Taking down “the largest child pornography conspiracy ever prosecuted”

How the Internet police mounted an international effort against "The Cache."

by Nate Anderson - Aug 18 2013,http://arstechnica.com/tech-policy/2013/08/operation-joint-hammer-taking-down-the-largest-child-pornography-conspiracy-ever-prosecuted/

• Internet Crime

On the morning of September 10, 2008, US Postal Inspector Lori Heath had assembled a Baltimore team to raid the ramshackle Independence Street home of a suspected Internet child pornography kingpin. They got an early start; with help from local cops, Heath put the house under surveillance at 6:00am. By 8:30am, the full twelve-person group of postal inspectors, digital forensics specialists, and police officers was in position, but they couldn’t act—Heath was stalled down at the District Court, still waiting to get her search warrant signed. Without it, the raid was on hold. The target was Roger Lee Loughry Sr., a fiftysomething mechanic with a high-school education, a handlebar mustache, and a love for motorcycles. Heath, in constant communication with her team back on Independence Street, wanted her warrant before Loughry got spooked by the surveillance. While she waited, Loughry stepped out into the morning air, unkempt hair hanging to his shoulders. To ensure he didn’t leave the property, the surveillance team broke from their vehicles and detained him next to his home.
At 9:00am, federal Magistrate Judge Beth Gesner signed off on the search warrant. Heath called her team immediately and they took Loughry back inside his home. Heath herself arrived shortly, crossed the dirt driveway, and let herself into the yard through the chain-link gate in the front fence.

A note on sourcing

This feature is excerpted, in slightly modified form, from the new book The Internet Police: How Crime Went Online, and the Cops Followed by Ars deputy editor Nate Anderson. It can currently be purchased as a hardback (Amazon, Barnes & Noble, or local bookstores) or as an e-book (Amazon, iTunes, Barnes & Noble, or Google Play).
The main source material for the piece was the hundreds of pages of transcripts detailing the trial of Roger Loughry in USA v. Savigar et al.—the Southern District of Indiana case used to prosecute most of The Cache defendants—along with other court documents and interviews with the lawyers involved. Full footnotes are available in the book.

The warrant team sat Loughry on a living room couch just to the right of the front door, then spent an hour and forty minutes combing the house. The vinyl-sided home was dilapidated; Heath’s inspectors went two steps down into the basement, but the stairs were so rickety that she worried someone might fall through. Most of the time was spent on the second floor where Loughry had his bedroom, a home office, and his computer. The agents were seeking information that could tie Loughry to an Internet message board called “The Cache,” a major site where members shared links to child pornography. The government had already penetrated the board’s security and so knew the online “handles” of its members. The site’s leader went by “DAS,” while Loughry was suspected to be a co-administrator named “Mayorroger.”
In addition to all the electronic evidence they collected, agents also discovered a scrap of paper with a cryptic address fragment scrawled in the lower right corner. Turning it over, they saw another notation: “Mr. D.A. Savigar, [house number redacted], Leyland, Preston, Lancashire, United Kingdom, PR251AH.” It was the address for one Delwyn A. Savigar—whose initials spelled out “DAS”—and who was at that moment being arrested by the Lancashire Constabulary. Convinced now that she had the right guy, Heath went downstairs to speak with Loughry.
Loughry was willing to talk without a lawyer present, and he freely admitted to using the Mayorroger screen name for all sorts of online accounts; he had chosen it in the wake of a failed 1999 bid for mayor of Baltimore. He then volunteered that he was an admin for a site called The Cache—before Heath had even mentioned the name. Loughry claimed the position was just an “honorary” one, however; what most interested him about the site was a simple arcade game called “Army Corps.” And what harm was there in that?
Heath had done her research, though; she pointed out that The Cache had actually dropped support for the game some time ago. She asked Loughry about child pornography on the site. He “figured” such material was being traded on the board, he said, but claimed that he had worked to stop its spread. “The only functions I performed there was I banned people for posting child pornography,” he wrote in a signed statement at the end of this interview. “I did click the links to see their posts and then banned them... My understanding of ‘The Cache’ was they had adult porn and games. I have since left the site.” He told Heath that viewing child pornography was a “sickness”—and unlike every other man swept up in Cache-related raids across the US, Loughry refused to plead guilty. He wanted his trial.
As a government lawyer would later put it, “We expect his essential defense in substance to be, I was only an administrator of an adult porn game board, ‘The Cache.’ I didn’t know. I didn’t intend to do any of the things that the other people are doing.” The government didn’t buy it. Would a jury?

Operation Joint Hammer

The long road to Loughry’s run-down Baltimore home stretched back to Australia, where in 2006 a Queensland investigator came across a video of child sex abuse. Investigators routinely scrutinize such videos after seizure, looking for any scrap of evidence—a school logo, a poster—that might help identify either child or abuser. The Australian video depicted a man and a young girl who spoke with a Flemish accent. Queensland police therefore passed the video to counterparts half a world away in Belgium.
Incredibly, the Europeans found the man shown in the video—a father who was raping his two daughters. The man led police to the forty-two-year-old Italian photographer who had taped the abuse. The photographer had set up a studio in the Ukraine, where he produced child pornography and ran a website from which he sold more than 150 homemade creations. (The site masqueraded as a legitimate child modeling site; a secret, password-protected section contained the illicit content.)
The photographer was soon arrested by Italian police, and the real breakthrough came when investigators found his archive of 50,000 e-mails from potential customers scattered across 28 countries. The cops suddenly had more leads than they could handle. Europol, the regional version of the international police coordination organization Interpol, put together detailed planning sessions at The Hague for what was now known as Operation Koala. Police from across Europe got involved, eventually using the e-mail addresses to identify 2,500 individuals; they then launched coordinated raids in 19 countries and arrested hundreds of suspects.

