2015-02 Education Department FOIA

11-000479
Attachment 6
11-000479
Attachment 8
11-000479
Attachment 9
UNITED STATES
DEPARTMENT OF EDUCATION
OFFICE OF INSPECTOR GENERAL

TECHNOLOGY CRIMES DIVISION
CLOSING REPORT CONCERNING
BUTLER, Joseph H.
11-110339
TABLE OF CONTENTS
NARRATIVE
ACTIONS TAKEN
ENTITIES AND INDIVIDUALS
ATTACHMENTS
Assistant Special Agent in Charge
Mark A. Smith
Special Agent in Charge
Signature
Signature
Date
Date
(b)(7)(C)
This report is the property of the Office of Investigation Services and is loaned to your agency; it and its contents may not be reproduced without written
permission. The report is FOR OFFICIAL USE ONLY and its disclosure to unauthorized persons is prohibited. Public availability to be
determined by 5 U.S.C. 552.
OIG-302R (8/07)
UNITED STATES DEPARTMENT OF EDUCATION

OIG FILE NO:
11-110339
DATE: July 12, 2012
REPORT OF:
BUTLER, Joseph H.
OFFICE: TCD, Region 11
PREPARED BY:
(b)(7)(C)
DISTRIBUTION:
File
, Assistant Special Agent in Charge
NARRATIVE
The Cyber Security Management Center (CSMC) sent the U.S. Department of Education
(Department) Office of Inspector General (OIG) Technology Crimes Division (TCD) a malware
alert on June 2, 2011. The alert stated Federal Student Aid (FSA) employee Joseph BUTLER
(BUTLER) connected to a malicious website while potentially accessing pornography on the
Departments network. TCDs and CSMCs initial log analysis determined BUTLER had, on
multiple occasions, queried and accessed potential child pornography. (Attachments 1 & 2)
On June 3, 2011, the Department seized BUTLERs Department issued computer (EDU403881)
and transferred it to TCD. The initial analysis of EDU403881 identified images of nude
prepubescent children and adult pornography. The analysis of the (b)(7)(E)
. (Attachments 3, 4, & 5)
On July 6, 2011, TCD opened an investigation into BUTLER. (Attachment 6)
(b)(7)(E)
. (Attachment 7)
On July 15, 2011, TCD obtained a Search Warrant in the Northern District of Georgia for
BUTLERs residence at (b)(6), (b)(7)(C)
,
which was executed on July 16, 2011. During the execution of the search warrant, TCD
interviewed BUTLER. He confessed to viewing the obscene images on his Department issued
computer and (b)(6), (b)(7)(C)
. BUTLER also consented to TCD
to searching his cubicle and his storage locker. DeKalb County Police Department assisted TCD
in the execution of the search warrant. (Attachments 8 & 9)
On July 28, 2011, Assistant United States Attorney, (b)(7)(C)
-OFFICIAL USE ONLY-
accepted the case for
Page 2
prosecution. On October 11, 2011, BUTLER was indicted by a Grand Jury, in the Northern
District of Georgia, on three counts of 18 USC 2252(A) and three counts of 18 USC
1466(A). (Attachment 10)
On October 12, 2011, an arrest warrant was issued for BUTLER, and TCD agents arrested
BUTLER and transported and booked him into Atlantas Detention Center. BUTLER was
transferred to the United States Marshall Services Detention Center on October 13, 2011 and
was arraigned on the same day. BUTLER was denied bail and remanded until trial.
(Attachments 11 & 12)
On December 21, 2011, BUTLER plead guilty to one count of 18 USC 2252(A) - Receipt of
images of child sex abuse (Attachment 13).
On March 21, 2012, the court sentenced BUTLER to10 years of confinement, supervised
probation for 5 years, and required him to register as a sex offender on his release from
confinement (Attachment 15).
On April 24, 2012, TCD destroyed all the evidence seized from BUTLERs residence, office,
and storage locker (Attachment 16).
-OFFICIAL USE ONLY-
Page 3
ACTIONS TAKEN
On July 15, 2011, TCD obtained a Search Warrant in the Northern District of Georgia for
BUTLERs residence at (b)(6), (b)(7)(C)
,
which was executed on July 16, 2011.
On July 28, 2011, Assistant United States Attorney, (b)(7)(C)
accepted the case for
prosecution. On October 11, 2011, BUTLER was indicted on three counts of 18 USC 2252
(A) and 3 counts of 18 USC 1466(A).
On October 12, 2011, an arrest warrant was issued for BUTLER and he was arrested and
transported and booked into Atlantas Detention Center, and transferred to the United States
Marshall Services Detention Center on October 13, 2011.
BUTLER was arraigned on October 13, 2011, and was denied bail and remanded until trial.
On December 21, 2011, BUTLER plead guilty to one count of 18 USC 2252(A) - Receipt of
images of child sex abuse.
On March 21, 2012, BUTLER was sentenced to 10 years confinement, supervised probation for
5 years and to register as a sex offender on his release from confinement. (Attachment 15)
-OFFICIAL USE ONLY-
Page 4
ENTITIES AND INDIVIDUALS

