Logging in to file-sharing networks has become a routine part of online child pornography investigations—so routine that multiple agencies sometimes target the same person without knowing it. Case in point: an undercover FBI agent was using the GigaTribe P2P program back in September 2010 in order to observe the material being shared by “pedodad36569."

The case didn't look to be a difficult one. "Pedodad36569" had hundreds of child pornography images in his share folder, and he had a publicly viewable IP address that resolved to a home on Fig Tree Lane in Roscoe, Illinois. But before a search warrant could even be obtained, a separate law enforcement agency gave the same information to the Illinois Internet Crimes Against Children task force, which got a warrant and conducted a search. (Including any variant of "pedo" in your online user name no doubt invites this sort of extra attention from law enforcement, but people just keep doing it.)

But police found nothing—except, we imagine, one terrified homeowner. All computers at the residence were examined, but no child pornography was discovered. Investigators finally realized that the home had an open wireless router and that anyone in the nearby area could have been responsible.

So it was back to GigaTribe in search of another IP address for "pedodad36569." Investigators had trouble finding one, though. Not until December 6, 2011 did a special agent working at a national operations unit get a new IP address for the target. This IP address also resolved to the city of Roscoe, but now it pointed to a home on Summerwood Drive—less than a block away from the first home.

Another search warrant, executed on January 9, 2012, revealed a man named Jason Nicoson who admitting to trading child porn online. As investigators went through his two computers, they learned that he had been exchanging child pornography through e-mail with people around the country. One of them went by the name "pedodave69@yahoo.com" (see what I mean?). The two men had found each other through a Russian website.

Yahoo provided the last known IP address for "pedodave69," which was controlled by AT&T's Internet services unit. AT&T told the FBI that the account in question belonged to one Donald Sachtleben, a 54-year old former FBI agent now living in Carmel, Indiana, a well-off spot just northeast of Indianapolis.

Given their experience with Nicoson, however, investigators were refreshingly cautious about just getting a search warrant and pounding on the door. On April 30, two FBI special agents drove past the Carmel home and noted the existence of two WiFi networks reachable from the property. One used WEP encryption, the other had the more robust WPA2, but the key point from the FBI's perspective was that neither network was unsecured. A search thus seemed much more likely to find its proper target.

The FBI and the Indiana State Police then executed a warrant on the home on May 11, just minutes after Sachtleben returned home from the Indianapolis airport. According to agents, onsite triage of his computers immediately revealed "approximately 30 image and video files containing child pornography," generally featuring kids under the age of 12.

Sachtleben's wife told investigators at the scene that her husband generally used a laptop computer and that she knew nothing about any child porn. The FBI's own analysis of GigaTribe—the Bureau apparently keeps a database of files, usernames, and IP addresses traded through the service—found that Sachtleben's IP address had traded numerous files through the P2P network in addition to his e-mails. Sachtleben was arrested and charged both with possession and distribution. His case, currently proceeding in Indiana's Southern District, could result in a maximum 20 years of prison for distribution and another 10 for possession—along with a $250,000 fine.

Sachtleben had a 25-year career with the FBI, mainly in explosives and forensics (watch video of him blowing up a car here). CNN notes that he investigated both the Unabomber case and the Oklahoma City bombing. Until his arrest, he was Director of Training at the Oklahoma State University Center for Improvised Explosives Research and Training (OSU-IMPEX). His photo and biography have already been removed from OSU's website.