IT was the tiniest of freckles. But it was a hugely significant piece of evidence.
At first glance almost undiscernible, the blemish would prove to be crucial in bringing the man in charge of the world’s largest child pornography website to justice.
The freckle was on a finger on Families SA carer Shannon McCoole’s right hand. It was noticed by Sex Crimes Investigation Branch Detective Brevet Sergeant Stephen Hegarty just a few days before he would snap handcuffs on McCoole while arresting him.
Hegarty was carefully examining shocking images of young children being sexually abused when he noticed it. First on one, then on several others.
It was irrefutable evidence the same sick, perverted individual was responsible for abusing the different children in the images.
While Hegarty did not know the identity of the man holding the children in the images at that point in time, he soon would.
He and his colleagues were just days into what would become the largest investigation into online child pornography yet seen in SA — and possibly the world.
The Sex Crimes Investigation Branch investigation, dubbed Operation Prism, was launched on June 6 last year. That was the day Queensland police contacted SAPOL with intelligence uncovered during a global policing operation into an online child pornography website.
It wasn’t just any site, it was the largest of its type in the world concealed within the so-called Dark Web. Its 45,000 or so members could access it only by using sophisticated Tor encryption software.
The Queensland investigation, dubbed Taskforce Argos, in conjunction with police in various overseas jurisdictions, had discovered that the man running the site was an Australian — and likely living in SA — although his identity was a mystery.
It was worse than the proverbial needle in the haystack. All police had was a four-letter pseudonym. The man they were hunting signed all of his messages and posts with a bland, unambiguous nickname, which gave away no clues as to his identity. While his precise nickname remains suppressed by the District Court, for the purposes of this story it is “Surf’’.
Assistant Commissioner Paul Dickson said when his detectives were contacted by Argos, the initial notification was simply of a potential target.
“At that stage we didn’t even know who he was, what his name was or that he even existed,’’ Dickson said.
“They gave us information relative to a name, Surf, and as a consequence of that we were able to identify that person.
“Initially it was quite difficult for us to get our head around the fact that a person in Adelaide was so heavily involved in this global picture. You don’t expect that.
“You expect people here will be predominantly involved in the usage of that product, viewing it, not managing and administering the software itself.’’
The international investigation into the website, the name of which has also been suppressed, became public in 2011 with an arrest in Germany of a man whose online identity was simply A1. At that time he was its administrator. However, investigations also revealed there was another senior member known as Surf. There was also an indication he may well be Australian because of some of the comments he made on the site.
Investigations continued and in June 2013, a Queensland man was arrested who was a high-ranking member of the site. During that investigation detectives ascertained the Surf was now running the entire site following A1’s arrest.
In early 2014 there was another arrest in the Netherlands. Dutch police were able to access material on the site that indicated Surf had in fact produced it himself. Crucially, there was evidence the photographs were taken using a specific Panasonic camera, identified by metadata embedded in the images. Again, there were more comments that indicated Surf was Australian.
The images taken by Surf that Dutch police found appeared to be of three different children. A girl appeared to be no more than four years old and two boys as young as two years.
The images depicted horrific abuse of the children. Because of the Australian link the images were provided Queensland police, along with information concerning Surf’s other online activities their inquiries had yielded. On June 6, Argos detectives would contact SA police after discovering a Facebook page in SA to which Surf was connected.
Extensive examination of Surf’s online activity by Taskforce Argos detectives found a link to a Facebook page in SA that Surf had visited and left comments on. It was found by painstaking analysis and searches of certain phrases and names used by Surf on his child pornography site.
It was confirmation he was in South Australia.
After just two days, Hegarty knew police were getting closer to identifying Surf by name. Further searches found that Surf had also been using an online four-wheel drive forum. In what would become a significant breakthrough, in several posts Surf was signing off as “Shannon’’.
Ironically, an error he made on that site would unmask his identity to police. After years of striving to keep his name and identity a secret, Surf had posted a photo of his four-wheel-drive, a VW Amarok, on the 4WD site — complete with its registration plate.
“That was the golden nugget, so to speak,’’ Hegarty said.