Europol headquarters in the Netherlands.

Europol

While Europe planned its crackdown, Europol sent a copy of the e-mail list to US officials, who found that the United States had the dubious distinction of originating 11,000 of the messages. The FBI could turn only 700 of these into “workable investigative leads,” but even pursuing that many individuals was itself a huge job that required massive federal resources.
Operation Joint Hammer was born. When US Attorney General Michael Mukasey finally revealed Joint Hammer at a press conference in December 2008, 60 US residents had just been arrested, including a New Jersey man who pled guilty to “producing sexual images of his nine-year-old daughter” and an Arizona fifth-grade teacher eventually accused of “sexual contact with female students at his school.”
That might not sound like a large haul after the application of so many resources, but the Europol e-mails had set in motion a complex series of investigations that ran for years—indeed, as of 2013, they remain ongoing. Joint Hammer provided a new entryway into the shadowy child pornography subculture, where users built relationships of trust with one another, took pains to use security measures, and operated on small boards that did not advertise their existence. In such cases, simply knowing that a particular child porn board existed was half the battle; such sites might operate in secrecy for years. But many users had accounts on multiple boards, so cracking one site often led to the next, which led to the one after that.
With Joint Hammer, the pattern held. In 2007, a US postal inspector named Jeffrey Arney was following up on some of the Joint Hammer e-mails when he interviewed an Alabama suspect who was a member of several boards. The man eventually turned over his online identity to the inspector, offering up his e-mail accounts, his usernames, and his passwords, including credentials to a site known only as The Cache. Suddenly, the feds had a new site name—and a way inside.

members had to copy the link, paste it into a Web browser, and correct it by hand

Visitors to The Cache accessed it by visiting thecachebbs.com and saw nothing beyond a simple login screen asking for a username and password. Signing up for a new account required approval from an administrator, and such access wasn’t given out easily. But with access to the informant’s account—his username on The Cache was “Retard”—authorities bypassed the login barrier and took a look around.
At first glance, the view was unremarkable. Like most online forums, The Cache hosted numerous text-based discussion sections, including sections on politics and sports. It also explicitly banned child pornography; indeed, this was rule number one. The Cache demanded that users “not request, offer, and/or post child pornography” and went on to add that “violation of this rule will result in an immediate ban, and your law enforcement agency will be notified of the infraction.” An entire subsection of the rules spelled out what constituted “CP” in tremendous detail—”no dildos or sex toys even if it is not used. This can include a girl suggestively sucking a cucumber or other phallic symbol. You get the idea?”
But the child porn ban didn’t mean The Cache was a wholesome place. Instead, the rules were apparently driven by a particular definition of “child pornography” as hard-core sex acts. The site banned those but trafficked in all sorts of other images and videos, mostly of young children posed to display their genitals for the camera. (Federal law makes such “lascivious exhibition” material illegal, despite the distinction drawn by The Cache.)
Users were cautioned to “always surf safe. Have your Internet settings at the highest settings. Take caution when surfing the links.” Members would be “pruned” from the board if they didn’t participate regularly, which included posting material—but not directly to The Cache. Members instead compressed videos and pictures, slapped innocent-sounding names on them, applied passwords, then uploaded them to anonymous file-hosting sites across the Internet. They would then post only a link to this material on The Cache while also providing the file password in bold letters.

The investigation spread from Australia to Europe to the US.

FBI

The links they provided couldn’t be clicked; they were purposely defective. Users were told to prefix links with “hxxp://” instead of the normal Web prefix “http://” This made links impossible to click on accidentally and also provided The Cache with some protection. Any link clicked on directly from a website generates a “referrer” ID that the linked website can read and record; if Cache members began clicking on links directly from the board, third-party sites or police might one day have an easy-to-assemble list of things that Cache members were downloading. Instead, members had to copy the link, paste it into a Web browser, and correct it by hand—thereby removing The Cache’s referral.
As Postal Inspector Arney looked around the site, he found such things as a “nude” gallery, which was further subdivided into an “18+” nude gallery, a “13-to-18” nude gallery, and an “under-13” nude gallery. Following the links and using the passwords revealed the material being traded. With 1,000 members at its height, The Cache was a big deal. It was such a big deal that the government soon spun The Cache probe off from Joint Hammer and into something new: Operation Nest Egg.

