Connecticut Man Found Child Pornography on the Darkweb and Shared it on Omegle

After a tip from Omegle, an online chat service, police officers arrested a former elementary school janitor for possession of child pornography (CP). According to a local news outlet, Douglas Mehan, a 50-year-old from Milford, Connecticut, found the media via a “special web browser.” The web browser, they wrote, allowed him to search for and download the content anonymously. However, he used a regular browser to share the videos on Omegle, and the chat service’s moderators flagged Mehan’s IP address.

News stations, after the incident, called Omegle an anonymous chat program or client. A once-over of the service’s privacy statement discredited these claims. However, the “anonymous” internet chat service requires no voluntarily submitted information from a user. They have stored user data since day one, but the lack of a signup form provided Mehan with a false sense of security.

Below is an excerpt from Omegle’s privacy policy that Mehan apparently missed:

“At the beginning of every chat, a record is made of the fact that a chat occurred between you and your chat partner. This record includes a timestamp, as well as IP address, ID cookie, and similar information for you and your chat partner. These records may be used for the purpose of tracking spammers, hackers, and others who pose harm to the site; and may also be used for law enforcement purposes; or analyzed in aggregate to produce statistical data (e.g., average number of chats started at different times of day). These records are typically stored for approximately 120 days.

Webcam images may be captured from Omegle video chats, uploaded to Omegle’s servers, and monitored for misbehavior as part of Omegle’s moderation process. Captured images may also be stored and used to improve Omegle’s moderation process.” (Emphasis added.)

According to the warrant, the information stored by Omegle directly contributed to Mehan’s incarceration. The screenshots, taken automatically during every video by Omegle’s behind-the-scenes software, captured CP scenes. A moderation process flags Inappropriate data—and certainly the highly illegal content in this case and others like it.

The human moderators, or “Omegle’s Moderation Team,” reported the graphic screenshots, IP addresses, and other saved data to the National Center for Missing and Exploited Children. Mehan shared three videos between 2:19 am and 2:39 am, and the NCMEC determined that all three videos depicted CP. Officials then sent the user’s information Connecticut State Police Internet Crimes Taskforce. The taskforce forwarded the information yet again—this time to the Milford police.

Police opened an investigation and quickly mapped the IP address to a physical address. Additionally, the physical address provided investigators with Mehan’s identity. A detective performed physical surveillance at the address on December 15. The warrant revealed that the wireless network’s owner secured it, but the guilty Omegle had network access.

Mehan’s place of work, the elementary school, received notice of the investigation soon after it began. After the arrest had taken place, the school system issued a press release regarding the incident. “Milford Public Schools was made aware of an investigation involving an individual who was employed by the school district. Based on the nature of the investigation, the employee was immediately placed on administrative leave pending the outcome of the police department’s investigation.”

In response to questions from the media, the school system also answered several questions that focused on Mehan’s employment They published a timeline of the events:

“• On Dec. 21, 2016, Milford Public Schools was made aware of an investigation involving Mehan. He was placed on administrative leave the same day.

• On Jan. 12, 2017, an arrest warrant was issued for Mehan. He was terminated from employment the same day.

• The investigations conducted by the police department and the school district found that the criminal charges were not related to the individual’s employment with the school district. The police found no evidence of actions leading to his arrest that occurred while in the school buildings.

• A search of Milford Public Schools computers found no signs of improper use by Mehan.”

A day after a judge signed Mehan’s arrest warrant, police officers knocked on the suspect’s door. They searched the house for electronic media and then questioned Mehan on the spot, in front of his wife and child. After he became “very uncomfortable,” the officers took him to another room where he confessed to everything. He also warned officers on the scene that his HP laptop contained “a lot” of child pornography. 378 videos and eight pictures.

Authorities charged the 50-year-old with first-degree possession of child pornography. He posted the $25,000 bond to remain free until his hearing in February.

Mehan’s case appeared to be one-of-a-kind; it involved the darknet and Omegle, yet mention of the FBI’s Operation Pacifier made no appearance in court documents.