County lab keeps cyber-eye on parolees

Technicians scour electronic devices for evidence of violations
by: Christopher Onstott Jeff Snyder manages the Multnomah County Department of Community Justice computer forensics lab, helping discover what probationers and parolees are really up to by extracting data from their electronic devices.

At first glance, Jeff Snyder's clean and orderly computer laboratory appears to be disconnected from the sordid world of human trafficking and child pornography. It's not, at least not in a cyberspace age where johns can visit local websites showing prostitutes performing sex acts - and where the websites ask the johns to rate their experiences with different women, much like travel sites posting customer reviews of restaurants.

Those innocuous looking videos and DVDs piled high on the center table feature illegal child pornography. The hard drives and cell phones racked in the corner contain some of the most reprehensible images imaginable: women trussed up like animals, guns in their mouths, screaming; young children, wide-eyed and naked, forced to pose for a camera.

With more criminal offenders being released on probation and parole as an alternative to expensive prison time, probation and parole officers have taken on a greater role in maintaining public safety. They are America's new jailers.

In Multnomah County, these new jailers have a powerful weapon at their disposal: a computer forensics lab that lets officers dig through parolees' cell phones, computers and other electronic devices to find evidence of violations and crimes.

'This is a setup for supervision in the 21st century,' Snyder says, panning around the laboratory he manages. 'If you really want to look and see what someone is doing day in and day out, look and see how they're using their cell phones, computers and thumb drives, especially when they feel nobody is watching them.'

In fact, Multnomah County is taking a greater role in watching those parolees than anywhere else in the nation. Snyder's Department of Community Justice computer forensics laboratory is the most advanced such operation available to parole and probation officers anywhere.

Snyder estimates that he and fellow forensics examiner Christi Winters have received more than $300,000 in specialized training from the FBI to operate the nearly $100,000 special equipment in their lab. With their equipment and training, even emails that have been erased and Internet sites that no longer exist can be recreated.

'We do autopsies on computers,' Snyder says.

Gang of pimps

Computers are only the beginning. Anything with a digital memory can be a hiding place for the text, photos and communications that criminals need to do business, and need to keep secret, he says. Even Sony Playstation and Nintendo Wii video game systems have hard drives, and Snyder has found hidden data behind prostitution rings and ID theft on the drives.

In other counties, probation officers can take electronic devices to FBI labs but they must wait months to get the data extracted. In Multnomah County, cell phone data can be extracted within an hour; computer hard drives often in a couple of weeks. The FBI has its own local computer forensics lab, where Snyder also works.

Two months ago, a parole officer brought to the forensics lab a parolee's computer and cell phone. Snyder downloaded data the parolee probably thought had been erased and found evidence that the man had been participating in a gang called M.O.B. - Money Over Bitches. The gang consists of individual pimps who join M.O.B. members in other cities to trade prostitutes up and down the West Coast.

Snyder can still be surprised by what he discovers. Recently a parole officer handed Snyder a thumb drive and asked him to look for pornography. Instead, Snyder found complete medical records - diagnoses, scheduling, addresses, birth dates, Social Security numbers - for 32 people. The data had been stolen from a California government agency.

A few months ago, Snyder had the pleasure of reciting to a local homeowner the man's home alarm code and when he would be going on vacation. Snyder had found the information on a probationer's computer. Snyder discovered that the probationer had stolen the computer from a computer recycling shop, with its hard drive intact.

Fortunately, Snyder reached the homeowner before he left for vacation when, assumedly, his house was scheduled for a robbery.

One probationer had information on how to build a bomb. Another had a hard drive with step-by-step instructions on how to target the elderly for ID theft.

Watching more closely

What Snyder and Winters often find is not enough evidence to obtain a conviction for a new crime, but more than enough for a community justice officer to send an offender back to jail for violating conditions of parole or probation.

