'Digital fingerprints' led to Calif. priest's arrest for child pornography possession

(OSV News) -- "Digital fingerprints" and a national database led to the recent arrest of a California priest for possession of images of child sexual abuse, an investigator told OSV News.

Father Martinez-Guevara, a 38-year-old member of the Missionaries of the Holy Spirit, was taken into custody Sept. 13 in Long Beach, California, by members of the Ventura County Child Exploitation and Human Trafficking Task Force, who found more than 600 images and videos of child pornography in the priest's possession. Father Martinez-Guevara, who has been removed from ministry with his priestly faculties suspended, remains in Ventura County's main jail.

The investigation into the priest, launched in April, began with a string of alphanumeric characters called a hash algorithm, a task force leader on the case told OSV News.

"Hash values, in the simplest terms, are the fingerprints of a (digital) file," Terrance Dobrosky, supervising district attorney investigator with the Ventura County High Tech Task Force and with the FBI's Child Exploitation and Human Trafficking Task Force, told OSV News. "Each hash value of a file is extremely unique. ... I've heard it referred to as the DNA of a file. It is so unique that the likelihood of two files having the same hash value is two to the power of 128."

Dobrosky -- who could not comment on the specifics of Father Martinez-Guevara's case, as it is an active investigation -- said that hash values in the image files on the priest's device matched those in a database maintained by the National Center for Missing and Exploited Children, or NCMEC, based in Alexandria, Virginia.

"When a police officer comes across a file of child pornography and it is part of his investigation, they take that file and they submit it to the National Center for Missing and Exploited Children, which holds this vast library of hash values," said Dobrosky, a 10-year veteran of child exploitation investigations who was named the 2022 Los Angeles Internet Crimes Against Children Investigator of the Year.

In 2022 alone, NCMEC added 1.1 million hash values to the more than 6.3 million included in the database, with each value representing an image or video of child sexual abuse material.

That database, which is "getting larger and larger," is then "shared with internet service providers and (social media platforms) such as Facebook, Instagram and Kik," said Dobrosky, who noted such entities are "not sharing the actual image of child pornography," but only the hash value.

"So what ends up happening is that when Facebook has an image uploaded to its system, it automatically compares that hash value with that database that NCMEC has provided them," he explained. "And if there's a match, it will not allow that image to be posted online, and then they turn around and they create a cyber tip report (to NCMEC), and that is what gets forwarded to law enforcement to do an investigation."

In Father Martinez-Guevara's case, "an internet service provider got a hit on hash values of known child pornography, and they made a report to the National Center for Missing and Exploited Children," said Dobrosky. "Based on the information the internet service provider shared with NCMEC, it led them to believe that the individual may have been in Ventura County and that's how the investigation began."

Dobrosky noted that the even more refined technique of "block hashing," which the U.S. is "slowly adopting," creates "fingerprints of tiny chunks" of files, enabling investigators to identify child abuse material in files that may have been slightly altered to create new hash values.

Dobrosky admitted that child abuse material exchanged through the dark web -- sites that are not visible through Google and other search engines, and are only accessible through special browsers such as TOR -- can be more difficult to track.

"Dark web investigations do make things vastly more difficult," he said. "Your common internet service providers are not monitoring people's web traffic if they connect to the dark web, mostly because the dark web goes through what's called a virtual private network, or through the TOR site, and because of it, everything is encrypted."

At the same time, "the vast majority" of those distributing child sexual abuse material "do use the open web," making them much more traceable, especially as "more service providers are looking for it now and reporting it," said Dobrosky.

While hash values are the most common means of flagging child pornography images, "when it comes to identifying children, we use pretty much any tactic we can," he said.

"Sometimes there's information in the file itself called metadata, where not only will it give us the date and time that the image or the video was created, but if we're very, very, very lucky, it will give us location data as well and we're able to locate the child that way," said Dobrosky.

In other situations, he said, investigators "are looking at an image or a video and we recognize the background and we say, 'OK, I believe based on the background that I have a general idea of where this victim is,' and then we work with the local law enforcement in that jurisdiction to be able to narrow it down even further."

Dobrosky said "in very, very rare cases," he has actually participated in the rescue of an exploited child who has been tracked down through an investigation.

In one out-of-state investigation, "we found out the mother was actually producing the child pornography of her own child," he said, adding that he was at least able to "put eyes on that child and say, 'OK, we know for a fact that child has been rescued and that child is now safe.'"

Such moments are "some of the high points" of a demanding and often draining career, said Dobrosky, whose team relies on several therapy dogs to offset work stress.

"For those of us who have been really involved in child exploitation investigations, it is the worst job that you could possibly love," he said. "And we say that because the material is horrific. It is very taxing and it can affect us personally. But we love (this work), because we know at some point, we are possibly preventing the victimization of a child." - - - Gina Christian is a national reporter for OSV News. Follow her on X at @GinaJesseReina.- - - NOTES: For more information on the National Center for MIssing and Exploited Children, visit https://www.missingkids.org/home. To make a report to the center's CyberTipline, visit https://report.cybertip.org or call 1-800-THE-LOST.