March 23, 2023 (Austin, TX) We are proud to announce that Case Closed Software™ has achieved TX-RAMP Certification, a prestigious recognition that demonstrates our commitment to providing secure and reliable software solutions for our clients.
The Texas Risk Assessment and Mitigation Program (TX-RAMP) certification is awarded to companies that have met strict security standards and have implemented robust risk assessment and mitigation processes. This certification recognizes our dedication to providing our clients with the highest level of security and reliability in our software solutions.
At Case Closed Software, we understand the importance of protecting sensitive data and confidential information. That’s why we have invested heavily in developing a secure software platform that meets the rigorous security standards required by TX-RAMP certification.
We believe that this certification is a testament to our commitment to providing our clients with the best possible software solutions while maintaining the highest level of security and reliability. We are proud to have achieved this certification and look forward to continuing to provide our clients with the best possible service.
Waco, Texas – The City of Waco Police Department has selected specialized criminal investigation software from Case Closed Software™ to manage investigations into gangs and narcotics crimes. The new software will provide officers with the tools they need to effectively investigate and track criminal activity in these areas, allowing them to more efficiently gather and analyze data to build strong cases.
“Gang and narcotics crimes are two of the most serious challenges facing law enforcement agencies in Waco and across the country”, said Case Closed Software’s CEO Douglas Wood. “These crimes often involve complex networks of individuals and can be difficult to investigate and prosecute. The new software will help better identify and track criminal activity, and build stronger cases against those who would do harm.”
According to recent data from the Waco Police Department, narcotics-related offenses have been on the rise in recent years, with a particular increase in the abuse of opioids and other prescription drugs. The department has also reported a rise in gang activity, with several local gangs being linked to drug trafficking and other serious crimes.
Case Closed Software is a leading provider of CJIS-compliant, cloud-based criminal investigation software and has been deployed by law enforcement agencies across the country. The software is designed specifically to help investigators manage complex cases involving gangs and narcotics, providing tools for gang analysis, investigation management, and organizational reporting.
The new software is expected to be implemented in the coming weeks, and officers will receive training on how to use it effectively. The City of Waco Police Department remains committed to providing the highest level of service to the community and will continue to explore new technologies and tools to support its mission.
Case Closed Software has also recently announced that its software was being deployed for Baldwin County (GA) Sheriff’s Office.
The project arose out of a need for a sophisticated tool to help the multi-jurisdictional ICAC unit effectively triage and investigate criminal activity involving child sexual abuse materials (CSAM). In particular, we needed to come up with an investigation tool that would work around evolving laws and The Wilson Ruling of 2021.
NCMEC then creates and distributes CyberTips to appropriate law enforcement agencies and specially-trained agents.
The Anatomy of a NCMEC CyberTip for ICAC Units
Without getting too granular, a CyberTip is made up of several sections. There’s a front page, and Sections A through D. The front page will contain the date it was received, its assigned report number, and an executive summary. The executive summary will say what type of incident the report refers to, such as “Apparent Child Pornography”, and the number of files that were uploaded.
The first section of a CyberTip, Section A, has information about the reporting agency – Google, Facebook, TikTok and so on. It will also include a brief incident description, the time of the incident, the webpage involved, and the email, username, and IP address of the person reported.
Spoiler Alert… Here’s a key to The Wilson Ruling: For each file, this section says whether the reporting ESP actually viewed the file and whether the file was publicly available. We’re going to come back to this shortly.
Section B is geolocation information for the offending IP address given in the report. This helps NCMEC know which ICAC Task Force should get the tip. The ISP who owns or controls the IP address will also be listed.
Section C is for any additional information and may reference other CyberTips that are associated with the same username or IP address.
Here’s another key point related to The Wilson Ruling. The images or videos associated with the CyberTip are provided to the appropriate agency along with a PDF report, but they are NOT shown in the body of the report.
Why the CyberTip Matters
The point of describing the CyberTip here is to reinforce just how much unstructured data exists on them and foreshadow some of the pain points that ICAC teams experience in getting these CyberTips triaged.
That’s a significant component of the partnership that Case Closed Software has developed with San Diego Police Department… how to manage, de-conflict, and triage the overwhelming volume of CyberTips that each ICAC task force or investigator receives.