Inside the nest

Arney had his evidence of wrongdoing, but he couldn’t yet identify the people behind the site. They were merely names on a screen—Mayorroger, Devil, Legend, Spit4branes. To access real identities, he needed the actual computer serving up The Cache. In February 2008, seven months after gaining access to their informant’s Cache account, US postal inspectors obtained a warrant to seize the thecachebbs.com server from North Carolina hosting company Caro.net.
Caro pulled the machine offline and turned the hard drive inside over to postal inspectors, who passed it on to the Department of Justice’s (DOJ) Child Exploitation and Obscenity Section (CEOS) in Washington, DC. James Fottrell served as head of the High Technology Investigative Unit at CEOS, and he used the main database found on the hard drive to rebuild The Cache locally in his office, creating a private, forensically sound version of the site that looked just as it would have to the site’s users. When infiltrating the board, Arney had been merely a regular user with a regular user’s limitations; now Fottrell had complete run of the site.
A few weeks later, Fottrell took his copy of The Cache out to the Immigration and Customs Enforcement (ICE) Cybercrimes Center in Fairfax, Virginia, to get more space. He set up shop in a training room with 24 computers. For a week, federal, state, and local agents sat at those computers and probed this locally re-created Cache, following its links, downloading evidence, preserving it for prosecution. The team eventually assembled investigative lead packets on every member of the site, packets that included usernames, profile information, and the Internet Protocol (IP) addresses of every machine used to access The Cache.
These IP addresses could often identify individual Internet accounts, but only with the help of service providers like AT&T or Comcast. The government sent a set of subpoenas to Internet providers across the country, asking them which subscribers had been assigned particular IP addresses at the dates and times in question. When the responses came back, the government suddenly had real names, though agents knew that an IP address alone could not tell you who had actually been using the computer at the time. Still, it provided a good place to start.
The investigative lead packets went to field agents around the country who lived close to the suspects. Mayorroger’s IP address matched a Comcast account belonging to one Roger Loughry of Baltimore, so his investigative lead packet went to an agent in the Baltimore/Washington area. Which is how Loughry’s name ended up on the desk of Postal Inspector Lori Heath.

Meet the mayor

The many faces of Roger Loughry, drawn from his MySpace page.

In 1999, Roger Loughry wanted to run for mayor of Baltimore—despite being out of work and on probation for driving while intoxicated. “I didn’t see any problem with running for mayor,” Loughry told a Baltimore Sun reporter at the time. “With Marion Barry getting busted and still getting elected [as mayor of Washington, DC], why not me?” His bid didn’t go far; Baltimore’s official results for the 1999 mayoral election show no record of his name on the ballot.
Born in March 1953, Loughry was in rough shape as the new millennium rolled in. Almost deaf in his left ear, he had brushed with the law over a pair of gun charges, marijuana possession, and a situation in which he was accused of threatening the manager of a pizza shop. He had married and fathered a pair of children, serving as their primary caregiver in the 1980s and early 1990s, a period of time during which he also admitted to using marijuana on a daily basis. Then his wife took ill; he tended her for three years, until she died. She was followed to the grave by Loughry’s mother Margarete, whose name remained on the deed of the Independence Street home where Loughry lived at the time of his arrest. He grew estranged from his family and had no “healthy support system since the death of your mother and your wife,” as a federal judge would later put it.
At some point, Loughry discovered MySpace. His profile, now frozen in time, describes him as a TRAMP—”terrific, responsible, adventurous, mystical, and profound.” (Digital forensics would later establish that “tramp” was one of his online passwords.) He most wanted to meet “real people in a real world,” he wrote. “We all need to stand together and kill the monster that is known as ‘Government.’” Pictures posted to the account show Loughry, often bare-chested, his reddish hair spilling down onto his chest. In one, he stands smiling and shirtless beside a sixties-style door studded with diamond-shaped windows. He clutches fourteen birthday balloons. Plaster and paint flake away from the background walls and ceilings.
Loughry joined The Cache in 2005, soon after its creation by Delwyn Savigar. His profile’s signature line was “Bow down to the masses” and he used a Confederate flag as his profile image. His Mayorroger account soon was made a co-administrator, one step below Savigar’s all-powerful root administrator. Loughry could create and change accounts, move and delete forum posts, even delete most of the board if he chose.
Far from ratting out the child pornographers, Loughry appeared to appreciate their work. A member provided access to images called the “school passion” series that had been ripped from another site “quite a while back when I was on dial-up.” Mayorroger responded, “Totally awesome, guys. Great work. Many, many thanks for these cuties.”

“With Marion Barry getting busted and still getting elected, why not me?”

