Being a well known expert in HBPR&A (Human Behavior Pattern Recognition and Analysis), I am often asked to give my expert opinion (or testimony) on people, events, locations, crimes, attacks, scientific theories, and a number of other highly complicated cases.

The questions I receive typically come from the law enforcement community, the military, cognitive and behavioral scientists, and my friends and family. Although the requests for my opinion usually arrive via email or during the course of conversation, I also receive phone calls from an in-progress situation or investigation.

The topic I am discussing in this article was inspired by a pair of email questions submitted by human behavior profilers:

“I am in Computer Forensics specializing in Child Exploitation and Human Trafficking. I understand the “grooming” that takes place between the suspect and child as well as the suspect and adults surrounding the child. The problem I am running into is the majority of the pedophiles that possess, distribute, and produce child pornography use the Internet to exploit children. How would you identify pre-event indicators of an offender based on the way predators select and victimize their targets?” “I assume that the children or victims also very rarely report it to parents or other authorities or perhaps don’t even say anything until well into their adult life. How can you change this cycle?”

Background Information

In order to answer these questions I will relate a story that has a personal connection.

In March of 2016, Daniel Cress (pictured above), a professor at Western Colorado University here in Gunnison, was arrested and charged with a number of felonies by the Colorado First Judicial District Attorney’s Office.

In February of the same year, Cress allegedly brought the attention of the DA’s Child Sex Offender Internet unit on himself by engaging an undercover investigator in numerous, repeated communications (text, chat, telephone, web cam) believing that the investigator was a 15-year-old girl. According to the arrest affidavit, the communication from Cress became increasingly sexually graphic and explicit.

I knew Dan Cress by association, my daughter was attending Western University and my wife Shelly and I were teaching there as Adjunct Professors of Sociology and Police Sciences.

BLUF (Bottom Line up Front).

All terrorists and criminals make mistakes. Their exploits create evidence. Exploiting the human behavior-based “signature evidence” or “digital fingerprint evidence” left behind by a criminal and simultaneously conducting proactive operations against lawbreakers will assist you in catching the offender(s).

The third tier of your approach needs to be training children and educating the general public in order to limit the seams and gaps where these offenders operate. The Internet is merely the latest Baseline within which to perpetrate a crime or conduct an investigation.

The Internet creates an environment where offenders have anonymity, easy access to victims, and they can use the Internet to cross local, state, federal and international borders.

Basic TTP’s (tactics, techniques, and procedures) of offenders.

Any terrorist or criminal using the Internet for illegal means will begin to set a pattern. Downloading and trading child pornography through various file sharing networks allows an investigator to trace the trade back to the home address of both offenders. So called “TOR” networks on the Dark Web hide a user’s online activities from third parties and prevent websites from seeing the user’s location by constantly rerouting the users sent and received data.

Pedophiles generally choose victims who fit a specific victim profile (their age, before, during or after puberty, a level of sexual inexperience and so on).

Understanding victimology can help further define and identify a likely suspect. Pedophiles often target withdrawn or shy humans. Even when the victims learn that such a relationship is inappropriate, it isn’t easy to end the relationship. There is a stigma with sex crimes. Children may fear the “outing” associated with reporting their situation or perhaps they have developed positive emotions towards the predator.

Generally, the more emotionally needy the child the more vulnerable they are.

Creating the profile of a pedophile.

Beware of any attempt to profile an offender based solely on statistical analyses. Using focused, specific data such as, “Pedophiles are commonly men near or slightly older than 30, single, but if they are married their significant other may be just a companion rather than a standard loving relationship…” limits the investigator whenever the artifacts and evidence they are encountering doesn’t fit the statistical profile espoused by these mathematically factual yet limiting architectures.

Pattern analysis-based investigations.

Virtually anything can be ‘Pattern Analyzed’. Let’s begin with the assumption that pedophiles or traffickers on the internet are no different. I coined the term HBPR&A to exactly describe the investigative process in which my students and instructors found themselves.

Whether martial artists, first responders, tip of the spear military operators or private citizens, they could use my theory of Human Behavior Pattern Recognition and Analysis to proactively and preventatively counter human behavior-based threats. It’s a non-technical and non-materiel approach.