The other significant component of what we’ve worked on together from a technology perspective is related to how courts have applied Fourth Amendment doctrines to CSAM investigations. The Fourth Amendment, of course, is an important piece of our Bill of Rights and is supposed to protect all of us from unreasonable searches and seizures by the government.
The ICAC Investigation into Luke Noel Wilson
Let’s look at The Wilson Ruling of 2021. This came out of the court’s application of the Fourth Amendment in the case of defendant Luke Noel Wilson who, in June 2015, attached several images containing CSAM to an email on his Gmail account. Google’s screening system – which scans uploaded images and checks for identical matches in a database of confirmed CSAM – immediately flagged Wilson’s attachments as “apparent child pornography”.
Without having an employee review the attachments first, Google’s system then sent an automated report to NCMEC that included the images. As is standard policy for ESPs, the report contained information about the date and time Wilson uploaded the images, along with his email address, login information, and the IP address of the device he used to upload the images.
NCMEC subsequently forwarded the report to local law enforcement – in this case, the fine team at San Diego ICAC – where an agent reviewed the NCMEC CyberTip and inspected each of the images, confirming that they were indeed CSAM.
Relying on Google’s report and his personal observations, the agent then applied for – and obtained – a search warrant for Wilson’s email account. The agent’s affidavit accompanying the search warrant request included descriptions of the images but didn’t specifically contain any mention of matching hash values, nor any description of Google’s screening process for CSAM.
When, with search warrant in hand, the agent searched Wilson’s email account, he discovered several email exchanges in which Wilson received and sent CSAM and additionally offered to pay a woman to molest and exploit children.
Law Enforcement then obtained a search warrant for Wilson’s residence and vehicle where they discovered devices containing thousands of images of CSAM including the original four attachments. Wilson’s alleged attempt at throwing a backpack over his balcony was noticed by assisting agents and was found to contain a thumb drive full of additional Child Sexual Abuse Materials.
It was later estimated that Wilson possessed 500 videos and 11,000 images of child sexual abuse, and – a few months later – he was arrested and charged with Distribution and Possession of Child Sexual Abuse Materials.
Wilson was convicted and sentenced to 45 years in prison.
So, this seems at this point like a fairly standard ICAC case. What then happened that fundamentally changed the way ICAC units operated to triage and investigate CyberTips?
The Motion to Suppress
After his trial, Wilson filed a motion to suppress the four original attachments (the ones included in the original CyberTip) AND all evidence subsequently seized from his email account and residence, arguing that San Diego ICAC’s initial review of his attachments was a warrantless search in violation of the Fourth Amendment.
The District Court denied his motion, however, reasoning that the government does not perform a ‘search’ within the context of the Fourth Amendment when it inspects something that is ‘virtually certain’ to contain contraband.
Wilson subsequently appealed that decision to The Ninth Circuit which reversed the lower court’s decision, concluding that the agent’s viewing of the attachments violated Wilson’s 4th Amendment rights and rejecting the position that there was ‘virtual certainty’.
Basically, the Ninth Circuit said that Google’s initial report specified only the ‘general’ age of the child and the ‘general’ nature of the acts shown, and had not been viewed by any Google employee.
By viewing the four attachments without a search warrant, therefore, the higher court concluded that law enforcement unlawfully obtained new, critical information, and then used that new information to obtain warrants to search Wilson’s home and email account.
Of key importance in the ruling was the assessment that, even though Google employees viewed images identical to Wilson’s to create Google’s database of suspected CSAM, they had not viewed the actual image itself.
By contrast, after viewing the images, law enforcement could describe “the number of minors depicted, their identity, the number of adults depicted alongside the minors, the setting, and the actual sexual acts depicted.” So, even though Google’s algorithm had flagged Wilson’s attachments to a mathematical certainty that his images were “bit-for-bit” duplicates of images identified by its employees as CSAM within their database, Wilson’s motion to suppress was granted.
The fallout for ICAC Task Forces has been tremendous because of this ruling. How are ICAC units and their respective affiliates, supposed to expeditiously review, triage, and investigate a massive and growing number of CyberTips while tip-toeing around an individual’s 4th Amendment rights?
Last year, San Diego ICAC approached Case Closed Software™ with this exact set of problems and we began work on a tool designed to systematically process CyberTips – one that automates what is currently a time-consuming chain of events.