Subject Information
First Name:
Middle Name:
Last Name:
DOB:
Federal Inmate Number:
Former Home Address:
Former Company:
Joseph
H.
BUTLER
(b)(6), (b)(7)(C)
63206-019
(b)(6), (b)(7)(C)
U.S. Department of Education, Federal Student Aid

61 Forsyth Street, SW, Atlanta, GA 30303
-OFFICIAL USE ONLY-
Page 5
ATTACHMENTS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
FY 11-2422_Alert Summary
Re CSMC Incident FY 11-2422 Suspicious Activity (b)(7)(E)
Internet History and Log Review
Analysis of Microsoft Word Documents and other Files
Forensic Report 11-110339_618
Case Opening Memo
(b)(7)(E)
Interview of BUTLER, JOSEPH H.

Search Warrant ROI
Indictment
Arrest Warrant
301a Indictment & Arrest of BUTLER
Guilty Plea and Plea Agreement
Interview of (b)(7)(C)
Butler - Judgment and Confinement Order
301a (TCD) - Destruction of Evidence 11-110339
-OFFICIAL USE ONLY-
Page 6

DATE:
October 6, 2011
PREPARED BY:
SA (b)(7)(C)
CASE TITLE:
Butler, Joseph H.
CASE NUMBER:
11-110339
REPORT RE:
Internet History and web/firewall log analysis
TCD REQUEST #:
672
Request: Determine if any originating URL identified from the Word Documents, obtained
during the criminal investigation of Joseph BUTLER are located in system or network logs.
Status: Closed.
Data Analyzed:
Q0001: Image of a Western Digital ATA WT026 WD800JD-75 hard drive, serial number
WMAM9CWW8889, approximately 80GB in size, located inside a Dell desktop computer.
Q0002: Image of a Seagate Barracuda hard drive, serial number 5RW4FQE, approximately
80GB in size, located inside a Dell desktop computer.
Q0003B: Image of a Memorex CD-RW, unmarked/unlabeled, approximately 700 MB in size,
seized from Butlers residence.
Q0004B: Image of a Memorex CD-RW, unmarked/unlabeled, approximately 700 MB in size,
seized from Butlers residence.
Bluecoat Proxy Server and Firewall logs from 4/1/2011to 5/6/2011
Date Prepared: 10/06/2011
(b)(7)(C)
Case No: 11-110339
This report does not constitute a forensic analysis report but simply documents preliminary findings or the basic retrieval of data
from digital evidence. This report may not contain all information needed for judicial proceedings and is provided as an aid to
the requestor. If data provided is likely to be used in judicial proceedings, please submit a request for a full forensic analysis and
identify the data of interest. Please contact the author of this document for any questions.
This report is the property of the Office of Inspector General and is loaned to your agency; it and its contents may not be
reproduced without written permission. The report is FOR OFFICIAL USE ONLY and its disclosure to unauthorized
persons is prohibited. Public availability to be determined by 5 U.S.C. 552.
OIG-301A (11/06)
Page 1 of 4
10/06/2011
Background
The US Department of Education (ED), Office of Inspector General (OIG), Technology Crimes
Division (TCD) became involved in a criminal investigation of Joseph H. BUTLER, an ED,
Federal Student Aid (FSA) employee. The investigation is predicated on information provided
by the Computer Security Management Center (CSMC), which reported BUTLERs workstation
Q0001 was identified, within EDs network logs, searching for nude images of children. On
