I-Team: Fairfield man caught up in notorious FBI child porn operation demands secret hacking code

Hear Hillary Lake and Paula Christian discuss this case in the podcast player above starting at 18:40.

A federal judge in Cincinnati will soon issue a ruling that could impact hundreds of arrests made nationwide when the FBI hacked into the world’s largest child pornography site.

In the coming weeks, U.S. District Judge Michael Barrett will decide if FBI agents who secretly hacked into a dark-web child porn site called “The Playpen” must turn over the spyware code agents used in the international sting operation.

A Fairfield man is launching a defense that could potentially impact the FBI’s work on child porn arrests nationwide.

Five men from southern Ohio were arrested from 2015 to 2017 in the government’s massive sting operation known as “Operation Pacifier,” which resulted in nearly 900 arrests worldwide.

The probe was controversial from the beginning.

“We’re finding a lot of the most aggressive surveillance and hacking techniques are coming up in these child porn cases,” said Colin Fieman, a Tacoma federal public defender who has handled several of these cases.

At one point, Playpen was believed to be the world’s largest child pornography website—with more than 150,000 users around the world. The FBI secretly took over the Playpen child porn website for two weeks in late February and March 2015, after getting a tip from a foreign law enforcement agency that the site’s operator had accidentally revealed its IP address.

A magistrate signed off on a search warrant allowing the FBI to operate the porn site from a government facility in Virginia. The FBI used secret spyware – a Network Investigative Technique, or NIT -- to learn the identity of website visitors who normally navigated the dark web anonymously.

The case will test just how far the government’s secret surveillance techniques can reach to capture suspected criminals on the internet.

“These are interesting test cases as to the limit of the government’s ability to search computers - when it doesn’t know whose computer it is going to search,” said University of Cincinnati law professor Donald Caster.

Armed with these computer addresses, the FBI got search warrants and built hundreds of cases. In the aftermath, attorneys across the nation have asked judges to throw out the evidence. Many argue the original search warrant was too broad and the FBI’s role in operating and expanding a child porn site too outrageous.

But so far the only argument that has been successful is one that would force the FBI to either reveal its entire secret hacking code or drop criminal charges.

That is exactly the issue that Barrett must decide in the coming weeks.

A Fairfield porn raid

In September 2015, FBI agents raided the Fairfield home of Richard Stamper, 34, armed with a search warrant.

At the time, Stamper, who was convicted in Butler County for the rape of a child under age 13 in 2003, received weekend visits from his 7-year-old son and 8-year-old stepdaughter, according to court documents.

The raid stemmed from an alleged visit that Stamper had made to the Playpen website on March 4, 2015, when FBI agents first captured his information.

During the search, FBI agents confiscated Stamper’s laptop and found more than 100 videos and thousands of photos depicting mostly girls, some younger than age 5, being raped and molested by men, according to the arrest warrant.

In October 2015 Stamper was indicted on one charge each of possessing and receiving child pornography. He is in jail awaiting trial on March 26.

But critics believe the FBI’s tactics used to arrest Stamper and others are illegal.

The technology the FBI used in the Playpen cases is so new that federal judges must make decisions without much legal history to guide them.

Barrett, the federal judge, must balance the FBI’s need to protect secret investigatory techniques with Stamper’s right to a fair trial with all the evidence necessary to mount a defense in court

Stamper’s attorney, Richard Monahan, insists the FBI made major mistakes. Not only did their malware identify the wrong computer address and operating system, he says it also altered the time-stamping component of Stamper’s computer.

“The NIT undoubtedly malfunctioned and got the MAC address and operating system wrong, or worse yet, crossed wires with the hundreds of computers it was infecting and associated another user’s computer with Mr. Stamper,” Monahan wrote in a recent motion.

More than 6,000 pornographic images that the FBI found on Stamper’s computer had been saved to the hard drive before Stamper had purchased the computer, Monahan wrote.

“Obviously, this is a factual impossibility,” Monahan wrote in a Feb. 16 court brief. “This anomaly demonstrates further evidence of error in the operation.”