The Trouble with Triage
For most ICAC Units, individual CyberTips must be downloaded as zip files via NCMEC or IDS. Those zip files contain PDF files with unstructured text that lists:
• Reporting Agencies
• Email Addresses
• Telephone Numbers
• IP Addresses
• Hash Values
• Physical Addresses
• Sender IDs
• Recipient IDs
• Suspect Names
• Victim Names
• … and much more.
Triage administrators must:
Download each CyberTip locally
Unzip the file
Begin a long process of putting those data elements together to create a connected view of those data elements to determine solvability
And then assign to an investigator – internal or affiliate.
Oh, and then do the same for the next CyberTip… and the next one… and the next one after that.
Problem Solving for ICAC
Working with San Diego ICAC, we created a tool that allows administrators to save CyberTips directly a CJIS-Compliant ‘black box’ server instead of downloading them locally. That black box contains proprietary logic that systematically opens those zip files, pulls all of those data elements from the PDFs, grabs all of the attachments and underlying hash values, and links them into a single interface for the administrator. Important to note is that this process happens quickly and virtually eliminates the manual efforts in existence now.
We have essentially created a unique, user-friendly system where investigators cannot view attachments until they purposely elect to.
They can see usernames, IP Addresses, filenames, and an array of other information… but not the images. Images cannot be revealed until investigators have proper authority in compliance of the Wilson Ruling. It’s a simple but brilliant addition to the process that protects all parties.
Just to tie a bow around Mr. Wilson, he was eventually convicted of child molestation on the Stateside and sentenced to 25 years. He was subsequently charged and convicted of possession and distribution of CSAM on the federal side and received an additional ten years. He is where he should be, but his entire case was thrown into jeopardy when one agent viewed four files that one court felt violated his rights.
August 1, 2022 (San Diego, CA) The National Center for Missing and Exploited Children (NCMEC) is on the front lines of the fight against online crimes against children. Their ‘CyberTipline’ is the country’s centralized system for reporting the online exploitation of children.
According to NCMEC’s website, “Concerned individuals and organizations make reports of suspected online enticement of children for sexual acts, child sexual molestation, child sexual abuse material, child sex tourism, child sex trafficking, and unsolicited obscene materials sent to a child.
In the United States, there are over 60 regional ICAC Task Force agencies representing almost 5,500 individual agencies.
Sergeant Garrick Nugent is commander of the San Diego ICAC Task Force. His task force consists of roughly 33 different agencies that endeavor to work together to investigate cybercrimes against children in San Diego, Imperial, and Riverside Counties. According to Nugent, most investigations begin with NCMEC, which contacts San Diego ICAC when it believes there’s a local case. These tips, referred to as CyberTips, number in the thousands each year for San Diego ICAC alone. And that number has risen consistently over the past five years.
“I truthfully believe there are more cases,” said Nugent in a 2020 interview with a CBS affiliate in San Diego. “I wish I could say we are (keeping up with the volume). We have both children and predators that are at home. They have unprecedented access to the internet. They’ve got lots and lots of time on their hands and therefore I think we’re seeing the increase as a result.”
Dealing With Growing Volume
With each CyberTip comes a host of investigation intelligence including perpetrator usernames, unique IP addresses, suspect information, Internet Service Provider details, and much more. CyberTips also include disturbing multimedia evidence of child sexual assault materials (CSAM) that must be verified by the task force. Each CyberTip must be downloaded, opened, reviewed, verified, prioritized, and assigned to investigators who already maintain a full plate of cases to investigate. To say the problem is overwhelming is an understatement.
Since 2020, however, Nugent’s ICAC task force has worked in partnership with Texas-based Case Closed Software to develop innovative new systems designed to simplify and speed up the entire process of triaging and managing CyberTips.
The new system was implemented last year and now, according to Nugent, “greatly helps his ICAC task force to efficiently triage the NCMEC CyberTips and to control, direct, organize, review, and track our multi-agency investigations into child abuse and exploitation.”
Working Hand in Hand to Solve Problems
A quote from Nugent on Case Closed Software’s website states “This software is a must-have for ICAC units.”