On March 9, 2007, Mayorroger contributed to a general Cache discussion thread about the “general definition of our topic interest” and provided an account of his early life (whether truthful or not is impossible to say). “You could say I was sexually molested as a child, but I wouldn’t,” he wrote. “I learned the true beauty of the young female form long before I should have. I learned to do things that a lot of men can’t do no matter how old they are, and that is truly—and that it is truly please that luscious creature. I’m gonna tell it like this. I was five and she was six, no joke. After that I was six and they were seven, eight, nine, 14, 15, 16; again, no joke.”
He said that, as he grew older, mature female bodies never became appealing. “I used to look at LGs [little girls] and think how sweet it was back then,” he continued. “Then I happened onto RLbbs [Russian Lolita BBS], and it was all over for me. I was seeing the very things I had been imagining for so long. For me, it was like a trip back to my youth. I wouldn’t lay a hand on any LG, but to look and remember, ah, yes.”
By October 2007, the breezy tone turned chilly; Loughry was running scared. He sometimes hung out on another board where he met a man known as “Cranckrack.” Loughry and Cranckrack formed enough of a friendship that they sometimes spoke on the phone; both eventually joined The Cache, and once they actually met in person at a Baltimore “gentlemen’s tavern” called Haven Place. Shortly after this meeting, Cranckrack called Loughry and told him that postal inspectors had just seized his computer.
The raid on Cranckrack spooked Loughry, as it did other Cache admins; they knew that a raid on any one Cache user might result in government infiltrators. Michael James Baratta, a Sacramento, California, resident who operated as “DublHelix” on The Cache, would later cop a plea deal and testify that Cranckrack’s account on The Cache was shut down immediately after news of the raid broke.
“If he were in custody, they... probably would have confiscated his computer and possibly be—what is the word?— impersonating him online, perhaps,” Baratta said at Loughry’s eventual trial. “We just wanted to make sure that there was no way that anybody else except the person that we knew as Cranckrack would be able to use that account.”
Loughry’s response was to send an instant message to DublHelix on October 3, saying, “Delete me from the board.” But when DublHelix went to the other admins with news of Loughry’s “paranoia” about arrest, site leader DAS got involved. “Paranoia about what?” he wrote back. “Don’t delete him, just downgrade his account to master. If he then wishes to come back, his account will be active.”

Back for more

On January 11, 2008, seeing that nothing had happened in the last three months, Loughry’s confidence returned and he logged into The Cache once more. “Yes, it was paranoia,” he wrote when he returned. “Besides, way too much live pussy running around my house to need pics. LMFAO [laughing my fucking ass off].” He resumed his co-admin duties.
Loughry’s confidence was supremely misplaced; the feds were actually tightening the noose around The Cache, but no one on the site appeared to notice. When postal inspectors seized The Cache’s main server from Caro.net in February 2008, the site stopped functioning—but admins didn’t spend much time investigating what had happened. People who run this sort of operation don’t want to bring themselves to the attention of their own Internet providers by filing trouble tickets when their servers have problems and so, while the episode should have waved a huge red flag repeatedly in their faces, the admins instead retreated to a backup server kept in place for just such moments of downtime.
This backup server wasn’t a traditional backup containing an exact mirror of the original site, but a secondary communications channel that members could use to regroup. The Cache eventually rebuilt its main site with a different Internet hosting provider, leaving Caro.net for Atomic Colo in Minnesota. (In September 2008, when the feds were finally ready to make arrests, they seized the new Cache server—but this time also found and grabbed the backup server from Future Hosting in Dallas to ensure this wouldn’t happen again.)
Membership declined to around 530 as the noose tightened and suspected infiltrators were purged, but the core members showed signs of addiction. William Weyrick, a forty-seven-year-old Cache member from Aurora, Indiana, operated under the name “Sammybear”—a combination of names from his two dogs. After his own arrest, he plea-bargained a lower sentence for testifying about the site. When asked during Loughry’s trial if pictures on The Cache were “not right to have,” Weyrick answered, “Yes, sir. There—I, I don’t know. I guess I was just addicted. I had problems, but I, I, I know it is wrong.”
Like many members of The Cache, Loughry just couldn’t stay away even when the danger was obvious. In late 2008, investigators finally raided homes across the country, including Loughry’s, where Heath and her team put their target under arrest and began a meticulous search of Loughry’s digital devices.

Dangerous friends

Investigators executing a search warrant have long been instructed to find all active computer equipment, shut it down, and bag it for study back at a forensic lab. Called “data preservation,” the approach takes as its mantra: “Don’t touch anything—you might contaminate it.” Evidence remains unspoiled this way, but the delay in looking through the material can cause problems. When police surprise a suspect on a search, running computers in the house might contain key information. Perhaps the suspect has just logged into a secret Internet board with his credentials; perhaps he has just decrypted the hard drive partition where the worst material is stored. Turn off the computer, haul it away—and you’ve lost your advantage.
The Cache investigators trialed a more recent technique known as “on-scene computer triage.” Under this model, search warrant teams arrived with their own digital forensics specialists and began sifting the data while the suspect sat on a living room couch. The technique “treats forensics data on someone’s computer like a martini,” Assistant US Attorney Steve DeBrota, who oversaw the entire set of Cache prosecutions, told me. “If you let it get warm, it’s not worth drinking.”
On-scene computer triage had been developed in part at Purdue University, an hour north of DeBrota’s base in Indianapolis. It wasn’t widely known in 2008, but DeBrota pushed his teams in Indiana to use it with terrific success, and confession rates went up.

Assistant US Attorney Steve DeBrota, one of the most prominent US prosecutors of child pornography.

