluon nor may this document be dll1rlbute 9 rlor authorization of the eneral for Invaatlgationa.

20070 1620B-I 0-AUG-2007-40KC-YOIF SEPTEMBER 7,2009 IDENTITY OF SUBJECTS IDENTIFYING DATA Name Alias Social Security Number DatelPlace of Birth Race Sex Height Weight Hair Eyes Residence Employment/Occupation Telephone Number Home Driver's License Number and Issuing State Education Shawn Mullen UNK -4/30/1964, UNK Caucasian MalelFemale 6'1 " 185lbs Brown Brown Former analyst Northrop Grumman UNK UNK UNK UNK FeR efflela...,8& 8N" D-l b(8} b(1){c) :amllllle your agency. C party of the Department of Delenee IMpector General to n nor may tills document be dlbtrlb lfic or euthorlutlon of the neral for Investigations.

200701 620B-l 0-AUG-2007-40KC-YO/F SEPTEMBER 7, 2009 IDENTITY OF SUBJECTS IDENTIFYING DATA Name Alias Social Security Number DatelPlace of Birth Race Sex Height Weight Hair Eyes Residence Employment/Occupation Telephone Number Home Driver's License Number and Issuing State Education James Dean Mattes UNK ~K Caucasian MalelFemale 6'2" 200lbs Brown Brown E-7 UNK UNK UNK UNK b(8} b(7){c) CLASSIFICA non: FeR effle.a.. U8. ONL

200701620B-IO AUG-2007-40KC-YOIF SEPTEMBER 7, 2009 LAW ENFORCEMENT RECORDS The files of the Defense Clearance and Investigations Index (DClI) were queried for records of Shawn Mullen and James Mullen. A check did not reveal anything pertinent to this investigation. A National Crime Information Center (NCIC) query of Shawn Mullen and James Mattes revealed no criminal records, either state or Federal. CLASSlFICAnON: Fe. effi81al HBI! ONLY tttmltiiuii petty of the Department of Defanee lnepactor Vistlgatlon nor may til.. age authorization of the

200701620B-IO-AUG-2007-40KC-YOIF SEPTEMBER 7, 2009 EVIDENCE A. Subjects Shawn Mullen 18 USC 2252(a)(2) 18 USC 2252(a)(4)(B) (Receipt of Child Pornography) (Possession of Child Pornography) James Mattes 18 USC 2252(a)(2) 18 USC 2252(a)(4)(B) (Receipt of Child Pornography) (Possession of Child Pornography) B. Documents Previously submitted c. Witnesses None.Oll O ICIAL tj8e 8NLY E-l WARNING of the Department of Defalllle IlIlIpector General your agency. Conte to on nor may thle document be dlstrlb authorization of the eneral for Inveetlgatlons.

20070 1620B-I 0-AUG-2007-40KC-YOIF SEPTEMBER 7, 2009 STATUS OF INVESTIGATION This investigation was successfully prosecuted by U.S. Attorney's Office, District of Kansas, Kansas City, KS and Southern District oflowa, Des Moines, IA. Shawn Mullen was indicted on one count 18 USC 2252 (a)(2) and one count 18 USC 2252(a)(4)(B). He pleaded guilty both counts and was sentenced to 78 months confmement, 8 years supervised release (to include sex offender registration) and was ordered to pay a $200 assessment fee. James Mattes was indicted on one count 18 USC 2252 (a)(2) and one count 18 USC 2252(a)(4)(B). He pleaded guilty to one count of 18 USC (a)(2) and sentenced to 65 months confinement, 5 years supervised release (to include sex offender registration) and was ordered to pay a $100 assessment fee. Mattes was also ordered to forfeit the Dell Dimension comij!ter 4600, Serial Number 14PKF31 used in the commission of the crime. The victim of the _ filed for $6 million dollars of restitution to be paid. An amended judgment was led and ordered Mattes to pay $5,000 in restitution. PROSECUTNE CONSIDERATIONS There are no prosecutive considerations to date. CLASSlFlCA TJON: F8R efflela.. "ali 8N.. " F-l b(8} b(1}{c),,"r'litll the property of the Department of Defen.e In.~ nvettlgatlon nor mey thlt Iflc prior authortzatlon of the

20070 1620B-l 0-AUG-2007-40KC-YOIF SEPTEMBER 7, 2009 EXHIBITS Previously submitted. Prepared by:, Kansas City Resident Agency APPR:_ b(8} 0-1 b(7}{c) FeR efflala.. we. OHio ' roperty of the Department of Defense Inspector General and ill 0 your agency. C an r may this document be distributed ol'izatlon of the ra r Investigations.

(Investigations) DEPARTMENT OF DEFENSE OFFICE OF INSPECTOR GENERAL DEFENSE CRIMINAL INVESTIGATIVE SERVICE ARUNGTON RESIDENT AGENCY 20112 111 STREET SOUTH, SUITE 712 ARLINGTON, VIRGINIA 22202-5408 REPORT OF INVESTIGATION 200701623E-IO-AUG-2007-60DC-WIID -- July 8, 2008 DISTRIBUTION: DCIS Headquarters, National Security Program (03NS) 11(8) b(7){c) FOR OFFIOIAL!::leE ONLY LAW ENFOAGEMENT &EN&Il'll.<E