Human problems require human solutions.

Simply put, you look for the pattern, recognize what the pattern represents and then analyze to create a “Left-of-the-next-bang” strategy for training, education, prevention, avoidance, mitigation or proactive enforcement.

The Internet is just another Baseline, another environment that can be measured and assessed. While the Internet likely represents the absolute limit of observable behavior, don’t get hung up on having to “see” human behavior patterns to locate or compare them.

Don’t “reinvent the wheel.”

Modern investigations use companion skill sets.

Bite marks fall into the realm of forensic dentistry while identifying a corpse through teeth falls into the realm of forensic odontology. A forensic document examiner can draw a reasonable conclusion on the authenticity of a signature on a suspected manuscript while a horticulture SME (Subject Matter Expert) can reach a legal conclusion on the plant seeds or fiber stuck in a tire tread and link that specific vehicle to a specific homicide or crime scene location.

Experts use Artifacts and Evidence to draw reasonable conclusions.

An ancillary benefit of these types of investigations is that investigators can draw reasonable conclusions from pattern-based evidence without ever visiting the scene. This can be accomplished by conducting an informal interview of a suspect or witness over the phone, reviewing a store video tape of the crime in progress, matching loops and whorls from a latent print to a known data base and so on.

Whether examining chat rooms, social media, or webcams, a savvy investigator can use human behavior and repeated patterns to “connect the dots” and establish likely future behavior profiles.

While police impersonation of child victims online is the most effective way to catch pedophiles in the act, routine investigative procedures can be hugely effective in identifying likely suspects.

Applying the “Sophistication, Organization, and Access” test.

I developed the SOA (Sophistication, Organization and Access) “test” to assist my students and Instructors in the determination of pattern assignments (which patterns fit which subjects?) This test can be used Left-of-bang, At-bang and then what they will likely do next, Left-of-the-next bang.

Here is an example from the battlefield. After an exhaustive study, the enemy Sniper Teams of Baghdad were neutralized when the SOA test demonstrated the following patterns: A low level of sophistication necessary to fool the US and Coalition partners, and a high level of organization using a ruse that gave them close access to their quarry.

Applying a Geographic Profile to this information identified likely future kill zones while a Heuristic Profile, compared against the Atmospherics of past attacks, gave us the likely “hide” that the sniper teams were using to conceal themselves.

It was then merely a function of sharing that “profile” with the U.S. Marine Corps and U.S. Army snipers who located and neutralized or captured the remaining enemy snipers.

Access.

Suspects need Access to the victims they wish to exploit. They will create or follow the “best practice” Pedophile strategies so they can get close to them. They’ll befriend them, build their self-esteem, then break down their defenses.

Pedophiles are commonly drawn to activities that appeal to children rather than adults. Perhaps using sports, activities or hobbies by playing popular video games, building models, or collecting popular toys, hoping that this will appeal to a child’s interests.

Predators seek out Baselines where they can hide in plain sight while having daily contact with children. Pedophiles seek out work as authority figures where unconditional trust is bestowed upon them by the primary care-giver of the child or children they intend to victimize.

In the case of a pedophile “grooming” on line, begin by asking;

What sites does the offender frequent? (or LIKELY frequent if you don’t have a starting point).

What is the chosen M.O. of that suspect? (which repetitive words or phrases are common, which likes or dislikes are evident? Is there a specific time that the offender ‘fishes’ for their quarry?)

Do they purport to be a teen? A teen girl? A victim of sexual assault? (This signature or fingerprint will be repeated if it works the first time. Offenders have almost exactly the same brain chemistry as you and I. Therefore, their pleasure centers light up whenever they have a positive result from their inquiry).

Consider “following the money.” Offenders likely have to pay for access to the internet. Look into how they are paying for their access. Once they have established a pattern it is easier to use that pattern against them. Money can include bestowing gifts upon children or potential victims in what (when looked at objectively) would be inappropriate.

Consider their physical location. Are the offenders working from home? If so, the times and dates of use can be matched against sick leave or work records (or illustrate periods of no work or vacation time). Are they operating from a hotel or coffee shop? Perhaps, yet this form of Internet access has less security than a personal ‘hot spot’. Perhaps as the offender gets closer to contacting the proposed victim they will ‘let their guard down’ and their Internet connection will be less protected.

