A follow-up to the arrest of Eric M. Lipman General Counsel of the Florida Elections Commission
The affiant to arrest …..
On 24 FEB 2021, your affiant, a member of the Internet Crimes Against Children (ICAC) Task Force, received two (2) Cyber Tipline Reports (#86237356 and 86945617) from the National Center for Missing & Exploited Children (NCMEC).
I reviewed the cyber tipline reports and learned the electronic service provider (ESP) known as Yahoo! (Oath Holdings, Inc.) detected a Yahoo! email account (eml110561@yahoo.com) through which several digital files containing child pornography had been transmitted. Yahoo then reported the incident to NCMEC as required by law, and NCMEC in turn forwarded the cyber tipline reports to the Leon County Sheriff’s Office. I was assigned this case for follow up investigation.
NCMEC also provided 19 files that were sent by the suspect email account, and preserved and archived by Yahoo personnel, as part of cyber tip report # 86237356. I viewed each file and confirmed they each do in fact contain child sexual abuse material (CSAM).
Two examples of the downloaded files as follows:
SAMPLE FILE 1
FILENAME: VID-20210112-WA0273.mp4
MD5 HASH: 3F59DACB63C1BD25A651B417936F54DB DATE SENT: 2/11/2021 22:43:06 -0500
DESCRIPTION This is a 2 minute 41 second video depicting an adult male who vaginally and anally penetrates a prepubescent toddler-aged female. The female child appears to be between 3 and 8 years of age and appears to be sedated or incoherent during the incident.
SAMPLE FILE 2
FILE NAME: VID-20210112-WA0085.mp4
MD5 HASH: A7578B33A4B86FC20B65C6100CA7CA9F DATE SENT: 2/11/2021 21:08:53 -0500
DESCRIPTION This is a 2 minute 57 second video depicting a prepubescent female being anally penetrated by an adult male. The child appears to be between 5 and 8 years of age.
A search warrant for email account eml110561@yahoo.com was obtained and served to Oath Holdings Inc. (parent company of Yahoo) on 03/05/2021. Oath Holdings Inc. provided a digital package containing the contents of the email account in response to the legal demands of the search warrant.
Yahoo records reflect that the account em11l0561@yahoo.com logged in on 11 FEB 2021 at 19:40:38 EST from IP adifress 2601:4c1:4003:8040:8063:ddf7:441a:827f. Yahoo records further reflect that on 11 FEB 2021 between 19:42:54 and 22:43:06 0500 (EST), the email account em1110561@yahoo.com sent the suspect files via email messages as attachments. During this time, twenty-four (24) digital video files were transmitted as attachments in twenty-four (24) separate email messages, one file attachment per email message. The file transfers in question began to occur approximately two (2) minutes after the login and continued for approximately three (3) hours. The suspect messages, along with the CSAM attachments, were sent from email address em1110561@yahoo.com to email address em1110561@yahoo.com (i.e. from the suspect to the suspect).
The email address em1110561@yahoo.com was researched through public records resources and investigative databases, and was found to be commonly used by Eric M. Lipman of Tallahassee, FL. The email address itself contains LIPMAN’s initials “EML” along with the digits “110561.” 110561 corresponds with Lipman’s date of birth of 11/05/1961. Yahoo! Inc. further identified the email owner as Eric Lipman of 4385 Benchmark Trace in Tallahassee, FL.
The logged IP address used to transmit the CSAM files was 2601:4c1:4003:8040:8063:ddf7:441a:827f. I ran that IP through an open database and learned it was owned/under the control of Comcast. A subpoena seeking subscriber information was served to COMCAST, and a legal response was received indicating the suspect IP address was assigned to Eleonor Lipman at 4385 Benchmark Trace in Tallahassee, FL. Eleonor is Eric Lipman’s wife, and according to DAVID records they reside together at the Benchmark Trace address. Utilities records reflect Eric M. Lipman as the named utilities account holder for 4385 Benchmark Trace, and has been since 07 DEC 2006.
Based on the above information a search warrant was sought for the residence at 4385 Benchmark Trace. The search warrant was approved by the Honorable Judge Nina Richardson on 04/06/2021, and served on 04/07/2021.
Eric Lipman was home at the time the search warrant was served, and was interviewed on scene by myself and FDLE SA Erika Morris. The search warrant was read aloud to Lipman, and he was read his Miranda Rights from an agency issued Miranda Form. Lipman indicated he understood his Miranda Rights and agreed to speak with me about the case. I informed Lipman of this investigation and questioned him about the suspicious files sent via his email address and through his home IP address. Lipman confirmed the suspect email account belonged to him at the time of the incident, but refused to answer any further questions related to the email, or anything else related to the search warrant related material.
Numerous items of evidence were seized from Lipman’s home pursuant to the search warrant; including his personal laptop computer, his work-issued laptop computer, and his personal Apple iPhone. These items were all password protected, and accessible only by Lipman. Lipman agreed to provide the passwords for the devices.
Detective Rob Waller performed digital forensic previews on these items on scene, and forensically confirmed the previously identified CSAM files had been downloaded, stored and viewed on Lipman’s personal laptop before being deleted. Detective Waller was further able to access search terms Lipman used for searching the internet. A large number of these terms, observed on Lipman’s work laptop, were related to child pornography. Some examples of these terms were “PTHC” (meaning pre-teen hard core), 3yo, 4yo, 5yo, ch]1dren$, kdd, kdz, pdo (slang for pedophile), pjk (peer-to-peer networking geared towards pedophiles), and young. Based on the forensic information obtained from the laptop computers seized from Lipman, and the information provided by Yahoo! Inc., Lipman was placed under arrest for possession of CSAM material (11 counts). He was placed in double locked handcuffs and transported to the Leon County Detention Facility by FTO II Robert Bethea
No comments:
Post a Comment