June 3, 2011, ED seized the hard drive from EDU40381 and provided that to TCD for analysis.
On July 16, 2011, TCD conducted a search warrant at BUTLERs home and seized several
items, to include data CDs. BUTLER also signed a consent form to allow TCD to search his
workplace cubicle and image his computer system.
TCD conducted an analysis of the seized media and these results are documented in TCD
Forensic Examination Request 618. Based on these findings, TCD Special Agents (b)(7)(C)
performed an additional analysis of specific information and data
(TCD Requests 671 and 672).
Examination of documents for Internet history artifacts
The Microsoft Word documents from Q0003B and Q0004B were examined and approximately
all URLs from the images which appeared to be potential child pornography were extracted
(Attachment 1) and a list of image file names was created from this list. (Attachment 2)
Examination of computer hard disk for Internet history and network artifacts
CSMC, in their security alert, identified the Department system as EDU403881 (Q0001), which
was assigned IP address 172.16.132.32. The primary user for this system was identified as Joe
Butler.
(b)(7)(E)
(b)(7)(E)
OIG-301A (11/06)
Page 2 of 4
10/06/2011
(b)(7)(E)
Correlation of Internet searches and history between documents, hard disk, and network logs
(b)(7)(E)
OIG-301A (11/06)
Page 3 of 4
10/06/2011
(b)(7)(E)
Attachments
1. (b)(7)(E)
2. (b)(7)(E)
3. (b)(7)(E)
4. (b)(7)(E)
5. (b)(7)(E)
6. (b)(7)(E)
7. (b)(7)(E)
OIG-301A (11/06)
Page 4 of 4

DATE:
October 6, 2011
PREPARED BY:
(b)(7)(C)
CASE TITLE:
Butler, Joseph
CASE NUMBER:
11-110339
REPORT RE:
Analysis of Microsoft Word Documents and other Files
TCD REQUEST #:
671
Special Agent
Request: Extract images and URLs from Microsoft Word documents and other files to identify
embedded images and originating URLs. Extract Microsoft Excel files from the subdirectory of
joe.butler My Documents folder which contains search terms for child nudity and
pornography.
Status: Pending.
Data Analyzed:
Q0001: Image of a Western Digital ATA WT026 WD800JD-75 hard drive, serial number
WMAM9CWW8889, approximately 80GB in size, located inside a Dell desktop
computer.
Q0002: Image of a Seagate Barracuda hard drive, serial number 5RW4FQE,
approximately 80GB in size, located inside a Dell desktop computer.
Q0003B: Image of a Memorex CD-RW, unmarked/unlabeled, approximately 700 MB in
size, seized from Butlers residence.
Date Prepared: October 6, 2011
(b)(7)(C)
Case No: 11-110339
This report does not constitute a forensic analysis report but simply documents preliminary findings or the basic retrieval of data
from digital evidence. This report may not contain all information needed for judicial proceedings and is provided as an aid to
the requestor. If data provided is likely to be used in judicial proceedings, please submit a request for a full forensic analysis and
identify the data of interest. Please contact the author of this document for any questions.
OIG-301A (11/06)
Page 1 of 4
Analysis of Microsoft Word Documents and Embedded Images
10/6/2011
Q0004B: Image of a Memorex CD-RW, unmarked/unlabeled, approximately 700 MB in