Armed with his name, intense background investigations then started. Alarmingly, police discovered he had worked in the US with children at Camp America, at an Adelaide primary school, with Nanny SA and that he was still working at Families SA as a carer for young children.
Police investigations also discovered McCoole had come to the attention of Families SA in June 2013. He made an inappropriate remark to co-workers about a young girl’s bottom. He was suspended for three months and eventually returned to work when an internal investigation — conducted by his colleagues — failed to find any evidence to take action against him.
At the time police were advised of these results and based on that information, decided not to launch their own investigation into McCoole.
During the initial Operation Prism investigations. detectives studied the disturbing images produced by McCoole carefully. They noticed he bit his fingernails and that he had a distinctive freckle on a finger on his right hand. While he was careful not to show the faces of any of the children in his sick pictures, the freckle was gold-plated evidence for the eagle-eyed detective who spotted it.
“That freckle was a key moment,’’ Hegarty said.
Dickson said the initial investigation phase was intensive. The inquiry was given priority because of the nature of the offending. Within a week of being given the initial information, which was at best sketchy, SA detectives with the assistance of Argos had positively identified Surf as Shannon McCoole. They moved swiftly to apprehend him because he was still working with children.
That day was June 10 — just five days after investigations had started to identify Surf. While it would have no doubt have been a simple matter to kick down McCoole’s front door, detectives hoped to catch him online, thereby giving them access to his website.
They were mindful that McCoole simply had to close his laptop to log off, denying them access to the site once the Tor encryption software kicked in. It was essential he was caught off-guard.
It was decided that Hegarty and another detective would simply knock on the front door, armed with just a general search warrant. It was 7.30pm on June 10 — it was dark and after knocking, the detectives stepped into the shadows to lessen the chances of being spotted before McCoole opened the door.
While it took no more than 20 seconds for him to open the door of his Oaklands Park home, the wait was agonising. Mindful that he may dash to his laptop after seeing him, moments after McCoole opened the door he was quickly detained by Hegarty and “placed’’ on a chair just inside the front door. He appeared stunned. He was not expecting this. Perhaps he even knew it was all over.
Within seconds his modest house was swarming with a dozen detectives from SCIB, E Crime and two members of Queensland’s Taskforce Argos. There was nothing remarkable about McCoole’s house. It was a typical bachelor’s pad. Dishes in the sink and messy.
Hegarty recalls entering the loungeroom of the house and seeing McCoole’s open Toshiba laptop sitting on a squat coffee table. It was connected to an external hard drive. He was relieved. While there was encryption software running, an examination by E crime detectives revealed the hard drive contained a backup of the entire site. And while he was not online, there were open links to it that enabled detectives to log on easily.
“And sitting on the mantelpiece was a Panasonic camera used to take the images found by the Dutch police,’’ Hegarty said.
“We very quickly checked his finger and yes, there was the freckle. He was then placed under arrest in relation to seven counts of unlawful sexual intercourse.’’
Dickson said the timing of the raid was critical. It was based largely on the intelligence police had gathered on McCoole and when he was usually active on the site.
“It is very difficult from our perspective if someone is able to lock it all down,’’ he said.
“It does not matter who you are, you just will not get in. If we had not been able to get in we would not have obtained the result we have been able to achieve here, certainly not to this magnitude. The timing was crucial to the overall success of the operation.’’
At that stage detectives had charged him using the evidence of seven offences having been committed that were in the images supplied by Taskforce Argos. They still had no idea of the identities of the children in them or even how many were involved.
The subsequent examination of the hard drive seized at McCoole’s house found a file — his private file — that contained 593 images and 57 video files documenting his own offending. Shockingly, some of the victims appeared to be under two years of age.
It took Hegarty 12 days to identify the seven victims in the photographs. It was a slow, painstaking process that involved calling in all records from Families SA and Nanny SA concerning McCoole’s employment and child placements in which he was the carer. Photographs of the children were compared with the images and bodily features used to match them. Blemishes on their skin, skin tone, scarring, bodily development and clothing were all crucial. Metadata embedded within the images was also crucial in this process for verifying times and dates.
“I was satisfied there were seven victims,’’ Hegarty said.