Timothy Cox, TheStatehouseFile.com. Used with permission

Investigators raided one Indiana man involved with The Cache and brought in Hamilton County’s child exploitation task force to help. The suspect had taken precautions, encrypting his hard drive, but when he saw the techs at work in his home he grew convinced that they were only minutes away from breaking in. During on-site questioning, he voluntarily surrendered the passwords.
As data use increases, so does the time needed to do an exhaustive search of that data in forensics labs. In one case, investigators came across a suspect with 12TB of data spread across 72 hard drives in his apartment. Sifting it all could take months, which wasn’t a problem if investigators wanted to convict one guy but became a huge liability when they wanted to take down a still-thriving network.
The government could build more labs, of course, but on-scene triage suggested a new approach: skim the data quickly on-site looking for other suspects, user passwords, and obvious items of value. Then act on it. Immediately. Said DeBrota, “Very dangerous offenders have very dangerous friends,” who may be hard to locate if the trail goes cold.

forensics data on someone’s computer is like a martini. If you let it get warm, it’s not worth drinking

The rest of the data can always be examined at leisure. In Loughry’s case, that job fell to computer forensics specialist Matthew Kiley, who had been at the DOJ’s CEOS unit for only a few months when Operation Nest Egg material began to arrive from across the country. In November 2008, Kiley copied the two 160GB hard drives found inside Loughry’s computer onto separate drives that he could examine without fear of tampering with the original evidence; in December, he moved on to smaller drives found atop Loughry’s stacks of DVDs. With the help of professional forensics software, Kiley rifled through Loughry’s files, the websites he had visited, and his instant messaging logs looking for evidence of child pornography—and it wasn’t hard to find.
Loughry had used Internet Explorer to visit sites like the Russian Lolita BBS and the Lair of Young Art Lovers (LOYAL). As a simple security measure, he had configured the browser to retain the list of websites he had visited for only a single day instead of the default 20 days, but this caused almost no problems for detailed forensic analysis. Little was well hidden; links to The Cache had even been bookmarked and 181 child porn pictures still sat in the Windows recycle bin.
Loughry had also used LimeWire, a peer-to-peer file-swapping application that has since been shuttered by a federal judge in a copyright infringement lawsuit. When his computer was seized, LimeWire logs showed attempts to download files with deeply incriminating names. A Windows Live Messenger log showed a conversation between Loughry and someone claiming to be a sixteen-year-old girl; Kiley’s final report noted that “the content of the chat includes sexual overtones.”
Kiley also found a host of child sex abuse videos in the Loughry evidence. A CD burned back in 2005 was labeled “LS_Movies,” an apparent reference to the huge Lolita Studios series of pictures produced by organized operators in Eastern Europe and sold around the world. A DVD burned on September 7, 2008—only three days before Postal Inspector Heath raided Loughry’s home—contained “approximately 200 pictures and 40 videos of suspected child pornography.”
Numerous Cache defendants turned out to be “contact” offenders, too—people who went far beyond just looking at pictures. “It was immensely satisfying to catch people who had gotten away with child molesting for at least ten years on multiple victims,” DeBrota told me. “If you prosecute sex crimes cases, at the end of the day what sustains you is knowing that you made an individual difference. I’ve met some of the victims that were victims of the material in The Cache case—I’ve met them. They don’t like that their material is out there. It causes them continuing chronic pain.”

The UK booking photo for Delwyn Savigar—DAS—the leader of The Cache. After his arrest, DNA evidence tied him to several unsolved sexual assaults.

In the end, of the 26 top usernames on The Cache, 22 were successfully mapped to real people. Relying in large part on digital forensic evidence, prosecutors got every other person arrested in Operation Nest Egg to plead guilty, including leader Delywn Savigar in England. (Savigar would eventually plead guilty to possessing 100,000 child pornography images, to running The Cache, and to sexual assaults on two 13-year-olds and one 16-year-old in the north of England.) “We had what they said to each other, there wasn’t much they could do,” DeBrota said.
Not Loughry, though—he alone elected to fight the sixteen counts against him on the grounds that he had actually been working from the inside to bring down the child abusers. The government was incredulous, calling The Cache “the largest child pornography conspiracy ever prosecuted by anyone anywhere” and claiming that Loughry was one of the five most culpable people. But Loughry would not bend, even if it might have meant a plea deal with a lower sentence, so his case trudged toward a trial.
After the arrests, the second innovation of the Cache investigation became clear: the government sought to hold the site’s leadership accountable for a group conspiracy rather than charging them separately. The tactical decision meant that the suspects could be consolidated into a single criminal case handled by DeBrota in an Indiana federal court. It simplified the discovery process and involved fewer prosecutors, who found it easier to get a handle on the complicated linkages between suspects in the case.
For fifteen years, DeBrota had argued for this approach to handling such cases; he told me that he felt “vindicated” by what happened with The Cache. “There’s always somebody you miss, but if you aggressively pursue groups as groups you can get a class of offenders that’s hard to find any other way,” he said. “They’re very good at hiding in plain sight.”
But charging The Cache defendants with conspiracy had a drawback—it limited the government to talking in court only about activities directly related to The Cache. Although far worse material was taken from suspects’ homes, the men weren’t charged with its possession—yet the government’s temptation to show this material to the jury anyway was powerful. And in Loughry’s case, the government indulged—with dramatic results.

