A sick trove of child porn found on Josh Duggar’s work computer was protected by the same password used for his family’s Instagram account, a court heard today.
Prosecutors say Duggar used his business HP to download videos of minors being humiliated and abused but hid his sordid activity behind a device called a Linux partition.
The Linux system effectively created a second, secret operating system on the same computer that could only be accessed by rebooting the machine, hitting F9 and manually typing in the password intel1988.
It’s behind this partition that the government says Duggar used encrypted ‘peer-to-peer’ software to anonymously search for and download child porn files from the dark web.
The court in Josh Duggar’s trial heard Friday that child porn found on his computer was protected by the same password used for his family’s Instagram account
Josh Duggar and wife Anna are seen arriving for Friday’s proceedings at his trial in Fayetteville Arkansas
The couple, pictured with six of their seven young children, subscribed to a service in 2013 called Covenant Eyes that monitors adult internet use and would report ‘objectionable material’ to wife Anna
James Fottrell, Director of the FBI’s High Tech Investigation Unit, told a federal courthouse in Fayetteville, Arkansas, today that two more machines, a MacBook laptop and an iPhone 11, were seized in the same raid on Duggar’s used car lot in November 2019.
Duggar spent seven days in jail after his April 29 arrest before being fitted with an ankle monitor and bailed into home detention
He didn’t find any traces of child porn on either, however, he did find an array of documents and emails on the MacBook listing login details for Duggar’s various internet accounts.
Several of these, including Chase banking and AT&T, used the password intel1988 while others used intel1988!, Fottrell told the court.
He said he also found an email sent from Josh Duggar to his father Jim Bob on February 13, 2014 letting him know he had changed the password to the ‘Duggar family’ Instagram – and the new password was intel1988.
Famous for appearing in TLC’s 19 Kids and Counting, Duggar was charged in April with two counts of downloading and possessing child pornography. He has pleaded not guilty but faces up to 20 years in prison and fines of up to $250,000 on each count if convicted.
Fottrell went on to tell jurors that the MacBook also contained a backup of an iPhone 8, which was never physically seized nor found.
He was able to access and identify it as Duggars’, however, through selfies and pictures of his wife Anna, who was in court to support her husband on Friday as she has been on each day of the four-day trial.
Fottrell said he found photos and texts on the backup that placed Duggar at his business, Wholesale Motorcars in Springdale, Arkansas, on the exact days that child porn was downloaded behind the Linux partition.
Presenting a painstaking timeline to jurors, he said that on May 14, 2019 Duggar took photos of a VW sedan, a Ford Truck and a set of scales that were then traced back to the car lot using GPS data stored in the Apple images.
Joy-Anna Duggar is seen arriving for Friday’s proceedings at her brothers trial in Fayetteville
Derick Dillard, husband of Jill Duggar, arrives for Friday’s proceedings at his brother-in-laws trial
At 4:49pm Duggar sent a text saying ‘Got stuck here’, Fottrell explained. At 5:05pm a notorious file of child porn called ‘webcam collection’ was uploaded to the business’s computer.
At 5:38pm the HP device downloaded a file named mov.0216 which had been previously identified by law enforcement as a video popular with pedophiles.
Four minutes later the Linux side of the Wholesale Computers PC made a ‘digital handshake’, not with another porn sharer, but with a law enforcement computer running specialist software to catch online perverts.
A detective from the Little Rock Police Department was able to download child porn from Duggar’s computer, thus triggering the probe that led to his eventual arrest in November that same year.
Duggar had also sent a text on May 15, 2019 stating ‘I’m at the car lot now.’ Around 20 minutes later his computer searched for depraved videos including ‘play tot sweetie’.
At 5:58 that day Duggar sent a text stating, ‘still have customers here’. That exact same minute another sickening abuse file named Marissa.Zip was opened on the computer, Fottrell told the court.
Investigators traced child porn images to the IP address to Duggar’s now-defunct used car dealership, Wholesale Motorcars, in Springdale, and seized his office HP desktop and iPhone in April
Duggar (pictured after his release from jail in May) allegedly asked federal agents without knowing anything about the nature of the probe: ‘Has someone downloaded child pornography?’
Josh and his wife Anna are pictured with six of their kids: Mackynzie, Michael, Marcus, Meredith, Mason and Maryella together. Anna recently gave birth to their seventh child
Fottrell said peer-to-peer file sharing software was found on the iPhone 11 and the MacBook but it was only used to download regular movies for Duggar’s kids.
However he also found logs on the iPhone11 indicating that Duggar regularly watched adult pornography, despite he and his wife having signed up to an online monitoring service named Covenant Eyes which was supposed to block his access to any online material classified as ‘mature teen’ and above.
In fact, Duggar had watched adult porn for ten minutes just hours before his arrest in November 2019, the court was told.
Asked by the prosecution which individual he felt had downloaded child pornography on the office PC, based on his analysis and two decades of years of FBI experience, Fottrell told the courtroom in a clear voice: ‘Joshua Duggar.’
Fottrell also showed jurors two emails he had recovered from Duggar’s seized MacBook that contained ‘accountability reports’ from the Covenant Eyes internet monitoring service, spanning April to May 2017.
The reports gave the self-confessed pornography addict’s browsing behavior a rating of ‘looks good’.
They did, however, list several areas for concern, chiefly multiple attempts to download the uTorrent application, which was found successfully installed on Duggar’s impounded iPhone11 but not his MacBook.
The week-long trial has heard that, while it’s not illegal to use programs such as uTorrent to search the dark web for files, criminals often use it for illicit activities such as downloading porn or buying guns or drugs.
It’s the same application that prosecutors say was used to download the bulk of the child porn files that were retrieved, watched and then deleted behind the Linux partition on the HP computer.
In cross examination, defense attorney Justin Gelfand put it to Fottrell that the computer at Wholesale Motorcars could have been accessed remotely by someone else who then streamed the child porn on a different machine.
He pointed to the fact that the Linux partition side included a program called Remmina, a remote access app that Fottrell admitted he was unfamiliar with, and that the alleged porn videos had been played on stream mode.
Gelfand also said the FBI could not determine which machines were connected to the internet when the illegal downloads happened because agents failed to seize or examine the router.
Similarly, a thumb drive that was briefly plugged into Duggar’s work computer at almost the same time the Linux partition was installed on May 11, 2019, was never found.
Gelfand suggested it could have had something to do with the installation but agents never found it or identified its owner, leaving them ‘guessing’ over who really created the secret porn domain.
In a tense back-and-forth Fottrell insisted the use of streaming mode was a quirk of how the video player interacted with uTorrent. ‘It’s streamed from me, From this computer, nobody else,’ he told the defense.
He was asked if it was possible ‘someone else, somewhere else on the planet’ could have logged on to Duggar’s machine to first download porn then watch it remotely without anyone realizing.
‘The possibility exists,’ he replied. ‘While the possibility exists I do not think it’s likely.’
The trial resumes Monday.