200701 623E-l 0-AUG-2007-60DC-WIID July 8, 2008 NARRATIVE: 1. This case was initiated based on infonnation derived from the DCIS Project: Operation Flicker (Case Control Number 200701199X). On May 29, 2007, the DCIS Arlington Resident Agency initiated Operation Flicker based on infonnation provided by Assistant U.S. Attorney (AUSA) Gerald Smagala, U.S. Attorney's Office, Eastern District of Virginia, Alexandria Division. AUSA Smagala advised that the Immigration and Customs Enforcement (ICE) was conducting a nationwide investigation that identified over 5,000 individuals that subscribed to predicated child pornography websites. AUSA Smagala requested DCIS assistance in identifying individuals affiliated with the DoD and investigate those individuals with ICE. AUSA Smagala identified as one individual with a DoD affiliation that subscribed to prc:ol(:au:g A query of the DoD Employee Interactive Data System indicated Reserves, E-05. A of the Joint Personnel 3. AUSA Smagala infonned that ICE did not purchase a subscription to the website_ purchased. AUSA Sm~ed criminal prosecution of_ because it could not be proven that the website purchased contained child pornography. 4. On January 16, 2008, ICE, interviewed _ at his residence. a subscription to a child pornography website. he purchased subscriptions to several online pornography websites over past few years. _ stated he encountered child pornography on the Internet on several occasions. On one occasion, after began downloading a pornographic video that he believed was adult pornography, read reviews of the video that were posted by other people that previously The posts were calling the individual that posted the video on the Internet a pedophile. After seeing the comments posted by people about the video~downloading the video because he believed it may have been child porn~ also encountered child pornography in the fonn of "pop ups" on the Internet on several occasions. _ was questioned about a website called "Red Lagoon Mags" and stated he had no knowledge of the website. ~as infonned that his credit card was used to purchase a subscription to Red Lagoon Mags for $79.99. repeated he had no knowledge of the website and stated he did not remember to the website. At the conclusion of the interview, requested voluntarily tum over computer for forensic review, but refused. then tenninated the interview. ClASSIFICATION: 5. On January."regarding f8ft 8ffieiAt li9e 8NLY I.AW &NF9AG&M&Nr SENSFFI\iE A-I "DCIS-- investigation. l"tmnin8 t is!he property of!he Department of Defense Inspector is on loan ld tents may not be d party under investigation nor may this outside!he receiving agency without the s" rization of the De neral for s. b(e} b(7}(c)

200701 623E-l 0-AUG-2007-60DC-W11D _.. July 8, 2008 7. DelS will take no further action on this matter. No fraud vulnerabilities were identified during this investigation. The investigation is closed as "declined." F9R 9FFIGIAL Y8E 9NLY LAW ENF9RGEMEN:r IENII:rI E A-2 WARNIN. nt is the property of the Department of Defense inspecldl' is on loan to tentll may not be d investigation nor may this docu without the' I s. onzation of the De ij"'it_iiiii..l_!!l..f! b(s} b(7)(c)

200701 623E-IO-AUG-2007-60DC-WlID July 8, 2008 IDENTITY OF SUBJECTS Name Social Security Number Date of Birth Sex Residence Employment/Occupation Prepared by Special Agent, Arlington Resident Agency B-1 APPR:_ b(8} b(7){c) POR OPfilelAl tlsi! ONLY LA"" rinf9agrimrin:r IriNII:rIt'1i is on loan to investigation nor may this docu without the..

(Investigations) INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE LONG BEACH RESIDENT AGENCY 501 W. OCEAN BLVD, SUITE 7300 LONG BEACH, CA 90802 REPORT OF INVESTIGATION -- 200701667W-17-AUG-2007-50ES-Wl/Z 3 I-JANUARY -2008 DISTRIBUTION Western Field Office b(8} b(7){c) FaR afflela... ee an... WtRlllll1i\ the roperty of the Department of Defense I... pector G your agency. los ViIIt &tion nor mlly this doc:ument be d Iflc prior authorization of the eneral for InvestigatIOns.

200701667W-17-AUG-2007-50ES-WlIZ 31-JANUARY-2008 NARRATIVE 1. On July 18, 2007 _. DCIS Arlington Resident Agency, referred identifying information for sixteen persons ties to the Department of Defense (DoD) who are in the DCIS Long Beach Resident Agencies (50ES) Area of Responsibility (AOR) and are suspected of purchasing and supporting the child pornography trade. initially received the information from Assistant United States Attorney States Attorney's Office (USAO), Eastern District of Virginia. The persons identified are active, reserve & retired military members, DoD civilians and DoD contractor employees, several of whom have security clearances. 2. In April 2006, the Immigration and Customs EnforcementiCyber Crimes Center/Child Exploitation Section (lce/c3/ces) initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection." The investigation revealed that the same organization is operating numerous commercial child pornography websites. In addition, the organization utilizes various Pay Pal accounts to process the payments for access to the member restricted websites. The investigation is being worked jointly with ICE/C3/CES, ICElBirmingham, the U.S. Postal Inspection Service, the U.S. Department of Justice/Child Exploitation and Obscenity Section, and the USAO for the Northern District of Alabama. ICE has designated this operation as Project Flicker. 3. ICElC3/CES conducted over 60 undercover transactions at the advertising websites associated with this investigation. The investigation determined that a specific criminal organization operates approximately 18 commercial child pornography portal web sites which provide access to approximately 18 child pornography member-restricted websites, using a specific and identifiable payment website known as "iwest." The investigation identified that the criminal organization (1) uses various PayPal accounts to facilitate the customer payments; (2) uses specific subject identifiers within the PayPai accounts to identify purchases into the various member restricted websites; and (3) uses specific administrative e-mail accounts that are used to distribute access to the member restricted websites. 4. Project Flicker data was sorted to identify individuals who used their personal e-mail addresses,.mil e-mail address, Fleet Post Office, or Army Post Office military zip codes to register for the PayPai service to access the child pornography websites. The four suspects identified in the SOES AOR have been titled as subjects based upon 'the initial evidence that was provided to the DCIS by ICE. Based upon the fact that the subjects are DoD employees and possess security ICE has listed them as a Tier 1. This investigation was coordinated with ICE Child Exploitation Unit, Long Beach, CA,,, _ has been assigned as the investigating agent, A-I b(1) b(7}(c)

200701667W-17-AUG-2007-50ES-WlIZ 31-JANUARY-2008 5. After a review of _ transactions in December 2007, it was determined that the probable cause for a search warrant was stale and that more recent evidence was not available. In addition to this information, it was also determined that a portion of the original nexus for the initiation of the investigation was incorrect. The information report referred had indicated that the subject had used hislher.mil accowlt to conduct the illegal purchase of child pornography. At the time it was decided that the use of a.mil accowlt in conjunction with the fact that the subject was a contractor to the U.S. military was sufficient nexus to initiate an investigation. However, once it was determined that the use of a.mil account did not occur and that the PC was stale and no further evidence is available, this investigation is closed. There were no management control deficiencies identified during the course of this investigation. A-2 b(8) b(7){c)

200701667W-17-AUG-2007-50ES-WI/Z 31-JANUARY-2008 IDENTITY OF SUBJECTS Identifying Data: Name Alias Social Security Nwnber DatelPlace of Birth Race Sex Residence Employment/Occupation Telephone Nwnber Education 8-1 b(8} b(7){c)

200701667W-17-AUG-2007-50ES-WlIZ 31-JANUARY-2008 EXHIBITS No Exhibits Prepared By; SA, Long Beach Resident Agency APPR: C-l b(6} b(7){c)