size, seized from Butlers residence.
Background
The US Department of Education (ED), Office of Inspector General (OIG), Technology Crimes
Division (TCD) became involved in a criminal investigation of Joseph H. BUTLER, an ED,
Federal Student Aid (FSA) employee. The investigation is predicated on information provided
by the Computer Security Management Center (CSMC), which reported BUTLERs workstation
Q0001 was identified, within EDs network logs, searching for nude images of children. On
June 3, 2011, ED seized the hard drive from EDU40381 and provided that to TCD for analysis.
On July 16, 2011, TCD conducted a search warrant at BUTLERs home and seized several
items, to include data CDs. BUTLER also signed a consent form to allow TCD to search his
workplace cubicle and image his computer system.
TCD conducted an analysis of the seized media and these results are documented in TCD
Forensic Examination Request 618. Based on these findings, TCD Special Agents (b)(7)(C)
(b)(7)(C)
performed an additional analysis of specific information and data
(TCD Requests 671 and 672).
Analysis
(b)(7)(E)
OIG-301A (11/06)
Page 2 of 4
10/6/2011
(b)(7)(E)
OIG-301A (11/06)
Page 3 of 4
10/6/2011
Q0003B Microsoft Word Documents

23 Word documents on Q0003B were identified as containing embedded images. Approximately
116 specific images were identified in those 23 Word documents to be potential child
pornography. (b)(7)(E)
(Attachment 4)
Q0004B Microsoft Word Documents
Seven (7) Word documents on Q0004 were identified as containing embedded images.
Approximately 74 specific images were identified in those seven (7) Word documents to be
potential child pornography. (b)(7)(E)
. (Attachment 5)
Attachments:
1.
2.
3.
4.
5.
(b)(7)(E)
(b)(7)(E)
(b)(7)(E)
(b)(7)(E)
(b)(7)(E)
OIG-301A (11/06)
Page 4 of 4

INFORMATION TECHNOLOGY AUDITS
AND COMPUTER CRIME INVESTIGATIONS
Technology Crimes Division
Digital Forensic Report

Request #618
11-110339
BUTLER, JOSEPH H.
Analysis of Butlers Media
December 1, 2011
_______________________________
(b)(7)(C)
Analyst
________________________________
Mark A. Smith
Special Agent in Charge
This report is the property of the Office of Inspector General and is loaned to your agency; it and its contents may not be r eproduced
without written permission. The report is FOR OFFICIAL USE ONLY and its disclosure to unauthorized persons is prohibited. Public
availability to be determined by 5 U.S.C. 552.
OIG Form 515 (1/10)
TCD Digital Forensic Report
Request #618
Request
On June 10, 2011, the Technology Crimes Division (TCD) received a request for assistance from Special Agent
(SA) (b)(7)(C)
pertaining to an analysis of media seized from Department of Education employee
Joseph H. Butler. The Office of Chief Information Officer (OCIO) seized a hard drive from Butlers work area on
June 3, 2011. Recordable media (CD-RWs) were seized on July 16, 2011, under the execution of a search
warrant at the Butler residence, 1 and an additional hard drive was seized from Butlers work area after Butler
consented to a search of his workplace on July 16, 2011.2 SA (b)(7)(C) requested a search of the seized hard
drives and media for content pertaining to potential child pornography or erotica. In addition, SA (b)(7)(C)
requested that graphics and files stored on the hard drives seized from Butlers work area be linked to the other
seized media found in Butlers home.
Summary
Files relevant to the investigation were located on all evidence items. The forensic images contained 1,498
graphic depictions of potential child pornography or erotica, each of which had a unique hash value. Files of
particular interest are those found in both the subjects Internet Explorer internet history records and the CD-RWs
found at the subjects residence. Relevant graphic depictions of potential child pornography or erotica are
provided with this report.
Evidence Analyzed
Q0001: Image of a Western Digital ATA WT026 WD800JD-75 hard drive, serial number WMAM9CWW8889,
approximately 80GB in size, located inside a Dell desktop computer.
Q0002: Image of a Seagate Barracuda hard drive, serial number 5RW4FQE, approximately 80GB in size, located
inside a Dell desktop computer.
Q0003B: Image of a Memorex CD-RW, unmarked/unlabeled, approximately 700 MB in size, seized from
Butlers residence.
Q0004B: Image of a Memorex CD-RW, unmarked/unlabeled, approximately 700 MB in size, seized from
Butlers residence.
Analytical Process
(b)(7)(E)
1
2
(b)(6), (b)(7)(C)
U.S. Department of Education, 61 Forsyth Street, Atlanta, GA 30303
FOR OFFICIAL USE ONLY
Page 2 of 7

