Marc Lopez - Taken: What Happens When A Hacker's Daughter Goes Missing

he is a army brat so he HS from everywhere but most identified with Miami and he currently teaches a cyber boot camp at w case Wester let's give Mark a warm Round of Applause thank you Mar okay all right all right so um as everyone's making their way in I'm going to stand here so the reporting uh can be picked up but uh I appreciate all the the attendance here and welcome to bsides austa it's actually my first time attending as well uh a little bit about the talk before I jump into the slides is uh it does have a happy ending right and so with that uh I have some humor uh in in the slides but I understand that

uh some people may be coming across this talk after the fact that may be in a crisis mode uh and so I do want to pay attention to that and have sensitivities of that um but with that being said I hope it's enlightening I hope you find it useful uh and uh I'm looking forward to the questions that come out of it at the end all right so as my talk is title taken what happens when a halfers daughter goes missing so a little bit of background about myself uh this is my 19th year of service in the Army I started off uh as a linguist and I did Intelligence work for about the first 10

years of my career and then switched over to cyber operations and so I learned uh how to spell IP address somewhere about midpoint in my career and then from there uh learned how to put pieces together to figure out how to provide intelligence to our nation and to our military and so when this event happened uh and it's exactly 366 days ago so yesterday I was going to go to besde last year but wasn't able to attend uh for obvious reasons that I'll be getting into all right so um today's story let's give some background bullets right so we have digital Footprints everywhere where we use our devices we have all these identifiers that make up who we

are right uh I'll talk about my family Dynamic a little bit without getting into too many details uh I'll also be disc uh discussing sort of what was going on in my head at the time at different moments right because it's difficult to make decisions it's difficult to Think Through Your analytic processes when you have so much emotion going on right we still have a home a home to run okay um she happens to leave her devices which is I think uh an interesting point and we'll talk about that uh how I came up with a different plan and then actually getting into how you Wrangle the data that you have once you have it

all right um she eventually makes it home I engage with law enforcement multiple times we'll talk about that and what that looked like and uh then I'll open it up for questions uh and discussion okay so if we think about it should come to no surprises us as people interested in cyber security or as enthusiasts that every piece of technology we interact with if it's Network connected has some sort of identifier associated with it right you have your phone you have a SIM card right you have a mobile equipment identifier you have a MAC address you have an IP address that's assigned to you at that time every application you use that's Internet connected also has

maybe its cookies that it's leaving in your device right so think about that now multiply that across a household multiply that across family and friends you know there's a lot of different identifiers that are out there so we'll be putting those pieces together to talk about what happened uh in in my life last year okay so background setting it's early October uh we just had a great summer vacation um my family home schools right uh we're a foster family and we're a household of eight uh right now there's two preschoolers four teenagers right so we're we're pretty busy home uh so yeah there's uh it was a complete shock to us uh when this happened because my daughter uh and

sometimes I'll reference her as my daughter or just as d right uh she had been with us for a year at that point she came to us in October of 2021 uh she's actually like a third or fourth cousin of my wife's like extended so they reached out to us from another state uh because we were licensed here in Georgia as foster parents to see if we would take her in and we said absolutely right uh and so not too much detail but a little bit she uh was in and out of care from an early age and had different traumas in her life that really complicate the situation as we look at what happened all right so the phone call

typically when I'm at work right I'm there getting ready for the day and uh there's a lot of people in the audience who have have had the pleasure of working with over the past and I get in my zone and I'm ready to go and there was this big meeting that I had to get ready for uh a briefing with somebody that had stars on their uniform and I was like all right yeah I'm ready to go and all of a sudden a phone call comes up and I have a call already it's a phone that looks almost exactly if not exactly like this uh comes up a call my wife and I'm like okay it's after 9:00

she's getting there school day started I must have left something like in a weird spot or like I I took something and moved it so that's what I'm thinking like hey Mark where'd you put the fill in the blank and then so I'm like all right we picked this up right before I walk away from this meeting and uh I picked it up and my wife is freaking out and she's like she's not here are you you know D is not here I looked here I looked there I was like all right we've been doing like fire pit stuff so maybe she's outside she wants to you know do a morning fire pit thing nope I checked