Douglas Wood is the founder and CEO of Case Closed Software. According to Wood, his company has unique functionality to allow near-instant triage of CyberTips.
“As a result of our unique partnership with San Diego ICAC, users can simply save CyberTips to our CJIS-compliant cloud service, and moments later view all pertinent information for quick and effective triage”, says Wood. “They can then be assigned to any task force case agent who can use the ICAC investigation case management system to work more efficiently through investigations and prosecutions.”
The Crimes Against Children Conference
In a joint announcement, Case Closed Software and San Diego ICAC Task Force stated support for the upcoming 34th annual Crimes Against Children Conference (CACC) in Dallas, TX beginning August 8, 2022.
According to Case Closed Software, conference attendees will be able to see the ICAC task force software in action at the Exhibitor’s Hall. CCAC is presented annually by the Dallas Children’s Advocacy Center and provides training to agencies in the fields of law enforcement, social work, child protective services, child advocacy, therapy, and medicine who work directly with child victims of crime.
Investigations of human traffickers, and the subsequent rescue of victims, is a very complex undertaking. Unlike more traditional criminal investigations, there is rarely ‘one suspect’, ‘one victim’, or ‘one location’.
Instead, the crime of human trafficking takes place in a shady world that consists of multiple entities. Multiple perpetrators who work for multiple criminal organizations. Multiple victims who are trafficked by multiple pimps in multiple locations. These variables can make human trafficking a hidden crime that is difficult to investigate. The cost of not investigating, however, is the loss of lives, the loss of freedom, and the loss of innocence.
One particularly complicating feature of human trafficking investigations is the relationships between victims and traffickers. Traffickers initially use force, fraud, or coercion to lure their victims and force them into labor or commercial sexual exploitation. They seek out victims who may be susceptible to their lies for a variety of reasons including economic hardship, psychological or emotional instability, or other socio-economic disadvantages.
Once lured by the traffickers, victims rarely have an opportunity to speak out or call for help. Language barriers, fear of their attackers, lack of a social safety net, and a general feeling of helplessness overwhelm the victims. Thus, the crime becomes difficult to investigate.
But investigate we must. The cost of turning our backs on this global problem is simply too high.
This overview will focus on some best practices for managing investigations into human trafficking, the capture of perpetrators, and the rescue of victims. A haphazard approach to these sensitive and complex investigations is likely to cause more harm than good, and these best practices are designed to help your organization maximize your productivity and safely rescue more victims.
Best Practice #1 – Stay Organized
The first best practice we need to discuss is ‘Staying Organized’. What might start off as a Tip that a young girl is being sold for sex in a local hotel may quickly grow in scope to include multiple victims, multiple locations, multiple pimps, and multiple abusers. These criminal enterprises thrive in the dark and, like cockroaches, simply scatter and disappear once light is shone. The practice of staying organized helps ensure that no intelligence or evidence falls through the cracks, giving the traffickers time to scatter and hide.
Use investigation case management software. There are simply too many ‘moving parts’ within a human trafficking enterprise to attempt to stay organized without a purpose-built database. Spreadsheets, notes, cloud folders… these are all yesterday’s tools that cannot adequately manage today’s investigations.
With your case management software, track every tip that you receive. Some tips may be stronger than others. Some may lead to full-blown investigations, and some may not. In any case, track and store each tip that you receive as you never, ever know when information from those tips may become relevant to your ongoing investigations.
Triage every tip you can. Spend a moment to search your case management system to determine if anything about a tip relates to any current or past investigation. You can’t do this with paper files or spreadsheets. Perform some online research on the subject(s) of the tips to gauge how reliable the information might be. If the tip initially lacks the actionable or credible information to assign resources, keep the data in the case management system for future use. If the tip does contain actionable and credible information, use the case management system to prepare an actual Investigative Case and assign resources immediately.
Importantly, in terms of Staying Organized, use your case management process to track each action being taken on the investigation. Did someone perform some Open Source Intelligence on the suspected location? Log that information electronically so that it does not fall through the cracks.
Has an agent visited the suspected location to determine if there are likely victims there? Log that into the system. Store any videos or photographs that the investigator made and attach them right to that case.
Log and maintain notes and related files on every action taken on your human trafficking cases. Make them safe, secure, and easy to access by other team members.