[Add CCN to Header] Month ##, YYYY (Investigations) INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE LONG BEACH RESIDENT AGENCY 501 W. OCEAN BLVD, SUITE 7300 LONG BEACH, CA 90802 REPORT OF INVESTIGATION -- 20070 I 690T-23-AUG-2007-S0ES-W liz 31-JANVARY -2008 DISTRIBUTION Western Field Office b(b} b(7){c) CLASSIFICAnOH: FaR efflala.. YBE eniry your agency. document be d or eneral for Investigations: ag

[Add CCN to Header] Month ##, YYYY 20070 1690T -23-AUG-2007-50ES-W liz 31-JANUARY-2008 NARRATIVE I. On July 18, 2007 DClS Arlington Resident Agency. referred identifying information for sixteen persons with ties to the Department of Defense (DoD) who are in the DClS Long Beach Resident Agencies (50ES) Area of Responsibility and are suspected of purchasing and supporting the child pornography trade. initially received the information from Assistant United States Attorney States Attorney's Office (USAO). Eastern District of Virginia. The persons identified are active, reserve & retired military members, DoD civilians and DoD contractor employees, several of whom have security clearances. 2. In April 2006, the Immigration and Customs EnforcementfCyber Crimes Center/Child Exploitation Section (ICE/C3/CES) initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection." The investigation revealed that the same organization is operating numerous commercial child pornography websites. In addition, the organization utilizes various PayPal accounts to process the payments for access to the member restricted websites. The investigation is being worked jointly with ICE/C3/CES, ICE/Birmingham, the U.S. Postal Inspection Service, the U.S. Department of Justice/Child Exploitation and Obscenity Section, and the USAO for the Northern District of Alabama. ICE has designated this operation as Project Flicker. 3. ICElC3/CES conducted over 60 undercover transactions at the advertising websites associated with this investigation. The investigation determined that a specific criminal organization operates approximately 18 commercial child pornography portal websites which provide access to approximately 18 child pornography member-restricted websites, using a specific and identifiable payment website known as "iwest." The investigation identified that the criminal organization (1) uses various PayPal accounts to facilitate the customer payments; (2) uses specific subject identifiers within the PayPal accounts to identify purchases into the various member restricted websites; and (3) uses specific administrative e-mail accounts that are used to distribute access to the member restricted websites. 4. Project Flicker data was sorted to identify individuals who used their personal e-mail addresses,.mil e-mail address, Fleet Post Office, or Army Post Office military zip codes to register for the PayPal service to access the child pornography websites. The four suspects identified in the 50ES AOR have been titled as subjects based upon the initial evidence that was provided to the DCIS by ICE. Based upon the fact that the subjects are DoD employees and possess security clearances, ICE has listed them as a Tier 1. This investigation was coordinated with ICE Child Exploitation Unit, Long Beach, CA, _ has been assigned as the investigating agent, b(s} b(7}{c) POIt Opp.elAL "BE 8NL amlltl the property of the Department of Defanse Inspector Gallef"al and Is to an Investigations.

[Add CCN to Header] Month ##, YYYY 200701690T-23-AUG-2007-50ES-Wl/Z 31-JANUARY 2008 5. After a review of_ransactions in December 2007, it was determined that the probable cause for a search warrant was stale and that more recent evidence was not available. In addition to this information, it was also determined that a portion of the original nexus for the initiation of the investigation was incorrect. The information report referred had indicated that the subject had used hislher.mil account to conduct the illegal purchase of child pornography. At the time it was decided that the use of a.mil account in conjunction with the fact that the subject was a active member of the military was sufficient nexus to initiate an investigation. However, once it was determined that the use of a.mil account did not occur and that the PC was stale and no further evidence is available, this investigation is closed. There were no management control deficiencies identified during the course of this investigation. ClASSIFICATION: per efflel... "ali 8NL j A-3,.tltll ~~~~~~~party;'~of th~. ~Depa~ rtment of Defense lnepector General your agency. document be jiector General for Investigations. b(8) b(7}{c)

- " [Add CCN to Header] Month ##, YYYY 200701690T -23-AUG-2007-50ES-WlIZ 31-JANUARY-2008 EXHIBITS No Exhibits Prepared By; SA FeR efflela.. "BE en.." Long Beach Resident Agency C-l the your agency. Con document be distributed era for Investigations. b(8} b(7}{c)

- (Investigations) INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE LONG BEACH RESIDENT AGENCY 501 W. OCEAN BLVD, SLiITE 7300 LONG BEACH, CA 90802 REPORT OF INVESTIGATION -- 200701691 U-23-AUG-2007-50ES-W1/Z 31-JANUARY-2008 DISTRIBUTION Western Field Office b(8} b(7){c) FeR efflela.. yee ONIrY... 111. of the Department of Defen.e lnepactor Gen your agency. Conte n nor may thlll document be d 9 &gene or autllortzatlon of the or General for Inveetlgatlona.

200701691 U-23-AUG-2007-50ES-WlIZ 3 I-JANUARY -2008 NARRATIVE 1. On July 18,2007_. DCIS Arlington Resident Agency, referred identifying infonnation for sixteen persons With ties to the Department of Defense (DoD) who are in the DC IS Long Beach Resident Agencies (50ES) Area of and are suspected of purchasing and supporting the child pornography trade. initially received the infonnation from Assistant United States Attorney States Attorney's Office (USAO), Eastern District of Virginia. The persons identified are active, reserve & retired military members, DoD civilians and DoD contractor employees, several of whom have security clearances. 2. In April 2006, the Immigration and Customs EnforcementiCyber Crimes Center/Child Exploitation Section (ICE/C3/CES) initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection." The investigation revealed that the same organization is operating numerous commercial child pornography websites. In addition, the organization utilizes various PayPal accounts to process the payments for access to the member restricted websites. The investigation is being worked jointly with ICE/C3/CES, ICElBirmingham, the U.S. Postal Inspection Service, the U.S. Department of Justice/Child Exploitation and Obscenity Section, and the USAO for the Northern District of Alabama ICE has designated this operation as Project Flicker. 3. ICE/C3/CES conducted over 60 undercover transactions at the advertising websites associated with this investigation. The investigation detennined that a specific criminal organization operates approximately 18 commercial child pornography portal web sites which provide access to approximately 18 child pornography member-restricted websites, using a specific and identifiable payment website known as "iwest." The investigation identified that the criminal organization (1) uses various PayPal accounts to facilitate the customer payments; (2) uses specific subject identifiers within the PayPal accounts to identify purchases into the various member restricted websites; and (3) uses specific administrative e-mail accounts that are used to distribute access to the member restricted websites. 4. Project Flicker data was sorted to identify individuals who used their personal e-mail addresses,.mil e-mail address, Fleet Post Office, or Anny Post Office military zip codes to register for the PayPal service to access the child pornography websites. The four suspects identified in the 50ES AOR have been titled as subjects based upon.the initial evidence that was provided to the DCIS by ICE. Based upon the fact that the subjects are DoD employees and possess security clearances, ICE has listed them as a Tier I... This investigation was coordinated with ICE Child Exploitation Unit, Long Beach, CA,,, _ has been assigned as the investigating agent, CLASSIFICA TlON: 5. After a review of'" transactions in December 2007, it was detennined that the probable cause for a search warrant was stale and that more recent evidence was not available. In addition FeR eff181a1: "tie 8NLY A-2 your agency. C document be dlatri D IftVI;... IIII. perty of the Depaftment of Del'lln I~pector I for Investigation b(b} b(7){c)