there I check and she's gone she's absolutely gone and so I was like this makes no sense we were in a really good spot with our family what is happening and so you know you start to think about all the different things that could have taken place um okay what you know what their file play and I I have no idea at this point all I know is that okay I need to stop my work day and I need to go home right and so so thankfully I have a lot of uh supportive people uh in the office where I work that have absolutely been uh were phenomenal through this process right and so yep I picked up I said I'm

not going to that meeting and I'm leaving um my daughter's gone and because she uh you know is in a vulnerable state we want to make sure that um we can I can take care of this no questions asked I was able to go right uh my immediate thought on driving home was is this happening uh what can I do starting to have my analytical brain sort of like come together and think about what are my next steps what's my next move right so from a planning perspective like okay we we're clearly going to be able to have um law enforcement come out uh we'll have them put their dogs and they'll be able to

like smell her stuff and then we're going to find her like she just walked away and we'll know what happened um but that wasn't wasn't that cut and dry so the investigation begins while I was on my way home the uh our local counties deputies came came out and they were already at the home going through the house and figuring out what happened uh from their perspective and so I I pull up and there's there's Bo there's um there's police cars in my driveway and first thing I thought was whoa she loved her devices this makes no sense right like what teenager doesn't take their devices with them and she's 17 at the time uh and so I was like that doesn't

make a ton of sense and then the law enforcement agents kept asking okay well does she have another cell phone maybe we can pay it and I was like no this was the only thing that to our knowledge that she had uh and so that was frustrating like oh man she didn't bring anything so we can't find her right away and then I thought hey she loved her devices I I can figure this out like I know what I'm doing I I can put these pieces together let me figure out and and so I was almost worried that they were going to you know take all of the devices and and like I wouldn't be able

to see them uh but because she was 17 um and because as you see on the slide she left a note there were very limited resources that went into the case from a law enforcement perspective uh and to complicate the situation you know we were trying to think all right what did we do wrong as parents um what's happening here but the note uh you know I'll summ it down into one or two of the lines it basically said thank you for giving me a year of a childhood that I didn't think was possible from what happened in my life I love you and I'm so sorry to disappoint you and that was to me and my wife and I was like I I

don't know what happened this is all very conf using um and so that's the emotional aspect of what's happening in my head as I'm trying to put these different pieces together all right so the starting context for this I had one iPhone I had a Windows laptop that she was using for school stuff there were three social media accounts that I knew about and one email account that I I knew about right and so I started immediately just like you know tapping and clicking through stuff and I I'm just looking for that one piece of information that was like okay she went here here she looked up Greyhound so she went to the Greyhound stop right and so that we're going to go

find that uh and so it was it was very reactionary and so if you you know if anyone finds themselves or knows a family member um or happens to have a terrible thing like this happen like your vision is going to be clouded your judgment your your planning your decision Cycles are going to be impacted by that um so I mean we had friends all over the um the Cs saying like Okay and so I'm local here to the Augusta area and uh they said okay yeah we'll call Greyhound we we'll go here uh cuz we had seen that on the computer and uh then I realized okay there's a lot of these accounts that she

had that are logged out I was like why why are these things logged out she never logs out so to give some additional context right she had been in different programs that didn't allow her access to technology um all through you know from ages like 10 through 16 really till she came to our house and so she didn't uh use technology like a a standard 17-year-old would today uh and so she she even would admit um and I just for full disclosure we did talk about like how I was going to present this and I have her permission to share this part of the story um with you all today right and so she's like I have no idea what

