Whitewater police probe global child exploitation case with 4,000 victims

WHITEWATER, Wis. (WMTV) - Four detectives from a police department in a city of about 15,000 people are leading what they describe as one of the largest internet crimes against children investigations they have encountered, identifying at least 4,000 victims, and suspects around the globe.

Detectives Justin Brock, Kevin Gowan, Olivia Monson and Anthony Heilberger make up the unit investigating the case.

“I look at my kids when I go home and realize that I’m doing this for a reason,” Brock said. “I have three kids. It’s hard to think that there are people in this world, even in our community, that would want to hurt them.”

The detectives say the cases impact them inside and outside their work.

“I’m a father and a husband. I think that you can do good things in this world in this position and try to set a positive example for my family and my child is something that is very important to me,” Gowan said. “Providing justice to victims of crimes and holding offenders accountable is something that drives me every single day.”

Monson said the work is difficult but necessary.

“Although it’s tough for us to look at, we weren’t the child that was exploited,” Monson said. “And if we can even stop just one more child from getting exploited or taken advantage of, then we did our job well.”

Team relies on each other

Brock said these investigations have grown beyond what one detective can handle alone, now requiring the combined expertise of the full team, including Gowan’s work tracing cryptocurrency and Monson’s forensic work on computers, cell phones and gaming platforms.

“They are some of the most skilled and tenacious professionals. They’re extremely dedicated to what they do,” Gowan said. “But as good as they are as investigators and police officers, they’re even better people.”

The detectives said the investigation, which uses what they described as state-of-the-art technology, would not be possible without each other.

They also say working alongside the team makes the job easier despite its difficulty.

“I enjoy coming to work every day. I enjoy talking with them, joking with them,” Brock said. “Makes the job a little bit easier, especially with how egregious some of these things are.”

Tip led to case

The investigation began after the department received a tip on Dec. 29 through Wisconsin ICAC, the state’s Internet Crimes Against Children task force run by the Department of Justice’s Division of Criminal Investigation.

Heilberger, who supervises the unit’s investigations, said the case stands out from others he has encountered.

“The scale of this case is the largest that I’ve ever seen or been a part of,” Heilberger said. “Looking around at other departments handling cases like these, I haven’t seen one to this scale or this extreme before. As a bureau, I don’t think we’ve even scratched the surface of what we’re capable of doing.”

The National Center for Missing and Exploited Children is a national clearinghouse that receives cyber tips from companies such as Facebook, Instagram and Roblox when their systems flag exploitation material or reports.

Gowan said this particular tip was different from others the department typically receives because it contained no contraband — only cryptocurrency transactions.

“I conducted tracing of the transactions with the addresses I was provided and the attributed vendor wallets that were flagged as potentially associated to CSAM vendors — child sexual exploitation material,” Gowan said.

Gowan said he traced the suspect’s funds using blockchain analytics software to follow the money to its destination.

“I was able to identify through my training and experience in dark web investigations that it was going to known dark web vendors and marketplaces,” Gowan said.

Gowan described the dark web as an unindexed part of the internet accessible only through specific software and browsers, which he said is used for both legitimate purposes and, in some cases, criminal activity.

Investigators used the dark web as an investigative tool to verify what the cryptocurrency transactions showed.

Gowan said the approach reflected the department’s willingness to try new investigative methods.

“We are not afraid to try new things that have not been done before,” Gowan said. “I know if it weren’t for the specialized training that I received from this agency, this wouldn’t be the same outcome, as far as getting into this investigation. It’s kind of really pushing that envelope.”

Search warrant, seized devices

With probable cause established, investigators took the case to a judge.

Monson said the department had to tie the online activity to a specific suspect before it could proceed with a search warrant, a process that included the dark web investigation.

Through the search warrant, investigators seized 30 to 40 electronic devices, including hard drives, cell phones and laptops.

“Up until this point, I thought our largest one was around 15,000 images,” Brock said. “And in retrospect that is a lot. And when I say images, I also mean videos as well. But after we located the devices and interviewing the suspect and him telling us where everything is, it really opened our eyes to — holy cow, this is massive. I think we’re up to 114,000 images. It’s about 8 terabytes of data.”

The suspect, Cody Pierson, is facing 20 counts of possession of child pornography and 20 counts of child sexual exploitation in Walworth County courts.

He had a court date last week and will be back in front of a judge on Oct. 22 for another status conference.

Digital forensics work

With the court case moving forward, investigators were tasked with going through the physical evidence.

Monson said analyzing the seized devices required steps, since many of the files were encrypted, password-protected or stored on damaged devices. She said the department relied on outside experts, including from the Department of Justice and the U.S. Secret Service, to access certain pieces of evidence.

She said every new piece of evidence carries uncertainty about what investigators will find.

“We don’t know what’s on the last drive that’s in storage,” Monson said. “We don’t know if the next thing that we analyze is a known or unknown victim. And that is ultimately, personally what drives me and what drives the team — because our goal is to identify and bring justice for these children that have suffered these awful things.”

So far, this case alone has 4,000 identified victims, according to Monson.

She said a victim can be represented in the file total more than once. The ages range from infants to 17 years old.

“The sheer amount of files and victims alone speaks to how much we really need to take this very seriously,” Monson said.

To identify victims, Heilberger said investigators rely on metadata, which NCMEC uses to track whether a victim has already been identified in a prior case.

He said investigators also work with other agencies to identify children based on who a suspect was communicating with.

Investigation expands

Gowan said criminal actors in the case used tools such as virtual private networks, proxy servers, the dark web and encrypted chat platforms to hide their activity.

Tracing those methods, he said, revealed a much larger network of offenders.

“We were able to identify that there are hundreds and hundreds of people that are doing the same thing,” Gowan said. “And that’s just an extremely small snapshot. It was very eye-opening to us to see just how large this type of operation is — and also disturbing.”

Gowan said the investigation has expanded from tracking suspects across the United States to identifying suspects in other countries.

“I think it’s extremely shocking. To know that person is living beside you or living beside some of our residents here — I think is shocking to our entire community,” Heilberger said.

The detectives said they are hoping to hold everyone involved accountable, whether in Whitewater or worldwide.

“We just want to help people, especially children, to protect them and they have a long life ahead of them,” Brock said. “I want to make sure that they can get that long life and move on and do the things that they want to do and obtain their dreams.”

Training other departments

Monson said other law enforcement agencies have reached out to the department for guidance since the case became known, including questions for Gowan on the cryptocurrency tracing process and for Monson’s team on handling large volumes of digital evidence and decrypting devices.

She said the unit has completed 30 to 40 forensic downloads of devices in the past six months alone.

Heilberger said identifying the people who produce the material remains the unit’s long-term objective.

“And that’s our end goal: to find who’s making these videos or taking these photos and holding them accountable as well,” Heilberger said.

Advice for parents

Heilberger said the department’s central message to parents and children is to be cautious about who they are communicating with online.

He said parents should monitor their children’s online activity, talk with them about what they are doing online, and keep computers and cell phones in shared or public spaces in the home.

Heilberger said parents who notice a child messaging with an unfamiliar person should contact local law enforcement.

The detectives said sites like Roblox and WhatsApp are among the common platforms to watch. They also emphasized their message to victims, saying it is not their fault.

Monson said children and families who find themselves in this type of situation are not alone and can contact the department at any time for support, including help getting exploitative content removed.

Click here to download the WMTV15 News app or our WMTV15 First Alert weather app.