“I tried to do the right things”

Loughry had little money to mount a legal defense, and he accepted court-appointed attorney Joseph Cleary of Indianapolis. After meeting with Loughry for two hours on January 16, 2009, Cleary had his doubts that his client was in a position to go to trial. “Loughry’s fixation extends to his efforts to clean up the city of Baltimore (figuratively and literally),” he told the judge overseeing the case. “Loughry claims to have run for mayor of Baltimore and [said] that he sought expertise in running the particular computer bulletin board at issue in this case in order for him to use a computer bulletin board to run for President of the United States. Counsel cannot get past Loughry’s fixation with being persecuted. . . . Counsel is unwilling to proceed without some medical assurance that Loughry is capable of making such a decision in this case.”
The Federal Bureau of Prisons examined Loughry; a doctor concluded that he suffered from severe maladaptive personality features that included a grandiose sense of self-importance and a lack of remorse—but they concluded that he was still competent to stand trial. Cleary eventually agreed. “I did not re-raise the issue in this case because I was satisfied that Mr. Loughry was competent,” he told me after the case ended.
On April 12, 2010, the trial began at the US District Court for the Southern District of Indiana in downtown Indianapolis. Loughry said almost nothing during the four days of testimony. Federal agents, including Heath and Fottrell, reconstructed the story of The Cache for the jury and walked through the contents of Loughry’s computer. Other members of The Cache testified as part of plea deals, each dispelling the idea that anyone might have used the site only to play games or to discuss politics.
Back in 2007, Marc “Kingbee” Reeder of Pennsylvania had posted a link on The Cache saying, “Once again I have decided to bestow my graciousness upon ye and post some more sets from Lolita Castle. I hope you enjoy!” At Loughry’s trial, Reeder admitting to possessing 200GB of child pornography and to being a regular on The Cache. When asked what The Cache was, he was clear: “It was a place where we traded links to images of underage girls, nude underage girls.”
Loughry declined to take the stand in his defense. He called no witnesses. Cleary’s closing argument concluded that Loughry “should be found not guilty”—a tough sell for a lawyer who also has to admit that his client “had child pornography in his house, but he is not charged with what is in his house, ladies and gentlemen, he is not. He is charged with these things on ‘The Cache.’” (I asked Cleary later what it was like to give this speech. “My job is to zealously advocate for my client and try to convince the jury that the government has failed somewhere in its burden of proof and thus my client should be acquitted,” he told me. “That was certainly difficult in this case, given the evidence arrayed against Mr. Loughry.”)
The jury left the courtroom at 2:41pm and returned at 4:11pm. In an hour and a half, they had found Loughry guilty of advertising and distributing child pornography. Loughry was taken back to prison to await his eventual fate; as a co-admin who had refused to plead out, the sentence was unlikely to be lenient.
In the four months before the judge ruled on his punishment, Loughry may have seen the jail terms piling up against the other Cache defendants: 120 months, 180 months, 240 months, even 378 months in one case, depending on how senior each man had been in the site hierarchy. Helping the government nail Loughry paid off for some. William “Sammybear” Weyrick, who showed up at Loughry’s trial to admit that he knew The Cache trafficked in child porn, received only sixty months in prison after most of the charges against him were dropped.

The jail terms piled up:
120 months,
180 months,
240 months,
even 378 months

While awaiting their sentencing in various jails scattered about the region, some Cache defendants had time to find God. One wrote in a letter to the court that “I realize now that my actions were not those of a God-fearing man; and I am deeply ashamed of what I have done. My actions, which I deeply regret, I realize now were cries for help; and because of what my cousin had done to me when I was a child, I was already in a prison of my own making, yet I did not realize at the time how imprisoned I truly was.”
Others led lives so lonely that they couldn’t find anyone to help them prepare for a long stretch in prison. Jason “Pikachu 71” Milano had lived in his Clinton Township, Michigan, mobile home for twenty-two years before his Cache-related arrest. Unable to find friends or family members who could put his possessions in storage, sell his trailer, and take care of his two Dodge Neons, Milano was reduced to begging the judge for a temporary release from jail to dispose of all his assets.
As for Loughry, he found only violence in the Kentucky prison where he was held. On August 18, 2010, he appeared before Judge William T. Lawrence for sentencing. For the first time in the case, Loughry’s voice comes through clearly. “I’ve had my face rearranged in Kentucky, literally,” he told the judge when given a chance to speak. “I’m really bad almost—well, the vision is really blurry in the right eye because it’s be being held in by a piece of titanium mesh now from this beating.” And his few possessions had gone missing while he was recovering from the assault; Loughry blamed prison officials.
Loughry saw his life as one subject to a “system” of overlapping authorities, each with minimal competence and in little contact with one another. “This system really does suck,” he said. “It’s not just on the outside, in Baltimore, it’s all over.” He claimed to have spent years filming gang violence on his street—but said that police refused to respond to his calls or to watch his VHS recordings. He claimed to have filmed his postman tossing Loughry’s mail in the rough direction of the porch, where half the time it fell short and would be covered in rain or snow; the Postmaster General would, he said, do nothing. He claimed that his garbage collector tossed trash in front of his house—yet it was Loughry who got a citation for littering. His 97-year-old neighbor threw “dirty diapers among other trash” into his yard and onto his roof, but “she don’t care. I’ve got it on videotape since ‘97.” And after his arrest, the City of Baltimore fined him $3,000 “because I was not there this past winter to shovel the seven feet of snow off the sidewalk,” he said. Those fines went unpaid; Loughry heard that the city eventually seized his mother’s home, but he didn’t know. (His probation officer said the issue was actually one of back taxes.)

Loughry in happier times.