I'm doing with technology like how do I use like why do people care about Instagram like she asked me like a 17-year-old asked me I was like I don't know I don't use Instagram right like I see St um but so she was still like just starting to get used to these things and so she wasn't really techsavvy in her own words she's she's not your standard user of of the technology that um our teenagers use today right and so the initial thought came up was okay who is involved who is involved with doing this and who am I up against right because I noticed the passwords are changed um I noticed that things were logged out and

on just a quick scrape of the browser history and so I'm trying to understand who my adversary is who is impacted my family in this negative way trying to say okay who who is doing this and why are they doing this uh and so let's get into that a little bit further next so yeah these are the devices that I I had uh and so I started with organizing my plan right and so some of my training is you know put me in a a position where I have to think about okay if we're going to do a specific action right I start my military planning process and I'm like all right I need to gain access to the

accounts all the accounts that I have artifacts for I need to understand what data is on those accounts and then I need to parse that for for different insights I'm so I'm going to collect collect all this data together put it in one spot and then clearly I'll have something that I can tell the authorities about what happened and then they'll they'll put the resources behind it to be able to uh find her right and so uh first stop was was the browser history so she had signed out of a a Google account on her phone but the browser itself uh and the Gmail account was signed out but the browser itself was still signed in uh and so I

leveraged that to be able to start doing my triage what I noticed on the initial manual review were various Facebook log Facebook logins and logouts uh there was a creation of a couple different Google accounts and a creation of a couple different Facebook accounts uh the new Facebook and Google accounts uh went through various rounds of password changes over a course of two days I noticed that there were chunks of history that were deleted uh that did make a ton of sense and then I saw in the history a login page uh for Bethany Smith her name is not Bethany Smith uh and I was like okay who is that is that somebody that helped her is that

somebody is this the person that I'm up against who's who's Bethany Smith uh and it turned out that it was actually um a fake account that she had made in order to have communications with a couple different suspects that we'll get into right so I then started to say okay based on what I know what account artifacts there are I have uh some accounts that are signed out which ones uh so I noticed that it was messenger for iOS and for Windows like she had logged out of Facebook um and then when I was going through that on the phone itself I could see that if you if you use Instagram messaging like through Messenger or Facebook if you add

another account to that you you can see what accounts you have tied to that device and so I noticed Bethany Smith had a login on her on her pH so I said okay that's that's who Bethany Smith is she created an alias and so immediately I told the investigators and this is all that same evening uh that I'm going through just the browser part and just looking at the devices so I I I let the investigator know the deputies that came to our house hey she could have an alias of Bethy Smith as I didn't cover more I see a new Gmail account hey she could have this uh Alias where um she was P

Lopez okay and so clearly I'm thinking all right they're going to put all these pieces together still didn't happen um I did a password reset on her Google account because my thinking was okay if somebody is helping her and they recognize that she didn't uh sign out of all the different aspects they're going to try to maintain that account new account takeover of that and lock me out again further so I said all right let me change the password on what I do have access to which is her standard Gmail account or Google account and then I'll use that to do a password reset on her standard Facebook account uh because there was some data there as

well and so I did that and I was like great now I can start looking through some of the details that are part of those accounts that I now can sign into all right so this is what the initial picture looked like I had um a Google account right daughter gmail.com uh and that was used to create her standard Facebook account there were standard usage there we knew about that stuff um and then the atypical usage was that there was a Facebook account that that was used for Messenger from both the iPhone and the school laptop with that strange gmail.com address which was used to create it right so this is the point that I'm at I'm like okay I need I

need more pieces to this puzzle I needed access to that um Gmail account and I I had no idea how to get it I uh bruit forced it as much as I could uh I had other people trying to help me put together different password lists based on things and uh I just couldn't get in and not and so it was frustrating so I read through all of Google's account policies to figure out how do I reset reset an account that um I need access to because this is already a day and a half maybe two days later where I I kind of was stuck the authorities said yep we're on it we're going to start our

investigation and uh let you know what happened try the best we can find her and so I'm going through Reading literally just reading Google password reset policies trying to I reached out to the law enforcement uh email address that Google had uh just to say like look I'm not in law enforcement but here's what's happening and obviously I get the email back it was a c email if anything that said uh you know thank you for your interest uh you know if this is a law enforcement request somebody will get back to you and so I didn't still waiting on that one that didn't happen uh but I did reach out to to my network

