Detective uses computer forensics to combat child abuse <span style="color:#ff0000">(video)</span> - The Times Herald(timesherald.com)
The Times Herald (timesherald.com), Serving Norristown, PA and Montgomery County
News
Detective uses computer forensics to combat child
abuse (video)
Monday, November 29, 2010
By KEITH PHUCAS
Times Herald Staff
COURTHOUSE — One can learn a lot about people by examining their computer hard drives, according to Montgomery County Detective
Ray Kuter, a seasoned investigator who heads up the Computer Forensic Laboratory for the Major Crimes Unit.
What Kuter investigates most often are suspects who electronically trade child pornography. In the past 11 years, he’s investigated more
than 400 such cases for the District Attorney’s Office. His first case in 1999 involved an Episcopal priest from Cheltenham, Rev. Robert Orr.
Three years ago, investigators learned a 14-year-old county boy flew to Chicago to meet someone. The teen was unaware his Internet
contact was a convicted rapist. He, too, was raped.
http://timesherald.com/articles/2010/11/28/news/doc4cf33787898e8959998299.prt[11/29/2010 2:23:30 PM]
Detective uses computer forensics to combat child abuse <span style="color:#ff0000">(video)</span> - The Times Herald(timesherald.com)
“We knew he had run away, and we tracked his cell phone (calls),” Kuter said. “He thought he was going there to meet somebody his own
age.”
During his communications with the 14-year-old, the Chicago criminal utilized the wireless network of a woman who lived in the vicinity
without her knowledge to evade detection.
Detectives Mary Anders and Kathy Hart, who pose as young teen girls or boys online, routinely work Internet chat rooms on the lookout for
adults attempting to arrange a rendezvous with minors.
Investigators discovered an Upper Merion man, Brian Keith Benner, swapping sexually explicit pictures over the Internet in 2007. Kuter
found more than 3,000 images of child pornography on two of Benner’s computers. Two years later, Benner pleaded guilty and was
sentenced to 25 to 50 years behind bars.
The Benner investigation led police to suspects in 24 other states and several foreign countries.
“It’s not just Montgomery County,” Kuter said. “We find people trading child pornography, who live all across the country and all over the
world.”
In fact, he has been involved in some capacity with child pornography investigations in Canada, United Kingdom, Germany, France, Italy,
South Africa, New Zealand, Australia and the Philippines.
“Child pornography is a global thing,” he said. “(But) we found out they were organized even before the Internet.”
The detective once travelled to the Philippines to interview a boy who had lived with convicted sex offender Scott Ward, a Wharton
professor, who hosted the minor at his Ardmore residence as a foreign exchange student. Ultimately, however, the U.S. Attorney’s Office
decided not to bring the boy here to testify. Kuter later testified in federal court during the professor’s trial.
When someone is suspected of sexually exploiting a minor, the detective has law enforcement contacts overseas who can usually make
arrests.
“If they can’t handle it, they put me in touch with someone who can,” he said.
Typically, pedophiles exchange pornographic images over peer-to-peer networks, such as “Live Wire” or “Frost Wire.” Armed with this
knowledge, police monitor the networks.
Examining forensic files
http://timesherald.com/articles/2010/11/28/news/doc4cf33787898e8959998299.prt[11/29/2010 2:23:30 PM]
Detective uses computer forensics to combat child abuse <span style="color:#ff0000">(video)</span> - The Times Herald(timesherald.com)
Computer forensic analysis has come of age in recent years and is now routinely performed to gather evidence on suspects in all types of
criminal cases.
In the past, Kuter’s forensic exams showed a woman had used instant messaging to intimidate a witness set to testify in her trial,
uncovered another woman’s fraudulent online purchases of prescription drugs, and revealed some online habits of a man convicted of
murdering an East Norriton woman.
Scott Schillinger, a computer expert whom Kuter recruited, became an investigator with the county and also performs the forensic exams.
Kuter and Schillinger use great care in examining computers of suspected sex offenders, so as to avoid compromising the evidence. If the
suspect’s computer system looks as if its start-up times or access dates have been altered, the evidence could be challenged in court.
In each case, investigators make a copy of a suspect’s hard drive to examine and store the original drive in an evidence locker.
The hard drive copy and operating system are scanned for telltale signs that the user visited suspicious news groups or known child
pornography Web sites. If a familiar file is found, a forensic software tool is used to flag it.
In the past, sexually explicit pictures might have remained hidden away for years, but pornography making the rounds on the Internet has
the potential of appearing on computer screens again and again to humiliate victims.
Kuter admitted the years he’s spent looking at the graphic imagery involving children has taken a toll.
“You get sick of looking at it,” he said. “Some of them make your skin crawl.”
The former Abington policeman plans to retire in January.
The DA’s Office is a member of the Internet Crimes Against Children Task Force, which is comprised of a cooperative group of law
enforcement agencies on the international, federal, regional, state and local levels, according to the DA’s Office.
“Ray’s work has proven invaluable, because he can go behind the screen,” said DA Risa Vetri Ferman.
As Assistant DA, Ferman worked with Kuter in the Narcotics and Sex Crimes units.
“I learned so much as a young prosecutor working with him,” she said. “He’s amazing.”
The task force also educates parents, teachers and children about Internet safety.
“We’re not just arresting people,” Kuter said. “We’re also trying to prevent these things from happening to kids.”
URL: http://www.timesherald.com/articles/2010/11/28/news/doc4cf33787898e8959998299.prt
© 2010 timesherald.com, a Journal Register Property
http://timesherald.com/articles/2010/11/28/news/doc4cf33787898e8959998299.prt[11/29/2010 2:23:30 PM]