Warrant: Sunspot observatory closure linked to child porn
The sudden and mysterious closure of the National Solar Observatory in Sunpost, New Mexico that sparked numerous conspiracy theories earlier this month appears to be linked to a child pornography investigation.
A search warrant filed in U.S. District Court in Las Cruces reveals the FBI began investigating after someone used the wireless signal at the Sunspot Solar Observatory, located in the Lincoln National Forest, to access, download and distribute child pornography multiple times since January 2018.
The warrant states the observatory’s chief observer told agents he found a laptop with child porn in an empty office. The FBI says an observatory janitor owns the laptop.
The warrant says the National Solar Observatory and the National Science Foundation shut down the facility after the janitor made veiled threats following federal agents’ seizure of the computer. No arrests have been made and the janitor has not been charged.
EDITOR’S NOTE: The Associated Press contributed to this article
The warrant obtained by ABC-7’s New Mexico Mobile Newsroom states that on July 27, 2018, an undercover law enforcement officer examined records contained in the Child Protective System (CPS) Database. The officer focused on internet protocol (IP) addresses and Globally Unique Identifiers (GUIDs) believed to linked to peer-to-peer file sharing networks in New Mexico and offered “to participate in the distribution of files containing child sexual exploitation,” the warrant states.
The officer noticed an IP address was associated with five GUIDs “which all contained files indicative of child pornography.” The warrant further states, “the CPS servers reported that this IP address was located at the National Solar Observatory in Sunspot, New Mexico.”
When the director of the observatory was alerted by investigators, “he ordered that the local public network at the site be disabled as a precautionary measure.” After a meeting involving investigators and the observatory director on August 2, 2018, “it was decided that the public network site would be recreated or re-opened, in an attempt to allow the subject to gain access to the internet for the purpose of monitoring activity and definitely identifying the subject,” the warrant states.
After the public network was re-opened that same day, the IT manager at the observatory “could detect inbound traffic to the specific port which had been blocked.”
The IT manager alerted special agents with the MAC address and the operating system for the device accessing the IP address in question. The warrant states the IT manager “was able to trace the host computer with the (identified) MAC address to a wireless access point located inside the Dunn Solar Telescope.”
On August 6, 2018, an undercover special agent using peer-to-peer file sharing software received a child pornography file from the IP address re-opened at the observatory on August 2nd. During the four day period from August 2-6, the same IP address allegedly participated in the distribution of more than 200 files of known child pornography, the warrant states.
By tracing the activity on the IP address and the host computer, investigators determined it was most likely “the individual downloading and distributing child pornography was present within the facility between approximately 5:30 p.m. and 6 p.m. on almost a daily basis,” the warrant states.
On August 21, 2018, the chief observer at the National Solar Observatory notified his supervisor he had found a laptop computer running in an empty office. “He further reported he had seen the same laptop secreted and running in two other offices over the past several months,” the warrant states, “he described the contents on the (laptop’s) desk top as ‘not good.'” The chief observer was ordered by investigators to lock the vacant office so no one could go inside.
On August 22, 2018, investigators met with the chief observer and seized the laptop found in the empty office. The chief observer told investigators he had first seen the laptop underneath a desk in the office. The laptop was running and plugged in. When he opened the laptop, he saw an image of a naked adult woman “which rapidly changed to an image of a female child with her face covered with a mask,” the warrant states, adding “The chief observer assumed the laptop belonged to one of the New Mexico State University students who occasionally conducted research at the observatory. The chief observer was distracted by an urgent matter within the facility, shut down the computer and did not report the incident.”
The chief observer told investigators, that over the next several weeks, he saw the same laptop secreted, plugged in and running inside several vacant offices in the facility. When he found the laptop in the empty office on August 21st, the chief observer realized it did not belong to an NMSU student because no students had been in the observatory for at least ten days. The laptop was allegedly found next to a box of cleaning supplies, the warrant states.
The chief observer told investigator he and two other individuals were the only ones who had access to the facility for the past 36 hours. One of the individuals was ruled out because he did not have access to the observatory from January 2018 to May 2018, when the wireless internet signal was used to download child pornography.
The second individual, identified in the warrant as the facility’s janitor, began providing janitorial services at the facility a year ago, the warrant states. Although the janitor’s name is listed in the warrant, ABC-7 is not identifying him because he has not been charged. The janitor was allegedly seen exiting the vacant office where the laptop was found, the warrant states.
The chief observer at the facility told investigators he had seen the janitor arrive at the facility the morning following the seizure of the laptop computer.
On August 22, 2018, the janitor approached the chief observer and asked if anyone had been in the office because he was missing some cleaning supplies. The chief observer told the janitor there was no reason for anyone to be in the vacant office because the assigned person had not been there in months. The janitor then stated he needed to clean the office next door and needed access to the vacant office so he could retrieve his cleaning supplies, the warrant states.
Later in the day, the janitor allegedly reported someone had been entering the facility at night in order to steal the wireless service. He also told the chief observer he had seen a man inside a pick up, parked in the observatory parking lot, with what appeared to be a black book.
On August 23, 2018, the janitor allegedly told the chief observer he was tired of people taking his things and that he was no longer going to bring any personal items into the observatory. He also stated many knew the passcode to the facility and the code should be changed. The chief observer said the janitor was frantic and said something to the effect of “I should be able to throw a laptop down in a room and not have to worry about someone stealing it,” the warrant states.
“The FBI is investigating (the janitor) as a suspect,” the warrant states, “based on the investigation, the FBI now believes (the janitor) is the user of the computer which was being used to access the wireless internet signal and to download and distribute child pornography.”
The warrant states the FBI’s claim is based on the following facts:
1) The wireless internet signal used to access and distribute the child pornography is contained within the observatory and does not reach any of the housing units near the observatory.
2) There are only two individuals who access the observatory after dusk and before dawn. The alleged activity began after the janitor was hired and months prior to the time when the other individual was given access to the observatory.
3) The janitor was allegedly present in the facility during the days/nights in which the host device was connected to the IP address within the facility, actively offering to share files consistent with child pornography.