200701691U-23-AUG-2007-50ES-WIIZ 31-JANUARY-2008 to this information, it was also detennined that a portion of the original nexus for the initiation of the investigation was incorrect. The information report referred had indicated that the subject had used hislher.mil account to conduct the illegal purchase of child pornography. At the time it was decided that the use of a.mil account in conjunction with the fact that the subject was a active member ofthe military was sufficient nexus to initiate an investigation. However, once it was determined that the use of a.mil account did not occur and thafthe PC was stale and no further evidence is available, this investigation is closed. There were no management control deficiencies identified during the course ofthis investigation. CLASSIFICAnON:.. elt e... 18IAL tj8e 8NL A-3 WMU I of the Department of Def8nse InspedDr General and I nor may tills cy r1zation of the

200701691U-23-AUG-2007-50ES-WI/Z 31-JANVARY-2008 IDENTITY OF SUBJECTS Identifying Data: Name Alias Social Security Number DatelPlace of Birth Race Sex Residence Employment/Occupation Telephone Number Education per 8FFI81Ab.. BE 8N.. V B-1 IUA<"".8 f ~1 ~~~~~~~~0~f5th~e~De~pa~rtm~en;t ;Of~Def1lnee Inspector General b(8} b(7}(c) your agency. Contents m on nor may thle document be dis. n of the or General for Invelltlgatlons.

200701691 U-23-AUG-2007-50ES-WlIZ EXHIBITS 31-JANUARY-2008 No Exhibits CLASSIFICAnON: Prepared By. FeR effle.a.. we. en... Long Beach Resident Agency C-l ",'AtIl1l8 ~~=~~~~~y o:':,the:!de:i.,8rtm.nt: 0' Defense In8pector General b(8} b(7){c) V~ to on nor may this c or authorization of the

- (Investigations) INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE LONG BEACH RESIDENT AGENCY 501 W. OCEAN BLVD, SUITE 7300 LONG BEACH, CA 90802 REPORT OF INVESTIGATION 200701 692V-23-AUG-2007-50ES-WlIZ 31-JANUARY-2008 DISTRIBUTION Western Field Office b(8} b(7){c) FeR efflela.. W6E 8NIrY :...-MII1I8 the property of the Department of Defenae Inapector General and la on loan to your agency. on. oaed to any pa u y this document be dlatrtbuted outbide the. c rior authorldition of the o gatlona.

20070 1692V -23-AUG-2007-50ES-WIll 3 I-JANUARY -2008 NARRATIVE I. On July 18, 2007 _. DCIS Arlington Resident Agency, referred identifying infonnation for sixteen persons with ties to the Department of Defense (DoD) who are in the DCIS Long Beach Resident Agencies (50ES) Area of Responsibility (AOR) and are suspected of purchasing and supporting the child pornography trade. initially received the infonnation from Assistant United States Attorney States Attorney's Office (USAO), Eastern District of Virginia. The persons identified are active, reserve & retired military members, 000 civilians and DoD contractor employees, several of whom have security clearances. 2. In April 2006, the Immigration and Customs EnforcementlCyber Crimes Center/Child Exploitation Section (ICE/C3/CES) initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection." The investigation revealed that the same organization is operating numerous commercial child pornography websites. In addition, the organization utilizes various PayPal accounts to process the payments for access to the member restricted websites. The investigation is being worked jointly with ICE/C3/CES, ICE/Binningham, the U.S. Postal Inspection Service, the U.S. Department of Justice/Child Exploitation and Obscenity Section, and the USAO for the Northern District of Alabama. ICE has designated this operation as Project Flicker. 3. ICE/C3/CES conducted over 60 undercover transactions at the advertising web sites associated with this investigation. The investigation detennined that a specific criminal organization operates approximately 18 commercial child pornography portal websites which provide access to approximately 18 child pornography member-restricted websites, using a specific and identifiable payment website known as "iwest." The investigation identified that the criminal organization (I) uses various PayPal accounts to facilitate the customer payments; (2) uses specific subject identifiers within the PayPal accounts to identify purchases into the various member restricted websites; and (3) uses specific administrative e-mail accounts that are used to distribute access to the member restricted websites. 4. Project Flicker data was sorted to identify individuals who used their personal e-mail addresses,.mil e-mail address, Fleet Post Office, or Anny Post Office military zip codes to register for the PayPal service to access the child pornography websites. The four suspects identified in the 50ES AOR have been titled as subjects based upon the initial evidence that was provided to the DCIS by ICE. Based upon the fact that the subjects'are 000 employees and possess security ICE has listed them as a Tier I. This investigation was coordinated with ICE Child Exploitation Unit, Long Beach, CA, _ has been assigned as the investigating agent, A-I b(e} b(7)(c) 'fj''''litig roperty ot tile Department of De... Inapector Gan to 9 on nor may this a ifle prior authol1zauon of tile