and ask hey does anybody know anybody um at Google or that can help me understand this and thankfully there was uh somebody who had contacts and connections uh with somebody at Google who kind of talked to somebody in their uh law enforcement support case uh office and they they helped me inform my local office on my local sheriff's office on what to do uh in this case so I was like all right that didn't help me I was I was thinking maybe somebody's going to get me access to the account right like I was trying to socially engineer my way into with with Google people and that didn't work surprisingly right uh so what I did find was that if

you dig hard enough there is a um way to do an account recovery if you have these artifacts of different pieces of your persona what makes you up on the internet and so because I had a phone that she had logged into with one account and that data was tied to uh the the Google account that I needed to get access to and so was the laptop I was able to request this password reset and I was like awesome and so I hit I hit reset and then it's like thank you for your request please wait 48 hours I was like no I I'm not going to be waiting 48 Hours um this is insane

like I I need access now uh and so and it said and then we may we may be able to give you access if our review team says like yeah you have enough of like the thumbs up stuff like the green check and not red flags to say like yeah you can get into this account what do I do in that time right and this is where you know I I did reach out to my network uh I pulled this out of my LinkedIn a year ago some of you you know were on that post and I did get a hold of somebody uh with uh at at Google like I said and then somebody else at uh at meta that

did work on the Facebook actual a team of uh incident responders for law enforcement requests which was great uh I had gained the access they said I was legit and I got access to that account uh confirmed that I was able to re set the password for Bethany Smith and then I was like all right I I have stuff and I look through it and oh man messages were deleted of course they were all right well Facebook and a bunch of people were like oh yeah Facebook has archive messages just go back there and look at the archive messages those are deleted too and again putting in things in context she didn't have the text savy

to know to go to those archive ones and delete it so someone is clearly helping her someone is is guiding her through this process and so that's what's going through my head is who is this person who am I up against so here's here's where I'm at so far based on messaging history uh and different things there were two suspects one was in Florida Florida the other one was in Oregon there were deleted messages passwords were changed and so I remember uh forgot where I got the information from but I knew that you could download like your entire history of Google and your entire Facebook or meta metadata right that's a play on words I know you'll see it a couple

times more in the slides right and so that's where I was with this whole thing all right so I did just that I went into the different providers so in Facebook I'm sorry in um Google it's called takeout you can do Google takeout and you have the option to pull your data out of Google from uh everything from your map searches to uh places you checked in literally every Google service that's out there you can pull your data for and review that and so I did that for both uh the account that she normally used which she had only had for a year when she moved in with us and I did that for uh the one that she used

to create that Bethany Smith Facebook account and I was like okay I'm going to find stuff uh I want all the data select everything and give it to me and it's uh for Google they give you output in a CSV and so I was like cool I'm an analyst right I can analyze things in a CSV file drop them to Excel and you know make pivot tables and do the whole thing right uh sweet so I got that and then that said okay you're because you requested so much data that's going to take approximately 24 hours to download so I like oh man uh so I had uh that request in then I went over to Facebook

and did the same thing for uh the Facebook ones now what I want to show you on the slides has changed since last year right these companies are continuously innovating they're always coming out with new ways to interact with your data and so by the time uh I was creating these slides all the interfaces had changed but the the the service still remain to download uh your data so Facebook meta data has two different formats uh you have browsable HTML files uh there's some pros with that right it's interactive like you take all these HTML files that they give you in your output and you can browse through it uh it's it's really easy and

to interact with and kind of gives a big broad picture of what's going on with that account the difficulty with that is that I know I needed more Rich data to work with to understand all the details that were asso with what happened and so I I opted uh then for the the Json data which had those detailed detailed records but was so granular that it was difficult to eyeball pars right not only that but it's there's so much even for a young account when by what I mean by Young is you know just recently created that I quickly became overwhelmed meanwhile uh you know having taller Twins and other teenagers in the house like there's there's a lot going on at