“We examined everything, cross-referenced times and dates the children were under his care.’’
On July 22 Hegarty visited the parents of the seven identified children and broke the terribly sad news to them. They were stunned. Many were angry.
Dickson said in the early stages of the inquiry there were real concerns the number of local victims would be large.
“We didn’t really know how many children he had access to. That took us some time to actually identify,’’ he said.
“Are there more victims out there, there could be. We could never say 100 per cent no.’’
While Hegarty already had compelling evidence of McCoole’s guilt, another critical and significant piece of evidence also came directly from the images of the children. Such was the quality of the Panasonic camera McCoole used, his fingerprints could clearly been seen in several of them. Thinking outside the square, Hegarty loaded these on to a disk and took it to the fingerprints section and asked them to take a look. It was also a long shot.
“I asked them to have a look at this and they said, ‘we have never done this before’,’’ Hegarty said.
“About 45 minutes later I had a phone call with them saying the computer has said yes, it has given us a positive hit.
“I could actually say that was McCoole’s hand in that picture abusing that child.’’
Hegarty would get a positive fingerprint match from five images out of the 593 found on McCoole’s file within his computer.
Just like the fingerprints, detectives would obtain even more evidence unwittingly provided by McCoole himself. This time it would be his handwriting. Those producing child pornography would post “proof pictures’’ on the site. The image would commonly contain something contemporary that viewers could identify, or a handwritten message from the abuser. That would be McCoole’s undoing.
“I think I identified 14 where he had written something on a Post-it or piece of paper and he would actually place these notes on the child just prior to or during the abuse taking place. From examples of handwriting taken from his house we managed to compare it to that in the images,” he said.
Hegarty firmly believes it was the fingerprint evidence that was the tipping point for McCoole to finally co-operate with police. After he advised McCoole’s lawyer of the quality of this evidence — and the fact he had found a partial facial image of McCoole in one of the abuse videos — McCoole consented to an interview.
Hegarty didn’t expressly want his confession. He already had more than enough evidence to convict him.
He wanted McCoole to identify who the children were in the images so they could be helped.
“I was confident we were going to get the right result at that stage. The priority was identifying the children,’’ he said.
The first interview took place in early August at Mt Gambier prison.
“I went into the interview with the names, we wanted him to confirm them and tell us others,’’ he said.
“I think he agreed to four and said he couldn’t remember the others. He clarified one and gave us the name of the child.’’
During the three-hour interview McCoole also spoke at length about the website, although he minimised his involvement and only spoke about what he thought the detectives already knew.
“He gave excuses for some offending, which I find very bizarre,’’ Dickson said.
And almost as unbelievably, McCoole told Hegarty he was proud of the website it and proud of his achievements with it. Hegarty said following the interview he was “drained’’. He would interview him on another two occasions at length.
“After the first interview we sat in the carpark for a while, unable to speak. I think we were just a bit blown away by the magnitude of what had been said,’’ he said.
On reflection, Hegarty describes McCoole as highly intelligent and very manipulative. He was also very careful, abusing the children only when he was alone with them to lessen to risk of being caught.
“He is no fool. He would not duly expose himself to the risk of being captured,’’ Hegarty said.
“I think that is one reason why his victim range was so young. As soon as he thought a child would be capable of reporting anything he would shy away from them. He would be very selective of who he targeted as victims.’’
Hegarty firmly believes that if McCoole had not been caught he would have continued offending. He feels McCoole’s ‘epiphany’ about his offending ceasing in early 2013 is a lie and that a simple lack of opportunity was responsible. He was suspended by Families SA between July and September 2013 and from that point until his arrest never worked with very young children again.
“He simply didn’t have the opportunity,’’ Hegarty said.
“He was waiting for his next opportunity, that is my honest belief. It might have taken another six months, it might have taken another two years but given the opportunity he would have offended again.’’
During their examination of Shannon McCoole’s internet use, detectives found one exchange on an undisclosed forum that both angered and astonished them. It also gave a clear insight into his state of mind.
A question was posed that asked: what is the maximum number of people you can offend with a five-word sentence?
McCoole replied: “Raping children should be acceptable.’’