The judge took note of all these complaints, concluded that none posed a material challenge to the case, and prepared to pronounce the sentence. Loughry received permission for a final oration. His statement, the longest single one he made during his case, reveals Loughry’s view of himself as a fundamentally decent person:

At my wife’s prodding, I took a bunch of old computer parts I had laying around the house, built computers for some of the kids in the neighborhood that couldn’t afford it and parents couldn’t afford ‘em. Granted, they didn’t get online, but at least they had a head start. I was part of the Maryland Toy Run from approximately ‘87 forward, which is [where] they give money, collect money and toys for children, needy children. Toys for Tots. I have had a hand in part of that.
My neighbors—a lot of my neighbors are handicapped senior citizens that are on fixed incomes, can’t afford to pay a hundred dollars plus garages charge these days. I was a certified master automobile technician. Sometimes I work on their cars for nothing just because they’re neighbors. They needed a break. I spent a lot of time and effort cleaning up my neighborhood; trash, actual refrigerators, stuff like that thrown around. . .
I was told I was stupid, I was crazy, because people don’t work for free, you know. Well, when your 88 year old neighbor can’t afford to have her car fixed but she depends on that car, you fix it if you can. I’m not saying I bought the parts or anything. She would have to buy her parts or he would have to buy their parts, but I could do the labor for free, and I did a lot of that.
I’m not the bad guy that this report shows, believe it or not. There’s a lot of good I’ve been doing.

Loughry traced his personal transformation back to a motorcycle accident on October 5, 1980 at 2:00pm. “It was a Sunday,” he told the judge. “I remember it well. I died in that accident... Right after I died in that motorcycle accident and came back to life—things changed for me. I tried as hard as I could. I tried to clean up my neighborhood, both physically and criminally and you name it. I tried to do the right things for a lot of people.”
Yet, returned from the dead, Loughry could not deny that he had spent a fair chunk of his brand-new life on child porn websites, eventually co-administering the largest one discovered in the United States to that point. He expressed no remorse, accepted no responsibility.
When Loughry’s speech concluded, Judge Lawrence told him, “Clearly the offenses you have been found guilty of are extremely serious and involve the exploitation of minor children who continue to be victimized each time a computer file or movie is downloaded, or a photograph is viewed or printed. There is no foreseeable end to their victimization.” He sentenced Loughry to 360 months in jail.
The prison term is unlikely to be a placid one. Child abusers of all stripes face violence in prison, and Loughry had already been beaten badly. “I would suspect that it’s a difficult road ahead for Mr. Loughry,” Cleary said at the end of the hearing, “given the crime.”

The many varieties of “Internet Police”

The resources spent cracking The Cache might seem almost despair-inducing; at tremendous expense leads appear, investigations develop, communities are infiltrated—yet most casual members simply melt away into the Internet’s shadows, slipping into other closed networks not yet known or imagined by their pursuers. But traditional policing didn’t die with the Internet, and investigators have had lengthy experience in following gangsters, pornographers, and drug kingpins through a maze of (offline) social networks. Done correctly, the shutdown of a major child porn network doesn’t mean that investigators are reduced to waiting for another Queensland police officer to discover a disturbing digital video; the original investigation should provide leads into new communities.
Operation Koala in Europe spawned Operation Joint Hammer in the United States. Operation Joint Hammer spawned Operation Nest Egg, which took down The Cache. What would emerge when Nest Egg was cracked open?
We found out on August 3, 2011, when US Attorney General Eric Holder revealed Operation Delego. If The Cache was the largest child porn bust until that point, Operation Delego’s target network—called Dreamboard—broke the record again.
“Operation Delego represents the largest prosecution to date in the United States of individuals who participated in an online bulletin board conceived and operated for the sole purpose of promoting child sexual abuse, disseminating child pornography, and evading law enforcement,” said a DOJ announcement at the time.
Delego began back in December 2009, little more than a year after the raids that brought down The Cache. By June 2009, Cache members had started signing plea bargains with the government that appear to have given the feds their access to Dreamboard. Kevin “Spit4Branes” Harkless, for instance, told investigators all about The Cache and went on to describe, as the government put it, “other Internet forums dedicated to the advertisement and dissemination of child pornography.” In addition, he “provided information concerning other individuals involved in similar offenses.”
But if investigators learn something each time they shut down a site, the child pornographers take their own lessons from such raids. Dreamboard used the same system as The Cache, one in which content was posted off-site and encrypted with passwords shared only with Dreamboard members. But many users of The Cache had done little to protect their own identities; once the servers were seized, grabbing IP addresses and turning them into real names was a tedious but straightforward process. Even a co-admin like Loughry used no passwords on his computer and had installed no encryption software.
Dreamboard shored up these security weaknesses. Users routed their Internet connections through proxy servers that altered the apparent IP address of a connection, making it more difficult for people to be identified simply based on Dreamboard connection logs. Members also routinely encrypted material on their own computers to make it invisible in case of a search—encryption good enough to stymie most investigators.
Yet solid policing paid off. Dreamboard was infiltrated and 72 people were initially arrested in the United States; 19 more were picked up in 13 other countries ranging from Kenya to Ecuador to Denmark to Qatar.
Concerns that the “borderless Internet” makes anonymous crime simpler are well founded, but they only tell half the story. While Internet protocols know nothing of national borders, the Internet certainly exists within those borders even as its links extend across them. Its fiber-optic lines, switches, routers, cable modems, copper wiring, and servers all exist within geographic and political boundaries, each carrying with it layers of existing authority structures—and each authority has been happy enough to exert its coercive power upon the users sitting at the end of those connections.
The global reach and presumed anonymity of the Internet has been a boon to child pornographers by linking up far-flung people with perverse interests. But it provides similar advantages to investigators, who eventually learned how to harness their collective power to do these kinds of joint investigations that led from a video in Queensland to Operation Delego.
“The Internet has connected all of us into one world without oceans and boundaries,” said the FBI’s Shawn Henry after Joint Hammer wrapped up. “As a result, cyber crimes present a challenge that can only be effectively confronted with strength and dedication exhibited daily by law enforcement agencies around the world working in close coordination.”
Rather than creating some new "Internet Police," existing police simply added Internet issues to their bailiwicks. And the number of bailiwicks involved in taking down The Cache was impressive. A partial list of agencies involved includes the Australian police, the Belgian national police, Europol, European national police from at least nineteen countries, the FBI, US postal inspectors, ICE, the DOJ’s CEOS unit, US attorneys, state task forces like the Indiana Internet Crimes Against Children Task Force, Virginia state and local police (who helped investigators during the week spent downloading all the linked material listed on The Cache), and local police in many cities who secured homes for search warrant raids and aided in arrests.
The sheer amount of police machinery put into place by a single Queensland video was staggering. While the Internet made criminals more agile, it did the same for their pursuers—who have continued the hunt. When we spoke, DeBrota told me that his team is “actually two operations after Nest Egg” now.