200701692V-23-AUG-2007-50ES-WIIZ 31-JANUARY-2008 5. After a review of _ transactions in December 2007, it was determined that the probable cause for a search warrant was stale and that more recent evidence was not available. In addition to this information, it was also determined that a portion of the original nexus for the initiation of the investigation was incorrect. The information report referred had indicated that the subject had used his/her.mil account to conduct the illegal purchase of child pornography. At the time it was decided that the use of a.mil account in conjunction with the fact that the subject was a military service member was sufficient nexus to initiate an investigation. However, once it was determined that the use of a.mil account did not occur and that the PC was stale and no further evidence is available, this investigation is closed. There were no management control deficiencies identified during the course of this investigation. A-2 b(8} b(1){c).muiline of u.. Department of Defen.. Inspector FeR efflela.. "BE 8N... your agency. Con n estigation nor may this document be d', 9 agen authorization of the eneral for Investigations,

20070 1692V -23-AUG-2007-50ES-Wl/Z 31-JANVARY-2008 IDENTITY OF SUBJECTS Name Alias Social Security Number Date/Place of Birth Race Sex Residence Employment/Occupation Telephone Number Education Identifying Data: 8-1 b(8) b(7}(c) per efflela.. we. ONLY uw'".. I your agency. property of the Def*lrnent of Defense Inspec;tol: to on c YestlgItiOn nor may this document be I IfIc prior authorization of the General for Investigations.

20070 I 692V-23-AUG-2007-50ES-WlIZ 31-JANUARY -2008 EXHIBITS None Prepared By; Long Beach Resident Agency APPR: pell epple.a.. WBC en... C-l ""AtutICil of the Department of Defen In.pector o-t'al dto b(8} b(7}{c)

(Investigations) INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE SAN FRANCISCO RESIDENT AGENCY 1301 CLAY ST, STE 480N OAKLAND, CA 94612-5217 REPORT OF INVESTIGATION 200701 756M-06-SEP-2007 50SF-W11E January 29, 2009 DISTRIBUTION Western Field Office b(8} b(7){c) PeR OFFICIAL USE ONLY

200701 756M-06-SEP-2007-50SF-WIlE January 29, 2009 NARRATIVE 1. This investigation was initiated based upon a referral from DCIS Arlington Resident Agency, Arlington VA identifying four' San Francisco Resident Agency area of responsibility who were suspected of involvement in child pornography. initially received the information from Assistant United States Attorney (AUSA) United States Attorney's Office (USAO), Eastern District of Virginia, Alexandria, VA. The subjects identified were reserve and retired military members, DoD contractor employees, and in one case a sub-contractor to a DoD contractor, all of whom used ".mil" e-mail addresses to allegedly register for access to child pornographywebsites. This investigation was conducted jointly with Immigration and Customs Enforcement (ICE) agents located in Oakland, CA, San Francisco, CA, and San Jose, CA. 2. Upon coordination with ICE regarding all four subjects, it was understood that as a matter of policy the United States Attorney's Offices (USAO), Northern District of California, San Francisco, Oakland, and San Jose, CA usually declined to accept any child pornography investigation where the subject of the investigation had not engaged in any download activity within the past six months. Due to the USAO's policy, ICE issued administrative subpoenas to PayPal to determine if the subjects had any recent download activity with known child pornography websites within the past six months. All PayPai information returned in response to the subpoenas revealed that none of the subjects had accessed child pornography within the required timeframe. At their discretion ICE agents plan to perform knock-and-talk interviews of all four subjects in order to ascertain their involvement with child pornography; however, due to the heavy case load of the assigned ICE agents and higher priority investigations, the knock-andtalk interviews are not expected to be conducted for an extended period of time. 3. Due to the policy of the USAO, the limited activity on the part oithe subjects, the length of time until the interviews will be conducted by ICE, and the need to focus on other higher priority investigations, this investigation is being closed by DCIS. It is understood that the investigations will be completed by ICE as time and their case load permits. At this time, no judicial or administrative actions are expected. There were no fraud vulnerabilities identified during the course of the investigation. PeR OFFICIAL "51! ONL.Y A b(8} b(7}(c) "A lit 14 1f4 e t is the property of the Department of Defense Inspector General an to a~ncy. an'.. ment be dl811ibuted out. of the Assistant Inspector IOns.

200701 756M-06-SEP-2007-50SF-W11E January 29,2009 IDENTITY OF SUBJECTS Name Alias Social Security Number DatelPlace of Birth Race Sex Height Weight Hair Eyes Residence Employment/Occupation Telephone Number Driver's License Number and Issuing State Education Identifying Data: DoD Affiliation: E-4, Marine Corp Reserve, Unit unknown 8-1 b(8} b(7){c) PeR e"lela:l US!! ONLY 'M'A.lltl8 erty of the Department of OefeMe Inspector General an. apency. conten.. 18 dl$lrlbuted outside G IOns.

200701 756M-06-SEP-2007-50SF-WIlE January 29, 2009 IDENTITY OF SUBJECTS Identifying Data: Name Alias Social Security Number DatelPlace of Birth Race Sex Height Weight Hair Eyes Residence Employment/Occupation Telephone Number Driver's License Number and Issuing State Education DoD Affiliation E-7, U.S. Navy, Retired rnr OFFlGI"L USE ONLY b(b} b(7)(c) 8-2 ""RtlltlG, the roperty of the Department of Defense Inspector Gen '. r may this document be,,. the Assistant Inspector

200701756M-06-SEP-2007-S0SF-WIlE January 29, 2009 IDENTITY OF SUBJECTS Identifying Data: Name Alias Social Security Number DatelPlace of Birth Race Sex Height Weight Hair Eyes Residence Employment/Occupation Telephone Number Driver's License Number and Issuing State Education DoD Affiliation -- FOR OFFIGIAL USE ONLY B-3 WARNIN8 rty of.the Department of Defense I ou b(8) b(7}(c) to nor may this document be f the Assistant Inspector

200701756M-06-SEP-2007-50SF-W11E January 29,2009 IDENTITY OF SUBJECTS Name Alias Social Security Number DatelPlace of Birth Race Sex Height Weight Hair Eyes Residence Identifying Data: Employment/Occupation Telephone Number Driver's License Number and Issuing State Education DoD Affiliation - Prepared by San Francisco RA B-4 APPR: b(8} b(7)(c} ClASSIFICATION: pelt eppi81al.. BE enly your agency. Co,,,,... 111111. of the Department of Defense Inapector General and Is a nor l11li)' tiila doeul1ient be dilltrlb orlutlon of the en... al for Investigations.

...' (Investigations) INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE COLUMBUS RESIDENT AGENCY EASTON PLAZA ONE 4449 EASTON WAY, SUITE 375 COLUMBUS, OH 43219 REPORT OF INVESTIGA non 200S000S0D-lS-0CT -2007-40CO-WlIZ December 3,2007 OPERATION FLICKER, Colwnbus, OH SPECIAL INTEREST CASE C-l ragll graralciai. ueli 8N...