The offenders are catching on. Parole officer Sandra Rorick recently had a parolee she suspected of being a member of Money Over Bitches. The parolee had been convicted of attempted rape, served prison time and been released.

Rorick says she had no idea the parolee might be involved with sex trafficking until she looked at his Facebook page and saw he had posted a photograph of himself with tattoos up and down his arms. One showed a naked woman with the initials M.O.B. Other posted photos showed the parolee drinking. Text messages talked about the parolee using illegal drugs.

Rorick called the parolee in for a meeting and a drug test. While he was talking to Rorick in her cubicle, another parole officer told her the parolee had left a backpack with a laptop computer in the office lobby. Rorick confiscated the laptop and asked for the parolee's cell phone, which had no memory card in it.

Based on the Facebook photos and a positive drug test Rorick, had the parolee arrested and taken to the county jail. While he was being booked, a memory card fell from his wallet. Before officers could retrieve it, Rorick says, the parolee grabbed the card, put it in his mouth and swallowed it.

Rorick can only guess at what evidence the forensics crew would have been able to download from the memory card. The confiscated computer and a thumb drive found in the parolee's backpack yielded 77 telephone numbers, most belonging to women, and photos of young, possibly underage women in their underwear.

In addition, there were pictures of the parolee with stacks of money fanned out in front of him and posing with associates, all of them holding guns.

Rorick gave the women's names to the county's human trafficking task force, which will match them against names of known missing women.

As for the parolee, he served a maximum 60-day sanction for violating the terms of his parole. This week he will hit the street again, with Rorick more watchful. She searched the house where the parolee said he was staying and found no evidence he had actually been there. Now she might require him to wear a GPS ankle bracelet to track his movements.

All those photos, including those with money and guns, are more than enough to change the way Rorick deals with the parolee.

'It tells me he's someone I need to watch more closely,' Rorick says. 'He's either dealing drugs or he's trafficking women.'

Joe Russo, director of the Corrections Technology Center of Excellence in Denver, says that only one other county, Orange County, Calif., has even attempted to establish a computer forensics laboratory similar to Multnomah County's lab. Russo calls Snyder's lab 'unique.' Yet given the cost, Russo says, few county community justice departments are likely to try to duplicate the lab.

'There's a commitment in Multnomah County, and they're putting their money behind it, which is everything,' Russo says.

Forensics lab on 'cutting edge' of tech, legal questions

Much of the computer forensics work by the Multnomah County Department of Community Justice lab staff is about preparing for a future they know is coming, but can't fully imagine.

Even as the lab uses increasingly sophisticated software to root out secrets hidden on electronic devices, software is marketed online to help offenders destroy data before it can be extracted.

The cyberworld future for which computer forensics scientists are preparing is also fraught with new legal questions. According to Jeff Snyder, manager of the county forensics lab, without a search warrant the lab cannot open and read email that has never been opened. Once an email has been opened, it is fair game for Snyder and the forensics lab.

Facebook and similar social networking sites present another challenge. Snyder says he needs court permission to extract past usage from a Facebook account. But to gain access to most Facebook data the lab must be accepted as a friend to the person holding the account. Snyder says he is still waiting for a legal decision as to whether a condition of probation can be that community justice officers automatically be given friend status.

Multnomah County parole officer Sandra Rorick says sex offenders often have a condition as part of their parole that requires them to consent to searches of electronic devices. The key to gaining access to devices for other probationers, Rorick says, is a condition that says an offender must give consent to a search if the parole officer has reasonable grounds.

Given those reasonable grounds, refusing to provide cell phones, thumb drives, video game systems or computers means the parolee is violating terms of parole and can be sanctioned to anything from community service to jail time.

All of those questions are likely to be worked out in the legal system for years to come.

'This is so new, and for us it's kind of like when police started using polygraphs or fingerprint IDs,' says Scott Taylor, director of the Multnomah County Department of Community Justice. 'We're at a cutting edge here.'