this time uh and so not a whole lot of sleep happening there's all kinds of sightings of you know potentially oh she's here because my wife went into like overdrive mode and started posting Flyers um making all kinds of social media contacts uh with with different agencies across the country uh including the center for missing and exploited children right uh and so this is an example of what the data looked like in the Json format right and it may be hard to see I understand that uh but what I want to draw your attention to is the time stamp uh oops that wrong Arrow the time stamp so does anybody know what kind of time stamp format that is eot time right

that's the number of seconds uh that have elapsed since January 1st 1970 and I was like okay uh yeah I don't know how to like sort that in a spreadsheet right so I need to figure out a way to to Wrangle this now I did recognize some other things in uh this Json field I'm sorry in this um key value pair that uh I thought was really interesting so one was a user agent string and the other one was something called a data Cod and I thought huh that's that's interesting let me read more about that so user agent strings are uh when we have different browsers that we use uh we use our user agent

strings to interact with a web service and it kind of tells a web server who you are right the device you're coming from that way it can render the page to you the way that you expect right or if you have a certain device your user agent string you use from your your handset or your tablet will be different so that the page can be sent to you or the service can be sent to you in a format that is easy to read That's compatible with your device right and so that's some of the purposes with user agent strings now you can do analysis on the user agent string to show uh more details about a device so I was like

okay I'm going to use this to figure out some more details along with the and I didn't know what a data cookie yet was yet but Facebook has really good documentation and so I went and found out that all right a data cookie is and I don't know if that's the way they say say it but that art a that art cookie so I'm just going to say dater cuz it's fun so a dater cookie uh is the cookie that Facebook puts on a device that signifies this is this device's cookie it's not your account's cookie it's the cookie for that specific device so I have uh my handset here and I log into Facebook uh and my personal account

great I have a data cookie associated with that now if I you know hand my handset to my buddy over here and they log into their account their account is also going to have that day or cookie feel but from my my handset so that's a key piece of what uh how we found out what was going on uh that we'll get into in just a bit but I still need to Wrangle this data I still need to interact with it and here's my Lia moment where I thought you know I know what I I don't know what's going to happen right I just I know that I know data I know how to do

analysis if I can put all these pieces together there's going to be a way I can figure out what happened and so enter Powershell where I'm able to and please scan the QR code uh that way you can see it links directly to uh my GitHub page where I put together my you know 60 line script to try and parse this data right uh so feel free to do that I'm I'm not a developer right trade right I'm an analyst who likes to push buttons and make things automated and so um I like uh I'd like your feedback if you want to take it you know I I'll entertain all the pull requests Fork it do whatever

you want with it um a couple reasons I started thinking like okay I've used python before too I'm profession in Python let me do this in Python and and it's on my local machine here and I thought I could you know Wrangle Json data with python pretty easily uh because it's something I'm familiar with but then I thought what if somebody else is going through this and you know Windows having the market share does I was like let me Wrangle it with Powershell um and get the fields that I want using PS custom objects to be able to look and produce a CSV that I can then analyze so that's exact what I did and I'll leave this up for another

minute um while uh if anybody else is scanning right otherwise I'll I'll I'll make sure that it's available upward if you look for me uh script or not is my uh tag on GitHub uh and we'll go from there okay so I don't use Excel all the time right I like to use interfaces uh but when I do it's spreadsheets right so I had human readable time stamps because what what I did and I'll go back real quick um and I think if I jump over here a wi Lite and we look at line 25 is what did the magic for me where I had to convert the Epoch time to something that I could

actually digest and parse and put together right so um I know that there were functions uh built into python that helped me do that at first I thought maybe I should use nested bash right like I could you know call my windows subsystem for Linux and use bash to like convert the time easier um meanwhile still wrestling with the emotions of what's happening right like my family feels like it's collapsing and so I don't I don't know what the best approach is but I'm like okay let's just poh it out and thank you stack Overflow for having that wonderful line that I was able to pull and and uh see that that's what I needed to get uh the way I