, NARRATIVE 1. This investigation into individuals who subscribed to predicated child pornography websites was initiated based upon infonnation received October 15,2007, from a Special Agent (SA) with the Department of Homeland Security (DHS), Immigration and Customs Enforcement (ICE), Columbus Resident Agency (RAC/Columbus) and as a result of DCIS Project "Operation Flicker" (CCN: 200701199X-29-MA Y-2007-60DC-Wl). ICE-Columbus referred identifying information for four individuals with ties to the Department of Defense (DoD) that are in the Columbus Resident Agency area of responsibility and are suspected of involvement in child pornography. In addition to the information provided by ICE Columbus, six additional DoD related subjects in the Cleveland, OH and Detroit, MI area were identified by the DHS-ICE Detroit, MI field office and through the efforts of the Mid-Atlantic Field Office (MAFO) in Project Flicker. The persons identified are active and retired military service members. DoD civilians, and DoD contractor employees; several of the individuals have Secret or higher clearances and some may have used.mil e-mail addresses to register for access to child pornography websites. 2. In April 2006, the Immigration and Customs EnforcementlCyber Crimes Center/Child Exploitation Section (ICE/C3/CES) initiated an investigation of a criminal organization operating a commercial child pornography website known as "Home Collection." The investigation revealed that the same organization is operating numerous commercial child pornography websites. In addition, the organization utilized various PayPal accounts to process the payments for access to the member-restricted websites. The is a joint investigation with ICE/C3/CES, ICElRAClBirmingham, the U.S. Postal Inspection Service, the U.S. Department of Justice/Child Exploitation and Obscenity Section, and multiple USAO offices, including the USAO for the Northern District of Alabama. ICE designated this effort Project Flicker. DCIS MAFO and DCIS field office representatives assisted ICE after determining that DoD personnel and/or contractor personnel may have been involved in accessing and obtaining child pornography. 3. ICElC3/CES conducted over 60 undercover transactions at the advertising websites associated with this investigation. The investigation determined that a specific criminal organization operates approximately 18 commercial child pornography portal websites that provide access to approximately 18 child pornography member-restricted websites, using a specific and identifiable payment website known as "iwest." The investigation identified that the criminal organization (l) uses various PayPal accounts to facilitate the customer payments; (2) uses specific subject identifiers within the PayPal accounts to identify purchases into the various member-restricted websites; and, (3) uses specific administrative e-mail accounts to distribute access to the member restricted websites. 4. Project Flicker data was sorted to identify individuals who used their.mil e-mail address, Fleet Post Office (FPO), or Army Post Office (APO) military zip codes to register for the PayPal service for access to the child pornography websites. The suspects identified in the Columbus RA AOR will be titled as subjects if the investigation determines the individuals were involved in acquiring and/or transmitting child pornography. The priority for investigating suspects will be assessed based on their security clearances, position in their DoD organizations, whether their DoD position provides access to children, and whether they are a recidivist. 5. Prior to opening this investigation, the agent met with immigration and Customs Enforcement (ICE) Special Columbus, OH regarding Operation Flicker. An investigative plan was provided identifying information on Department of Defense employees that are the Columbus Resident Agency area of responsibility and are suspected of being involved in child pornography. _ offered ICE cooperation in this investigation. b(8} b(7}{c)

. 6. Due to DCIS Headquarters' direction and other DCIS investigative priorities, this investigation is cancelled. No subjects were formally titled in the DCIS IDS System. No judicial or administrative action will occur. There is no loss to the U.S. Government. There were no management control deficiencies identified during the course of this investigation. Prepared by Columbus RA b(8} b(7){c)

.. (Investigations) INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVES1"IGATIVE SERVICE DAYTON RESIDENT AGENCY 3066 KETTERING BLVD, #206' DAYTON, OH 46439 200800157H-02-NOV-2007-40DY-Wl 02-November-2007 INFORMATION REPORTI REFERRED: The Dayton Resident Agency (RA) received information from the Kansas City RA regarding a project that was initiated based upon information provided by the United States Attorney's Office (USAO), Eastern District of Virginia, Alexandria Division that advised the Immigration and Customs Enforcement (ICE) of a national investigation that identified over 5,000 individuals who subscribed to predicated child pornography websites. As a result of this information ICE and the U.S. Department of Justice/Child Exploitation and Obscenity Section designated this operation as Project Flicker. As a result of Project Flicker and the initiative from the US~O, ICE identified individuals under Project Flicker associated with the military by either providing their.mil e mail addresses, Fleet Post Office (FPO), or Army Post Office (APO) military zip codes. DCIS was requested to assist in identifying additional Department of Defense (DoD) affiliated individuals and provide investigative assistance. Targets of Operation Project Flicker that are affiliated with the military put national security at risk by compromising computer systems/email systems and individuals with security clearances from the DoD compromise their clearance and put themselves and the interests of DoD at risk of blackmail. bribery. and threats. A DEIDS Report o~ revealed that he is an at Fort Kentucky. It provides AREDDR~wsthat_" _." _ " <attachment 3).. A National Comprehens~ided from Choice Point was generated and lists _... address abovementioned (attachment 4). b(8) b(t}{c) POR OPPlelAi. U8. ONL.. III... perty of ttle Department of Defen.e Inspector your agency. document be dletrt eney eneral foi' Investigation.

2 "does not have a current Kentucky driver's license. Criminal Investigation Division (CID), Fort Campbell, Kentucky, Special Agent advised that ~des off-base and provided the address III te1eph~ advised that because offwould not be involved in the investigation as it would most be handled by the United States Attorney's Office, unless information was gleaned that_ was participating in criminal activity on-base. Contact with III, ICE Bowling Green, Kentucky office revealed that he was miidrnlatllon to the ICE Nashville, Tennessee office because _ resides in Clarksville, Tennessee. This information is being forwarded to the Nashville Post of Duty (POD) for further -action since Clarksville, Tennessee falls under Nashville POD Area of Response. Any further questions regarding this report should be directed to the undersigned at telephone number_ Attachments: 1) Flicker Targets in Kentucky, 1 page 2) DElOS Report, 1 page 3) REDD Report, 1 page 4) National Comprehensive Report, 26 pages Prepared by DaytonRA APPR:_ -,.,. ument is the property of the Department of Defense I b(b} b(7){c) General an to your agency. Con e disclosed t eriel,., Viii 9tRWIr any party under investiga ~ ~s document be distributed outside t ' gency without the s ' r authorization 0 SSlstant Inspector General for Investigations.