The government argues that any problems with Stamper’s computer are his own doing. In the months before the FBI arrested him, Stamper installed a new hard drive into his laptop and upgraded his operating system. He also used a virtual machine to mask his online behavior, which would explain why the computer addresses don’t match, according to prosecutors’ theory.

Above all, prosecutors argue they don’t have to turn over the secret code because it is protected by law enforcement privilege.

“Disclosure … would severely compromise future investigations, and could allow other individuals to develop countermeasures to avoid detection when violating the laws of the United States,” Assistant U.S. Attorney Christy Muncy wrote in a Feb. 16 court motion.

If Barrett rules in Stamper’s favor, the FBI may decide to protect its secret code at all costs -- and drop criminal charges instead.

That’s what happened in a 2016 case in Tacoma. Fieman, the public defender, argued that his client, Jay Michaud, couldn’t get a fair trial without access to the FBI’s full code because it had potentially caused errors in his computer. A judge agreed.

Afterward, the FBI opted to drop child pornography charges against Michaud rather than give up the secret to its malware.

“Courts cannot force law enforcement agencies or the government to turn over classified information,” Fieman said. “But what they can do is order prosecutors to either turn over the discovery – the code that’s needed in order to develop a defense – or have the government dismiss the charges.”

As a result of his success, Fieman has consulted with more than 200 defense attorneys nationwide on Playpen cases.

“When the government starts to use secret surveillance methods in domestic criminal cases and say they won’t disclose what they did because they also use them for national security issues … then they really shouldn’t be using those kind of methods," Fieman said.

The code

As criminals get savvier on computers, agents must become smarter in order to catch them.

“It’s the same with any criminal violation: As they get smarter, we adapt, we find them,” FBI agent Dan Alfin, who led the Playpen probe, said in a May 2017 prepared statement. “It’s a cat-and-mouse game, except it’s not a game. Kids are being abused, and it’s our job to stop that.”

Ben Glassman, U.S. Attorney for Ohio’s Southern District, agreed.

“The Playpen cases are an example of our work underway across the nation to identify and prosecute those who exploit our children,” Glassman said in a prepared statement. “As offenders make technological advances, we will adapt and we will find them.”

Two of the five local men who were caught up in Playpen sting had a history of child pornography or crimes against children, but three others were not known to law enforcement.

Before James Gaver, of Dayton, was indicted on June 16, 2016 for federal child pornography charges, he had been convicted twice before in state court – in 1994 for gross sexual imposition and in 2002 for pandering obscenity involving a minor.

Last April, Gaver pleaded guilty to one count of possession of child pornography. He died at age 71, before serving any of his 11-year prison term.

Two others who are awaiting trial locally – Eric Schuster, 33, of Fairfield and Brandon Spicer, 42, of Franklin, have no prior history of crimes involving children, according to federal court documents.

Neither did Robert Phelps, 50, of Shelby County, who is serving a three-year prison term after he pleaded guilty to possession of child pornography in 2017.

“Mr. Phelps is essentially a good person who has one glaring weakness, an addiction to child pornography,” Phelps’ attorney, Scott Kelly, wrote in a 2017 court filing.

If the government reveals its secret malware code, it may be harder to find and prosecute these cases in the future.

“Here, the government has a legitimate need to protect the “exploit” related to the NIT,” Muncy, the prosecutor, wrote in a recent court filing. “Disclosure would hamper future investigations and allow individuals to develop countermeasures to avoid detection when violating the laws of the United States.”

Of the five local men caught up in the Playpen sting, only one -- Schuster – is accused of producing child pornography.

Agents found four internal hard drives belonging to Schuster that contained thousands of images and videos of child pornography and erotica, according to court documents.

Schuster had shared custody of his two minor children, a son, age 10, and a daughter, age 5, according to court documents.

“Its important to investigate these crimes, but you also have to know how your government is going about doing it,” Fieman said.

Whatever Judge Barrett decides in the coming weeks could set a precedent for future investigations, and not just involving child pornography.

“The Fourth Amendment says that people have the right to be free from unreasonable searches and seizures,” Caster said. “And that doesn’t just protect the child pornographer ... it protects everyone who could find themselves under the eyes of the government.”