needed to look yeah so I I I will spare you what my spreadsheet actually looked like uh because there's a lot of fields a lot of data and that was going to be a lot to tokenize uh for this brief uh and so what I will represent though is the more clearer picture of where we were at with the situation all right so up at the top uh all the way through the through the bottom on the left hand side of the diagram that's what I knew before we had that atypical usage with the Bethany Smith Facebook account I did see contact with a suspect in Oregon uh who was uh a known sex offender a known um person

that was had Abus in past and that was scary and we didn't know what was going on uh and so then we had a a search result and a messenger contact with a Florida suspect who was an extended family member of hers uh that was also scary because that's this person has also been in and out of jail and we weren't sure uh their intentions or or how stable that person was what I did find through that spreadsheet analysis and through all of the um the details was that there's an iPhone 13 that logged in to the Bethany Smith account after she was gone and it geolocated to South Georgia North Florida okay cool I let the detectives

know right away hey this is what happened oh okay thanks right like that's best response I got she's 17 you guys like we have other things to deal with unfortunately there was a case um in Savannah at the time where there was a 2-year-old missing and so a lot of the state's resources were going toward that case and so we were kind of like pushed off to the side especially because she had left a note she had left a note saying like she was just unable to to bear like kind of Life circumstances for her at the time and so they thought she didn't want to be found she clearly she changed all her things and we tried our

best to articulate like no this is not her normal behavior right like yes we've only known her for a little over a year but this isn't standard for what she does um so yeah this is this is the picture so we were waiting and uh you know I had that I had that uh diagram up and I went to my local sheriff's office uh and I was sitting there and I printed everything out for them make multiple copies because that's what you do when you're a senior leaders right you print out the PDFs drop it off on their desks and I had every every uh detective that I could U sitting in that office going over some some data with me

but this is what it felt like and like they looked at me like I was crazy and I don't know how to how else to articulate it but when you have someone you love that's like gone and it's like crazy and you don't know what's happening like you can probably come across like like Charlie does over here on the side all right so what I'm going to go over next are literally The Briefing is literally The Briefing the next couple slides that I gave to them uh to try and help them understand what you're looking at and how easy it should be for them as Law Enforcement Officers to and if there's any law enforcement

officers in the crowd thank you for what you do um I'm not ultimately there was great interaction but what I found was it was really difficult to articulate from a techy mindset uh how do I how do I say like this data is important you need this just go request it because I can't I'm at a limit of what I can do with what I know and so I need your help I was looking for a partnership uh with them so this is my brief into them same uh same thing I had obviously more enriched details that I took out uh for this presentation but we explained who the Oregon suspect was we explained who

the Florida suspect was and the family relation and so uh we explained what an iPhone 13 you know why that mattered and that no that wasn't hers um and so this is I then went into all right there's an IPv6 address that's the real one it's probably been you know reassigned since then um but yeah I was like the customers assign IPv6 here's why that matters right it's more granular uh and it was with T-Mobile because I looked at the registration records and so all you have to do is contact T-Mobile right like that's put in your law enforcement request um and then I will talk about Facebook Messenger like what accounts are linked to the messenger cookie

starting with that string and that's the actual string right uh and then I said all you got to do is you know find that out and then request from Facebook or meta you know this bethle Smith account looking for the uh the messages that had gone I go into the significance of an IP address and I I try to tell them what that looks like and then I even gave them the wonderful resource of here's how you do your job right you just got it those people because I I was literally at like my end of like what I could do I you know I was ready to like go apply to a laws enforcement agency to say like okay