3 DISTR: 40SLl20F0120AT120NV (electronically only) ument is the property of 'I1'1III''''. the Department of Defense Inspec General an to your agency_ Contents sclosed t epp181~ va. ~ any party under investiga 1. ocument be distributed outside the re y without the 'or authorization 0 t ant Inspector General for Investigations.

... - INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE DAYTON RESIDENT AGENCY 3055 KETTERING BLVD, #205 DAYTON, OH 46439 (Investigations) 200800158I-02-NOV -2007-40DY-WI 02-November-2007 SSN:_ nknown Ft. Campbell, KY INFORMATION REPORT/ REFERRED: The Dayton Resident Agency (RA) received information from the Kansas City RA regarding a project that was initiated based upon information provided by the United States Attorney's Office (USAO), Eastern District of Virginia, Alexandria Division that advised the Immigration and Customs Enforcement (ICE) of a national investigation that identified over 5,000 individuals who subscribed to predicated child pornography websites. As a result of this information ICE and the U.S. Department of Justice/Child Exploitation and Obscenity Section designated this operation as Project Flicker. As a result of Project Flicker and the initiative from the USAO, ICE identified individuals under Project Flicker associated with the military by either providing their.mil e mail addresses, Fleet Post Office (FPO), or Army Post Office (APO) military zip codes. DCIS was requested to assist in identifying additional Department of Defense (DoD) affiliated individuals and provide investigative assistance. Targets of Operation Project Flicker that are affiliated with the military put national security at risk by compromising computer systems/email systems and individuals with security clearances from the DoD compromise their clearance and put themselves and the interests of DoD at risk of blackmail, bribery, and threats. (SSN:_, DOB: _ was identified -----. by Project as one these targets. Information he provided to an online payment website ~rnography websites listed an address of.._... A check with the DEIDS database revealed no record of_ A REDD Report shows that end date with the Army was 1). date with the Army was... and his was an enlisted 05 with the Army (attachment A Nati~~rt provided from Choice Point was generated and lists an address for (attachment 2). _ does not have a current Kentucky driver's license. b(8} b(7}(c) ClASSIFICATION: per effle.ai:.. ee 8N.. V :rio NII1I8 the property or the Department of De18nse Inspector General and.s on to to a may this r authortzlluon of the for InvHtlgations.

2 v",,,ul!;;,n,,,'u Division (CID), Fort Campbe\l, Kentucky, Special Agent never lived on-base at Fort Campbell and that the address he not exist. _ advised that because _ lives off-base, cm not the investigation as it would most likely be handled by the United States Attorney's Office, unless information was gleaned that _ was participating in criminal activity on-base. Contact with office revealed that he was ret;errimg because_ resides in Clarksville, Tennessee. ICE Bowling Green, Kentucky ICE Nashville, Tennessee office This information is being forwarded to the Nashville Post of Duty (POD) for further action since Clarksville, Tennessee falls under Nashville POD Area of Response. Any further iiiiilegarding this report should be directed to the undersigned at telephone number. Attachments: 1) REDD Report, 1 page 2) National Comprehensive Report, 5 pages Preparedby...,Da~onRA DISTR: 40S~lectronically only) APPR:_ 11M.."... cument is the property of the Department of Defense b(8} b(7){c) General an to your agency. Co e disclosed t eppiezab veb emdv any party under investiga ~s document be distributed outside th. gency without t e ior authori~ation 0 ~stant Inspector General for Investigations.

(Investigations) INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE DAYTON RESIDENT AGENCY 3055 KETTERING BLVD, #205 DAYTON, OH 45439 200800 159J-02-NOV -2007-40DY -WI 02-November-2007 INFORMATION REPORTI REFERRED: On June 25, 2007, the Dayton Resident Agency (RA) received information from the Kansas City RA regarding a project that was initiated based upon information provided by the United States Attorney's Office (USAO). Eastern District of Virginia, Alexandria Division that advised the Immigration and Customs Enforcement (ICE) of a national investigation that identified over 5,000 individuals who subscribed to predicated child pornography websites. As a result of this information ICE and the U.S. Department of Justice/Child Exploitation and Obscenity Section designated this operation as Project Flicker. As a result of Project Flicker and the initiative from the USAO, ICE identified individuals under Project Flicker associated with the military by either providing their.mil e mail addresses, Fleet Post Office (FPO), or Army Post Office (APO) military zip codes. DeIS was requested to assist in identifying additional Department of Defense (000) affiliated individuals and provide investigative assistance. Targets of Operation Project Flicker that are affiliated with the military put national security at risk by compromising computer systems/email systems and individuals with security clearances from the DoD compromise their clearance and put themselves and the interests of DoD at risk of blackmail, bribery, and threats. -(SSN:_,DOB identified by Project Flicker as one of these targets. Information he n.. r,u"""n na'{ffitent website for subscribed child pornography websites listed _ and an email address revealed that he is an enlisted 03, active duty Army, Bliss, Texas 79916. It provides a home address of". A REDO..."..,,,... with the Army is begin date was l at1l:lchilrlent 3). and his end date b(8} b(7){c) FOR OFFICIAL U81i ONL of the DejMIrtmant of Dele... Inspector Gen... nd.. an

_at A National Comprehensive 2 _ does not have a current Kentucky driver's license.. A criminal history was run for _ which revealed a charge of "wrongful use of.. the U~ Belvoir on February 2, 2005. It lis~ as being a _ tha_..._(attachment5). Anny Criminal Investigation Division (CID), Fort Campbell, Kentucky, Special Agent advised never resided on-base while stationed at Fort Campbell, Kentucky and that he is currently stationed at Fort Bliss, Texas. CID forwarded this information to CID Fort Bliss, Texas. This information is being forwarded to the El Paso Post of Duty number"_ (POD) for further action since Fort Bliss, Texas falls under El Paso POD Area of Response. Any further questions regarding this report should be directed to the undersigned at telephone Attachments: 1) Flicker Targets in Kentucky, 1 page 2) DEIDS Report, 1 page 3) REDD Report, 1 page 4) National Comprehensive Report, 10 pages 5) Criminal History, 5 pages Prepared by, Dayton RA APPR:_ DISTR: 40SLl30FO/30HS/30EP (electronically only) b(8) b(7)(c) JIMIlIi.lI. ent is the property of the Department of Defens General an ~ our agency. Co e disclosed t any party under investigat~ 1S document be distributed outside the. ency without the spe' authorization 0 ant Inspector General for Investigations.

