Cases and Documents

W. Bleyle Case

Why this case is listed:

• Demonstrates how P2P file-sharing networks enable detection of perpetrators who evade traditional reporting mechanisms
• Illustrates the role of digital evidence in cases where victims cannot report abuse
• Shows how technology can bridge gaps in institutional oversight and victim reporting

Case Summary: W. Bleyle worked in a long-term convalescent facility at the Children's Hospital and Health Center of San Diego for 25 years. He targeted children who were the most brain-damaged, comatose, and nonverbal—children who could never report the abuse. During an interview with law enforcement, Bleyle compared the number of victims he r---d to the number of snowflakes in a snowfall. Bleyle was apprehended not through reports by hospital staff or victims, or through a CyberTip, but through an investigation of his use of a P2P file-sharing program.

Technology Involved: P2P file-sharing networks

Enforcement Method: Digital forensics investigation of file-sharing activity

R. Belden Case

Why this case is listed:

• Demonstrates the scale of CSAM collections and the challenge of managing massive digital evidence
• Shows how sentencing reflects the severity and nature of offenses
• Illustrates the role of P2P networks in both distribution and detection

Case Summary: R. Belden pleaded guilty to knowingly receiving and possessing CSAM and was sentenced to 35 years in prison. He was in possession of 57 terabytes of CSAM across 15 hard drives. His collection contained depictions of toddlers and sadistic abuse. His sentence was higher than the typical 20-year term due to the nature and circumstances of his offense. He was caught through an investigation of his use of a P2P file-sharing program.

Technology Involved: P2P file-sharing networks, large-scale digital storage

Enforcement Method: P2P network monitoring and digital forensics

Tor/TorChat Case

Why this case is listed:

• Demonstrates how anonymity technologies are used for exploitation and distribution
• Shows the role of platform reporting (Yahoo to NCMEC) in investigations
• Illustrates long-term abuse documentation and the importance of digital evidence
• Highlights international aspects and streaming-based exploitation

Case Summary: An individual used TorChat, a Tor-based messaging client, to send CSAM. The recipient stored the content on Yahoo servers, and Yahoo reported the incident to NCMEC. Homeland Security agents executed a search warrant and found numerous videos documenting abuse over many years, along with hundreds of additional CSAM images and videos. Tor onion services were also used by an Australian person convicted for streaming abuse to paying clients.

Technology Involved: Tor onion services, TorChat messaging, cloud storage (Yahoo), live streaming

Enforcement Method: Platform reporting to NCMEC, search warrants, international cooperation

Group 1 ("Base Group") Case

Why this case is listed:

• Demonstrates organized criminal networks and coordinated exploitation
• Shows sophisticated grooming techniques using deception and manipulation
• Illustrates the use of unmoderated platforms to evade detection
• Highlights the scale of victimization (1,600+ minors) and identification challenges
• Demonstrates cross-platform targeting (YouTube, TikTok, Musical.ly, etc.)
• Shows the use of malware, remote access, and psychological manipulation

Case Summary: This conspiracy involved at least 14 persons convicted of sexually exploiting over 1,600 minors from 2012 to 2014, some as young as 8 years old. Fewer than 400 of the minors have been identified. The group used unmoderated platforms (Chateen.com and "Website B") to evade detection. Members posed as minors, used pre-recorded videos ("loops") to trick victims, and coordinated in chat rooms to normalize sexual behavior. They targeted children on YouTube, Musical.ly (TikTok), YouNow, and MyLOL, then lured them to unmoderated chat rooms. One member, Berenson, used malware to gain remote access to victims' computers and engaged in extensive psychological manipulation and threats.

Technology Involved: Unmoderated chat platforms, social media (YouTube, TikTok, Musical.ly), malware, remote access tools, cloud storage (Mega.nz), webcams, video loops

Enforcement Method: Multi-agency investigation, victim reporting, search warrants, digital forensics