Organization is the KEY to any criminal investigation, and even more so for investigations into human trafficking.
Best Practice #2 – Securely Share Information in Real-Time
Investigations into human trafficking and victim rescues are complex and cannot occur in a vacuum. Much like the criminal enterprises themselves have multiple roles such as kidnappers, transporters, handlers, and pimps for example, so must your investigation team have specialized roles. Your undercover ‘john’ cannot be the same as your public-facing advocate, for example.
The key to ensuring that everyone involved in the investigation is successful is sharing information. In an environment where traffickers are always on the lookout for potential risks to their operation, it’s of utmost importance that your operational team all be on the same page so that no missteps occur.
This type of alerting and information sharing cannot be done by text messages or word-of-mouth. It must occur within a fool-proof system of secure information sharing where there is no room for ambiguity. Lives depend upon it.
All of the actions and intelligence that is gathered during an investigation should be securely stored in your case management system. The moment a member of the investigation team submits new information, all other permitted team members should have secure, online access to the new information whether they are notes, videos, photographs or other file types. The removal of ambiguity or misinterpretation is key to ensuring that all team members are aware of the case status at all times.
As an aside, for multi-jurisdictional investigations, teams should ensure that individual members can view the information in the language of their choice in real-time. If the information was entered by an investigator in Brazil using Portuguese, that information should immediately be readable to a team member in Colombia who understands only Spanish. Always focus on ensuring your team members have access to accurate information in real-time. When time is lost, the cockroaches scatter.
In those unique situations where individual team members do NOT require access to the information, perhaps because an investigation is particularly sensitive or involves public officials, your case management system should have capabilities to disallow them from viewing the update. This keeps information in the correct hands, while still furthering the integrity of the data-sharing requirement.
Only when information is shared in real-time can managers and team leaders best determine the next steps for the investigation and rescue of victims.
Best Practice #3 – Maintain Investigation Privacy and Integrity
As mentioned above, human trafficking organizations are like cockroaches. The moment they sense something is going to shine a light on them, they disappear into the woodwork. This most tragic of outcomes is painful for both the investigators and victims alike.
Keeping the investigation lights off, therefore, must be a strategic goal of human trafficking investigations. Assigning roles to your team, and ensuring that all members are adhering to those roles, is one way to keep your actions covert and secure. If a team member’s role is to pose as an interested buyer of sex, that team member should probably not also be involved in general reconnaissance of crime scenes where he or she may be recognized.
Another way to ensure privacy and integrity is to utilize cutting-edge access policies to ensure that information is not accessed by outsiders or, worse yet, an insider to your team. Ensure, therefore, that EVERY SINGLE KEYSTROKE into your case management system is logged and reviewable. If your suspect organization packed up and left mere days before your major rescue and arrest operation, its important to know how that happened. Who accessed the information in your case management system, and why?
Make sure that the information your team is electronically storing is secure. Very secure. Use globally recognized and proven data security standards to protect all data and access to it. Ensure that all team members are trained and well-versed on any systems you are using for investigations.
There can never be too much integrity in a human trafficking investigation, and there can never be too much privacy. Loose lips sink ships. The same goes for loose investigation procedures. The line between a rescued victim and a lost opportunity is thin. Use investigation privacy and integrity to walk that line more effectively.
Best Practice #4 – Share Information with Senior Law Enforcement or Trusted Partners
As a team of human trafficking investigators, you recognize the seriousness and horror of human beings – like you, like me, like our daughters, sons, and grandchildren – being bought and sold for pleasure. You understand the misery of the victims and feel compelled to help. Good. That makes you a good person.
Law Enforcement agencies, however, do not typically act as emotional human beings. They have full caseloads involving homicides, drugs, corruption, and a host of other traditional crimes. Too often, they view human trafficking as merely ‘prostitution’. If a person wants to sell his or her body in exchange for money, there are no victims and, therefore, these cases can often receive a very low priority. Many times, they are dismissed out of hand.
The job of the human trafficking investigation team, therefore, is to get the attention of senior local law enforcement partners in a direct and meaningful manner… one that compels the officers to work with your team in rescues and arrests.
Our history and background suggest that engaging senior law enforcement ‘too early’ adds risk to the investigation. Remember, loose lips sink ships, and these cases are often viewed as unimportant.