I've applied I'm close enough now can you help me um so yeah I gave them that team of the law enforcement process and then I went over this with them because I tried to make it really clear uh this is some of the output you get from the HTML which is great now it doesn't have the graphics I stole that from my Vio license that I have um and so I said look the Facebook Messenger cookie those data data cookies I didn't call it data cook throw them off I just said like Facebook Messenger browser cook P um when you use your actual browser whether that's you know Firefox Edge Chrome that's you know that's one machine each

of those get a machine and then the uh the app itself gets a machine or gets a machine identifier uh for the data Cy and I said look there's significant event big red arrow right there this is look at the date time stamps they're after they're after what you know what she she was gone so go find that right um and I told them the significance of it right so here's a quick little like story I tried to give them I was like imagine you have a drug dealer that you're tracking and this person has tons of different burner accounts but they're using one phone right so if they're using one phone but they have all these

different accounts all those accounts if you're able to tie it back to that one data cook you have your suspect and because some of the uh detectives were um narcotics detectives and I was like okay yeah this should make sense and there's something like yeah okay I see that and so I was like great let's talk about the iPhone 13 it was used after like I made it really clear because some people don't like to look at time stamp data even with a big red arrow this is a significant event so I went over I went over why this phone mattered right and where the GE location was was for and then I told them how to

contact Facebook here's how you do that part so just please go do that right and this you know I sat in this is across Seven Counties in two different states that uh I was giving this briefing at while around the road looking at different sightings that were happening um calls that we would get from the Flyers that we put out right uh so then we waited um sorry yeah that was just Facebook thing so then we waited three 3 weeks in by okay local law enforcement assured us that they were coordinating with other agencies uh and like I said we went on the road and we went to these other places where there were sightings and their uh police

departments were were happy enough to engage us and they said oh you have to contact your local County to put in a request okay well we did well they never reached out so there's not much we can do um but I gave them briefing anyway uh and they were kind enough to offer to go do health checks and stuff on the residents that we thought uh she may be at and they found nothing when they went and did that uh and so we called our local detectives and said hey we're at County X in Florida can you guys call them and just say we'd like your assistance okay yeah we'll do that still didn't do it so we drive back here to CA

we go down the road here to the DA's office and I give to Da the the DA for this region the briefing and I say look you're a lawyer right this makes sense right this is the data points we need that help oh okay yeah that makes total sense they reassigned a new detective from my County who was a little bit more enthusiastic and and was offering to help us a little bit better with this uh so we sit with them they have connections with the Georgia Bureau of Investigation gbi and uh so we get a gbi analyst assigned to the case she was awesome right um she looked at the briefing she's like yep I'll talk to our cyber

guys uh that work just down down the street at the Georgia cyber Center and we're going to figure this out and you know we'll be good to go your C just has to request gbi assistance okay so they request gbi assistance because we're all sitting in the same room and it was hard to for the local agency to say like no we don't need you um when they clearly hadn't done anything and got you know slap on the wrist from the da often saying like you need to investigate when you know people bring things up and so um that new detective the gbi uh actually agreed to do the a real uh investigation uh with of the forensics investigation of

the devices so I hand over the devices uh they didn't find anything extra uh because everything was done from an internet perspective uh and then what else happened is that they got the FBI on board because even though I laid out like here's how you contact they just I when I talked to the people that I did have contact with at Google and at meta and again the person at meta was is like their lead for uh law enforcement uh cases uh that come in he said yeah as long as it comes from like at Sheriff's Sheriff's office.org or like it's a real domain that we can tie back like we'll we'll go and engage with them um so even

though I had you know giving them that information the gbi um and that new Detective start working with the FBI local field office here in austa we sit down and have a conference call with them and they said yeah this is great here's what we're going to do we're going to leverage something called our administrative subpoena power and we're going to uh put together all the details and so we sit there and wait like okay cool like I gave them everything like all you have to do is use your legal power now to go get the data and we'll be good to go and so uh I waited for a week and a week is a really long time

when you're someone you love is missing and so I was like I don't know what's going on so I would call them up every day anything new yes we have good data we know what's we we we we're in a good spot they couldn't tell me anything for their operational security reasons uh but we're in a good spot you know we have we know what we know and trust me things are in the works okay cool things are in the works she's not home yet she could be being harmed I don't know what's happening so November 8th I think the day was uh there was a my wife was out posting flyers or or you know trying to

