E-mail address led police to U professor

July 29, 2001

For months, it was as if he were invisible.

Richard Pervo, a professor at the University of Minnesota, freely used his e-mail at work to download thousands of images of child pornography, and his digital contraband slipped unnoticed into the torrent of data that roars daily through the school's massive Internet connections.

But Pervo left one stray thread dangling: his university e-mail address.

Investigators at the university and the Minnesota Internet Crimes Against Children Task Force grabbed hold and followed it to the Department of Classical and Near East Studies and through the frosted glass door of Pervo's one-man office. There they found scores of shiny CDs containing child pornography scattered among CDs filled with Christian scholarship and digital Bibles. The hard drive of his school-issued desktop computer brimmed with more child-porn files, along with Pervo's work.

Later, Pervo would tell police, "I was stupid, but this is good. It'll stop me from doing it."

Sgt. Brook Schaub, the task force's computer-evidence recovery expert who helped the university put together a search warrant for Pervo's computer, would muse: "You almost got the feeling that rather than executing a search warrant, you were doing an intervention."

But Pervo might not have been stopped without help from a sharp-eyed police detective from Keene, N.H., 1,500 miles away.

Det. Jim McLaughlin spotted Pervo's e-mail address after infiltrating an online child-porn club less than two weeks old. The 44-year-old detective has worked undercover since 1996, and he regularly combs e-mail addresses for clues to the identities behind the club's mailing list from its listserv.

Although Internet enthusiasts regularly use listservs to manage mail lists for thousands of legitimate interests. But child pornographers and child molesters also discovered that listservs could help them swap child porn and child-molesting tips and material among themselves, investigators say.

The clubs are secret and often require new members to offer their own child pornography to join, a tactic to keep out police. They have short life spans -- some last only a few days before folding , only to assume a new name elsewhere.

"It's like playing a worldwide game of Marco Polo," said Schaub, referring to a version of hide-and-seek that requires the hunter to keep his eyes closed.

But one e-mail address caught McLaughlin's eye. It didn't belong to a Web-based e-mail account like Hotmail or Yahoo that exists only in cyberspace but to a "route account" with a concrete street address. In fact, it had an ".edu" extension, indicating that it belonged to a school.

The name also stood out: pervo001@tc.umn.edu. Pervo.

"My initial reaction to that was that somebody was clowning around," McLaughlin said.

But he checked the university's Web site and found the name and e-mail really did exist. The detective also knew the header of the e-mail would record the route it took, and a quick check showed it started from a computer called 160.94.246.197 at the University of Minnesota.

McLaughlin faxed a report to the University of Minnesota Police Department.

"When I started doing this work in 1996, about two-thirds of my leads went down the drain because I couldn't find a law enforcement agency who wanted to touch these cases. A lot of these agencies had technophobia," McLaughlin said.

Now, however, he regularly sends out leads to departments eager to receive them, and he says he's coordinated the arrest of 225 suspects in 41 states and 12 foreign countries. "So far, we have not lost any cases at trial," he said.

The next morning, McLaughlin's lead landed on the desk of Patricia Gjerde, one of the department's two detectives.

Gjerde, a 20-year veteran of the department with a master's degree in popular culture, had been promoted to detective only eight months earlier, but she had training in Internet crimes and sexual predators on the Net. At 5-foot-5, Gjerde appears unremarkable, except for her arms, which are sinewy like a professional tennis player's, and for the 15-round Glock she carries discreetly under a jacket.

She was unimpressed that she was investigating the first child-porn case for both the university and herself. "As long as my investigation is as true and complete as I can get it, that's what I'm aiming for," she said. "I don't assume that people are going to pay a lot of attention to it."

Gjerde first visited the university's Information Technology Department, which confirmed that computer 160.94.246.197 belonged to the university. Technicians there also told her it was used in the office of Richard Pervo, a specialist in Christianity studies, and only during normal business hours.

E-mail logs for Pervo's e-mail account revealed a surprise.

"They're huge," the technicians' IT coordinator told Gjerde, noting that Pervo was receiving 12 megabytes of incoming messages, with each megabyte equivalent to one million bytes of information, which can translate into 300 pages of text copy or, in Pervo's case, roughly one digital image. For one week alone (Jan. 4 through 11), he received 4,700 e-mails.

The IT department also discovered that Pervo was sending out e-mails to addresses with names like "4femalechildvideos," "young-nude-girls" and "littlenudepreteengirls."

Schaub, called in to do a "pre-search" on images taken from Pervo's e-mail logs, found 4,244 images, the majority of them of girls ages 5 to 14 engaged in sex with adult men, according to Gjerde's report.

A seven-page list of "poplogs" for the e-mail address also shows that Pervo checked his e-mail constantly, up to 42 times a day.

Gjerde and Schaub walked into Pervo's office in Folwell Hall at 7:01 a.m. on Feb. 8. On the left side of the room on a computer desk sat 160.94.246.197 -- a Dell desktop with two servers, one with a CD writer, a device that allows a person to load computer files onto a CD. The investigators also found shiny CDs tossed carelessly into desk drawers, scattered on top of a 10-foot wooden worktable, spilled on the tile floor under the table and jammed inside his metal filing cabinet.

Pervo arrived a minute later. When the investigators handed him the search warrant, he set it on the table without reading it. "I know what this is about,'' he reportedly said. ""It's that Internet business, isn't it?"

Pervo pleaded guilty in May to six felony counts of possessing and disseminating child pornography. He was ordered to write an apology to the university and spend a year in the workhouse. He resigned from the university in June.

It's not unusual for porn collectors to use their work computers, police say. Usually, workplaces have high-speed Internet access that allows users to download pictures and video far more quickly than on a conventional home dial-up connection. Research institutions like the University of Minnesota also have hyper-fast, cutting-edge technology that make downloading a snap.

The university, like many companies, retains the right to monitor workers' computer use, but large network administrators usually are so overwhelmed by the task of keeping their massive systems running that they don't have time to sample the data that rages through their servers, police say.

"I think they think they're more anonymous," Gjerde said. "But it's similar to the telephone. You can trace a phone call -- you can trace e-mail."

Gjerde returned Pervo's scholarly material, but 160.94.246.197 was shipped back to the Classical and Near Eastern Studies Department in June, minus its hard drive. A hard drive filled with illegal pornography is so hard to sterilize that it's simpler and cheaper to destroy it and buy a new one, police say.

But the images that Pervo downloaded still exist. They're floating on the Internet, continuing to bounce from computer to computer, waiting for more downloads.

"Once that gets out on the Internet, it's out there forever," Schaub said.

Leslie Brooks Suzukamo can be reached at lsuzukamo@pioneerpress.com or (651) 228-5475.