(Investigations) INSPECTOR GENERAL DEPARTMENT OF DEFENSE DEFENSE CRIMINAL INVESTIGATIVE SERVICE SACRAMENTO POST OF DUTY 2800 COTTAGE WAY, SUITE W-1946 SACRAMENTO, CA 95825 200800 168S-05-NOV -2007-50SM-UOIX (IR) 5-November-2007 INFORMATION REPORT: The DCIS Arlington Resident Agency referred identifying information for persons with ties to the Department of Defense (DoD) that are in the DCIS Sacramento Post of Duty (POD) area of responsibility (AOR) and are suspected of involvement in child pornography. The DCIS Arlington Resident Agency initially received the information from the United States Attorney's Office (USAO). Eastern District of Virginia. The persons identified are active and retired military members, DoD civilians and DoD contractor employees. several of whom have or had Top Secret security clearances and all of whom used.mil e-mail addresses to register for access to child pornography websites. As background. in April 2006, the Immigration and Customs EnforcementlCyber Crimes Center/Child Exploitation Section (ICElC3/CES) initiated an investigation into a criminal organization operating a commercial child pornography website known as "Home Collection. If The investigation revealed that the same organization was operating numerous commercial child pornography websites. In addition. the organization utilized various Pay Pal accounts to process the payments for access to the member restricted websites. The investigation is being worked jointly with ICE/C3/CES. ICEIRAClBirmingham. the U.S. Postal Inspection Service. the U.S. Department of Justice/Child Exploitation and Obscenity Section, and the USAO for the Northern District of Alabama, ICE has designated this operation as Project Flicker. ICE/C3/CES conducted over 60 undercover transactions at the advertising web sites associated with this investigation. The investigation determined that a specific criminal organization operates approximately 18 commercial child pornography portal websites which provide access to approximately 18 child pornography member-restricted websites. using a specific and identifiable payment website known as lfiwest." The investigation identified that the criminal organization (1) uses various Pay Pal accounts to facilitate the customer payments; (2) uses specific subject identifiers within the Pay Pal accounts to identify purchases into the various member restricted websites; and (3) uses specific administrative e-mail accounts that are used to distribute access to the member restricted websites. Project Flicker data was sorted to identify individuals who used their.mil e-mail address, Fleet Post Office (FPO), or Army Post Office (APO) military zip codes to register for the Pay Pal service to access the child pornography websites. The suspects' names were queried in DCII. Auto Track and other b(15) b(7}{c) FeR effle.aia wee 8NIa It''A''I'IO of the Department of Def1ImIe Inspector GIn ency on nor 1liiy thl. of the

200800168S-05-NOV-2007-50SM-UOIX - (IR) 5-November-2007 2 applicable databases. This investigation was coordinated with the Air Force Office of Special Investigations (AFOSI), Travis Air Force Base, CA. In Swnmary, SUBJECT was identified by PROJECT FLICKER, as a possible paying member of a website containing child porno~ September 27, 2007, an interview of SUBJECT was conducted by ~ DCIS, Sacramento POD, Sacramento, CA and AFOSI Detachment 303, Travis AFB, CA. SUBJECT was advised of his rights 31, Uniform Code of Military Justice (UCMJ). SUBJECT acknowledged he understood his rights, declined legal counsel and stated he was wil1ing to answer questions. SUBJECT admitted to paying approximately $97.00 through a Pay Pal account for access to a pornography website. SUBJECT stated he logged on and viewed the site for 1-2 hours before noticing thumbnail images of females approximately 10 years of age. SUBJECT stated he immediately left the site and never went back. ICE records indicate SUBJECT only visited the site once. SUBJECT was released to his supervisor with no further investigative steps planned. SUBJECT was advised of his rights in accordance with Article 31, (DCMJ). SUBJECT acknowledged his rights, declined legal counsel and agreed to answer questions. SUBJECT provided the following information in a signed, sworn statement: SUBJECT stated some time in the past he signed up for a pornographic website. SUBJECT did not remember the exact amount he paid for access to the site. SUBJECT stated he received a username and password via his HOTMAIL account. SUBJECT logged into the site and began browsing. SUBJECT stated he got to a page containing what appeared to be underage females. SUBJECT stated he immediately left the website and never went back again. SUBJECT signed up using a Pay Pal online cash account. SUBJECT reported the loss of his credit card number in the past and had unknown charges on the stolen card. SUBJECT related one of the charges was for "Video Professor" software which was mailed to his address. SUBJECT checked with the card company and they told him there were several other charges. SUBJECT stated he disputed the charges, cancelled the card and was issued a new card. SUBJECT believes he lost the card last year. SUBJECT stated he has never "surfed" for child porn. SUBJECT has received several emails advertising porn sites but he just deletes them. The site he paid to access had adult women on the first page. On subsequent pages of the site, there were thumbnail images showing females approximately 10 years of age. SUBJECT stated he left the site when he saw the underage females. SUBJECT stated he never looked at the child porn images. Additionally, SUBJECT stated verbally he looked at the website for "one or two hours" before noticing the underage females. Agents inquired into the possibility ofa consent search of his computer. SUBJECT stated he didn't feel comfortable with anyone looking on his computer. Consent was refused. Due to SUBJECT currently being on terminal leave awaiting his retirement and no substantial evidence found concerning the allegation, no further investigation is warranted. SUBJECT provided investigators with a signed, sworn statement. b(8) b(7)(c) _PHIl'S document is the property of the Department of Defense Inspector Genera an to your agency. Contents may no. t any party under inves ~ rna' e distributed outside the receiv ou rior authorization 0 nspector General for Investigations.

- - Attachments 1. Rights Advisement form, S~ 2001 2. Signed, Sworn Statement of dated September 21,2001. 200800168S-05-NOV -2001-50SM-UOIX (IR) 5-November-2001 3 _l1li_, Prepared by: Sacramento Post of Duty DISTR: 60DC,...,... APPR:_ b(8} b(7){c) cument is the property of the Department of Defense Ins r General an our agency. Conte ~sclosed t any party under investigat~o ocument be distributed outside th ency without the spec~ orization 0 s~stant Inspector General for Investigations.