figure stuff out meeting with different agencies and she gets a text on her phone from a number she never seen before send cops to so and so's house it's bad who is this it's me I'm sorry I messed up it's me are you and so we got no the number of spam things we got saying like we have your daughter she's sick you got to send us a million dollars right now right like we got a ton of those from poting we do that we do that we part of that so we weren't sure if this is one of those things um but there were enough details to know like okay this is this is real and so

um depes were dispatched and uh she was found so what happened right life is messy and so she uh had reached out to a family member cuz she didn't think what was happening for that year that she was with us like she was deserving of it she didn't think she could deserve a real family um with people that loved her and would like go on trips and when she messed up that it would be okay and so she reached out to the person in Oregon um as often victims do that had abused her in the past uh to try and like get mad at him and like write things uh she reached out to that extended family

member in Florida who was like oh yeah I I'll come pick you up where you at and in her you know in her mind at the time she's like I'm this is where I am so she shared with the general location of where she could be picked up she changed her mind but that wasn't good enough for this person whose dirt bag right and so he said if you're not there at this time of day I'm going to show up and shoot everybody in the house so you better be there and so she thought I I can't live with that I have to be able to um these people that I loved like I messed up and

so she went she went and they drove back to Florida um so while she was there they forbid her from using technology uh every time that we sent Law Enforcement Officers to the house from a request they would hide her under the bed um and then what actually happened was that uh during a demestic uh violence incident in the home that she was at she was able to grab a tablet remembered my wife's number but my wife made her memorize by heart uh and was able to text my wife uh and then deputies were dispatch within minutes and so why did I do this talk this is this is what happened um because I I

found out through this experience that our our local law enforcement agencies are really underresourced when it comes to understanding digital investigations right so uh I share the story to to show that there are pieces out there fragments of data of information that we can put together to help arm uh ourselves with you know the right kinds of tools in case something tragic like this happens um again mine did end with with a positive story she was back back home she's finishing up her senior year or I guess Midway through her senior year now of high school um and she has big plans for the future right uh so the person that uh did this that extended

family member uh is currently serving prison time uh the the charges were like interstate commerce laws and things the FBI did a whole thing right and um obviously they were found guilty uh of that there was also some charges about interfering with a child custody case CU she is uh considered a dependent like from that military DOD stuff uh because she's you know she's our our um she's our daughter right that's the best way to say it there's legal stuff but she's our daughter that's how we sit here right so that's the talk and so with that I'll leave this open to questions uh for a few minutes that we have uh and if you want to connect with me there's

QR codes get to my LinkedIn please feel free connect yes you have a question in the

back I haven't but I did uh start talking with a couple of different volunteers Mar would you repeat this question yes so the question was uh there's uh companies out there and correct me if I'm wrong that will that have assistance to offer in these kinds of cases yeah the specific one's called Trace lab okay and they're softare security specialist that help TR okay yeah um so I don't remember if it was Trace live specifically but I did dialogue with some people in those organizations so the gentleman here is speaking about Trace Labs which helps people with cyber Security Professionals um find their missing you know missing love noise and so I did have some some

online chats with people at various organizations like that and they said dude you're you're on track there's not you can't do anything else um and then they asked if I would go to volunteer when this was all done when she was back home so and it's something I consider yeah absolutely thank you for the question anyone else question here sir um I was actually wondering like what safeguards you put in place for um these kind of events

Bo yeah so um save CS we put in place right uh we tell all our teenagers that we have there's a fine line between like safety and privacy and allowing someone to grow right um so our approach has been keeping an open dialogue but did put some new policies uh on her devices uh there are like open and I just drop off your device here we need to go through you know she's 18 now so there's a different level of of privacy that that we feel as a family she's entitled to and we have other um we have a 19-year-old also that that we here for and so we didn't put anything like that in place um going forward we our our

approach is having an open dialogue with our kids but we do have other security measures uh that we put for our family and for our home thank you all right so we do have two prizes to give away on behalf of Mark Mark that's an amazing story thank you for sharing

it