Sadly, our experience also shows that involving senior partners ‘too late’ is problematic as police departments are often reluctant to become involved in situations that they have not directly controlled and cannot easily verify the integrity of the work done prior to their involvement.
So, the answer of when to involve your senior partners is unique to each case and each situation. That decision can’t be covered in detail here. Instead, the method used to involve local senior law enforcement – whenever that transpires – is a factor that you can and should control to maximize the potential for a successful operation.
Going in to meet with your prospective law enforcement partner should be a pleasant experience. Your team has built a good case and you’re ready to involve the authorities to help finalize the operation. Going in unprepared, however, will result in disappointment or disaster. As advocates for the prosecution of these types of crimes, you’re full of passion. Best practices, however, show that it is equally important to be full of actionable facts, evidence, and proof.
Therefore, best practices suggest that you build a ‘case file’ as you prepare to meet with law enforcement or senior management. On television, they sometimes call the visual representation of this case file a ‘murder board’. Make sure you have one. Make sure your case file lists ALL of the entities involved in your case. Make sure it includes all of the specific actions you’ve taken. Make sure it includes all of the audio, video, photos, and other evidence you’ve gathered.
Make sure the case file clearly shows the human trafficking operation. Who is in charge? Who are victims? What locations are involved? Who are the supporting witnesses?
Without an easy-to-digest case file, your chance of getting senior law enforcement’s attention diminishes quickly. So, utilize your case management system to very clearly outline the case in a compelling and thorough manner.
Best Practice #5 – Plan, Plan, and Plan Again
The final best practice is Operational Planning. Not to overstate it, but as I’ve said earlier human traffickers are cockroaches. At the first sign of light, you’ll lose them. Every time.
The final best practice for investigating human trafficking is perhaps the most important. Plan.
Plan, then plan again, and then plan once more. Plan your response to every initial tip. Plan your initial investigation work into every case. Plan the tasks and mission of every operative involved in your case. Plan how to get case information into the hands of those who need it in real-time. Plan to keep the investigation quiet so as not to risk the cockroaches running.
Plan every covert operation as if lives depended upon it. They might. Plan in advance what the ‘panic’ word is. Plan in advance what hand signals your operative might use if audio fails. Plan in advance to know where the nearest trauma center is. Plan in advance to know what other risks are present. Dogs? Security? Children?
Plan and make that plan available to everyone who needs to see it. Share that plan in your case management system and know when every user has read it.
Finally, plan to present your case in a compelling manner to senior law enforcement officials. And then work with them on a plan to successfully pull victims out of harm’s way and arrest the bad guys.
Summary of Best Practices
We have covered some of the key ingredients to a successful human trafficking investigation and rescue. Of course, no operation ever goes exactly as you expect, but by ensuring that you are following these best practices – staying organized, sharing internal information, maintaining investigation integrity, effectively engaging with senior law enforcement officials, and conducting meticulous planning – you greatly increase the likelihood that your efforts will result in the wonderful rescue of victims and the prosecution and incarceration of the perpetrators.
By Douglas Wood, entrepreneur and investigation management professional.
GASTON COUNTY, N.C. – 9 pitbull terriers from a home in Gaston County, NC are safe today after being rescued from a dogfighting ring earlier this week.
Janette Reever of the Humane Society International’s global anti-dogfighting team says that the animals are on their way now to an undisclosed shelter run by specialists in rehabilitating abused animals.
The Humane Society International uses specialized investigation management software from Texas-based Case Closed Software™ to track and investigate dogfighting and other forms of animal abuse around the globe. ™
“It’s not just medical treatment, it’s complete mind and body therapy,” Reever explained. “Removing them off their collars, you can see their relief. They know they’re being taken away.”
She says the animals have already been treated with antibiotics and pain killers for their injuries.
“What’s so unique about American Pitbull Terriers, or pitbulls in general, is that they are so loyal,” Reever said. “That’s why they are terribly exploited. You can do horrific things to them and they will still love you and still want to fight to the death for you.”
Reever says seven dogs were rescued from dogfighting on Wednesday. Two weeks prior, two dogs were rescued from animal cruelty.
One man faces eighteen felony charges related to dogfighting, cruelty to animals, and possession of drugs.