Are there clues to the offender’s associations in his or her methodology? Many times, to gain access an offender will be involved in day care, act as a coach, mentor, authority figure or work as a substitute teacher (any number of ploys) that will allow them legal access to children of the age which excites or intrigues them.

Again, studying the likely victimology of your suspect will help you exploit the clues you discover.

Obviously, law enforcement can leave “track traps” on well-used sites and ultimately portray themselves as potential willing participants or clueless victims. They can use the victimology research to focus in on a specific bandwidth of offender. Embedded codes of information on graphic images and child pornography can be traced or tracked.

Sophistication

My students, instructors, and I, use a very specific definition of sophistication. An easy way to remember it is that low levels of sophistication make it harder to catch a suspect. Higher levels of sophistication mean that your suspect or cabal will be easier to locate and catch.

What name is your suspect using? Is that name a pseudonym? A nom de plume? A title? Does the offender repeat all or part of that name? Is there some theme within their use of names, nicknames or titles? Is that name simple or complicated? Basic or convoluted? Funny or ironic? Is the name partially true or does the offender think that they are clever using a nickname that only he or she will understand (until compared with a group of likely offenders and then compared with idiosyncrasies within that group to delete the unlikely contributor)?

The harder they work at it, the more likely you will find a pattern. Hacking isn’t that hard because humans make simple mistakes with their password conventions. It is therefore likely to assume that some offenders will make the same mistakes.

Organization

Remember that High levels of organization help me determine one offender or group of offenders from another. Does the offender exhibit high levels of organization? What do they do first? How long is a normal session? At what time of day do these sessions begin or end? Does that timeline vary?

Again, applying my standard of Baseline + Anomaly = Decision can be used to determine whether the suspect is making mistakes or setting patterns that you can exploit. Time information can help you build a profile of likely times that they will re-offend, when they sleep or work or perhaps what time zones they are working from.

A pattern is a pattern and the more highly organized the pattern, the more distinctive the signature. Bomb makers and emplacers repeat behaviors because they work. Pedophiles will do the same on social media sites and the internet.

Limits and boundaries further define an offender.

I developed a manner with which to determine the stage of performance development of an offender.

Offenders typically follow the, “First I learn my limits, then I test my limits, then I push my limits” standard.

Repeat behaviors are based on our brain’s chemistry. We repeat them because they affect our pleasure centers and we want to autonomically and unconsciously continue to repeat these behaviors, even if they result in self-harm (opioid abuse, for example).

Look at the manner in which the offender approaches the chat room. What do they do first? How exactly do they strike up a conversation? How do they test the waters? Is there a specific fetish sequence that activates followed by selfies of the offender’s genitalia or suggestive images from pornography sites?

Revisiting documentary evidence

Exploit the documentary evidence you already have. Within the information (recordings, print outs, cold cases, written complaints, interviews) you are likely to find evidence to create a human behavior profile or discover additional “transfer evidence” that you can use to create a more robust human behavior profile.

Offenders routinely keep mementos from their successful ventures and conquests. Even on their cell phones. Certainly, on thumb drives or external storage sources. Further, no matter how hard you work, the photos and sites you visited remain on these devices and can be used retroactively as artifacts and evidence to prosecute criminals and to look for other offenses they may have been involved with.

Use Training and Education to counter apathy and garner public involvement.

Regarding incident reporting and community involvement, there is a stigma associated with any sex crime and certainly with any crime involving the exploitation of children. You can break that stigma with training, education and transparency.

Openly and honestly discussing the SOP’s (standard operating procedures) of Pedophiles and Sex Traffickers can help people stop the proliferation of predation while starting a dialogue to engage our at-risk youth to be equally transparent.

HBPR&A training and education will help you identify both the suspects and the likely victims “Left-of-Bang.” Proactivity can lead to prevention and mitigation.

Reporting

To report child pornography or to report information on a potential case involving child trafficking or the sexual exploitation of children, please contact the National Center for Missing and Exploited Children on their Cyber Tip Line at www.cybertipline.com.

Study hard and TEACH HARDER!

- Greg