Man and machine

Stories about Internet policing often focus on the tech—how a hacker exploited a particular operating system vulnerability to install malware inside a corporate firewall, how investigators used a new wireless sniffing device to spy on the hacker’s Internet traffic. But technology is only the gun; human judgment pulls the trigger, and human judgment makes the same mistakes it always does.
As Roger Loughry’s trial concluded, prosecutor Steve DeBrota called an Indiana postal inspector to the stand and walked through some of the material seized from Loughry’s house. He questioned the inspector about it and established that several of the videos showed men having sex with girls who appeared to be younger than 12. These videos had not come from The Cache, which tended to traffic in “lascivious exhibition of genitals” imagery as opposed to hard-core sex acts, and they were therefore not part of the conspiracy charges against Loughry in the case.

Technology is only the gun; human judgment pulls the trigger.

DeBrota had his reasons for focusing on the seized hard-core videos. During his initial interview with Agent Heath back in September 2008, Loughry had defined child pornography only as “images of young kids, male and female, naked, doing sexual acts, under the age of 18.” The federal criminal definition covers far more than this, but DeBrota wanted to show the jury that Loughry possessed material that qualified as child porn—even under his own incorrect definition of the term.
Loughry’s lawyer, Joe Cleary, objected. Though the videos were illegal, he said, they weren’t at issue in the case and could be improperly used to sway the jurors emotionally rather than to prove a specific charge. But the judge allowed them.
“The particular videos you are referring to were exceptionally graphic, much more so than the Cache material,” Cleary told me after the trial. “You can imagine what it would be like to watch three to four minutes of a young girl having sex with an adult male. It was disturbing and difficult to watch. The Cache evidence, while disturbing, was principally limited to images of naked girls.”
After sentencing, Loughry got a new lawyer and appealed his conviction; his key argument concerned these videos. Had they prejudiced the jury? The case moved three hours up the road from Indianapolis to the Seventh Circuit Court of Appeals in Chicago, where a three-judge panel considered the question. On October 11, 2011, the appeals court ruled that the videos had indeed been “highly inflammatory and had only minimal probative value. These errors were not harmless.”
The entire case was overturned; Loughry was granted a whole new trial.

An arrogant assumption

The Cache leadership had been decimated and its servers seized, but no one could say with confidence that the site had died. “I am sure ‘The Cache’ is back up and running somewhere else that law enforcement is not aware of,” said James Fottrell of the High Technology Investigation Unit at the DOJ’s CEOS unit, during Loughry’s trial. But “I don’t have specific information as to where ‘The Cache’ is today.”
For DeBrota, the Internet has changed his job in two ways, making it easier to untangle child porn networks—but also making the creation of those networks so much simpler. “Before the Internet was easily searchable, back when it was just e-mail—we had these guys on the run,” he told me. “Being able to find a like-minded individual easily and communicate about sexual fetishes wasn’t very easy to do in 1992 but today is trivially easy.”
Still, The Cache example shows that the child pornographers can’t act with impunity online. “Their arrogant assumption that they can do all this stuff on the Internet,” he said, “is just an arrogant assumption.”

Epilogue

Just before The Internet Police went to press, Loughry's second federal trial was held in late January 2013. The same witnesses and the same evidence were trotted out before a new jury in an Indianapolis courtroom—but without showing the hard-core videos. The jury's conclusion stayed the same: guilty. On February 12, 2013, Loughry was sentenced to 360 months in jail, with a recommendation to the Bureau of Prisons that he "be evaluated to determine if mental health counseling would be beneficial."
Loughry has appealed, again.