DATE:
October 12, 2011
SUBJECT:
Synopsis of the Arrest of BUTLER
CASE AGENT:
(b)(7)(C)
ARREST LOCATION:
751 North Indian Creek Dr. Apt #108

Clarkston, GA 30021
REFERENCE:
BUTLER, Joseph H.
CASE NUMBER:
11-110339
Special Agent
On Tuesday October 11, 2011 at approximately 10:45 AM, Special Agent (b)(7)(C)
, U.S.
Department of Education (ED) Office of Inspector General (OIG) testified before a Federal
grand jury in the Northern District of Georgia. The Grand Jury issued a True Bill, indicting
Joseph BUTLER on 6 counts of possessing and receiving child pornography and obscene visual
depictions of children engaged in sexual activity. As a result of the Indictment an Arrest
Warrant was issued for BUTLER. BUTLER is an employee of Federal Student Aid, on unpaid
administrative leave, and resides at (b)(6), (b)(7)(C)
. (Attachments 1 & 2)
On Wednesday October 12, 2011 at approximately 11:30 AM, OIG SAs (b)(7)(C)
, Assistant Special Agents in Charge (ASAC) (b)(7)(C)
attended an Arrest Warrant briefing, for BUTLER, at 61 Forsyth St. Atlanta, GA. In
addition to the information at the meeting, a copy of the approved Operation Plan (OIG Form
374), arrest warrant and indictment were provided to all participating Agents. (Attachment 3)
The Arrest team, ((b)(7)(C)
) departed 61 Forsyth and drove to
BUTLERs residence. At approximately 12:40 PM, SA (b)(7)(C) met with the (b)(7)(C)
. During this meeting, SA (b)(7)(C) was informed that
BUTLER still resided in apartment
, and the (b)(7)(C)
voluntarily provided a
master key to BUTLERs apartment.
(b)(6), (b)(7)(C)
(b)(7)(C)
Case No: 11-110339
OIG-301 (11/06)
Page 1 of 4
Case No: 11-110339
During SA (b)(7)(C) s meeting with the (b)(7)(C)

, ASAC (b)(7)(C) met with Police
Officers from the DeKalb County Police Department (DCPD), who agreed to assist OIG SAs
with the arrest.
At approximately 12:45 PM, OIG SAs attempted to execute the Arrest Warrant. SA (b)(7)(C)
knocked on the door of 108 and announced Police, Arrest Warrant, Open the door! This was
repeated several times. After receiving no response from BUTLER, ASAC (b)(7)(C) instructed
SA (b)(7)(C) to enter the house. This entry was based on the facts that BUTLER did not own a
vehicle and had previously told SAs during his initial interview that he rarely traveled or left his
residence; he described himself as a loner, who went to work and church and rarely anywhere
else. BUTLER was on unpaid administrative leave, so there was reason to believe he would be
at his residence.
Using the key provided by the (b)(7)(C)
, SA (b)(7)(C) unlocked the front door and
(b)(7)(C)
entered the residence. OIG SAs
((b)(7)(C) remained outside) and
DCPD officers entered the residence, but did not locate BUTLER. SAs and officers immediately
that
exited the residence and locked the door. SA (b)(7)(C) informed the (b)(7)(C)
OIG SAs had not located BUTLER and the (b)(7)(C)
stated OIG SAs could keep the
key until BUTLER was arrested.
At approximately 1:15 PM, OIG SAs also attempted to locate BUTLER at the nearby public
library, BUTLERs storage unit, a local drug store and his church. DCPD volunteered to
dispatch a BOLO for BUTLER.
At approximately 3:30 PM, OIG SAs again attempted to execute the Arrest Warrant at Butlers
residence. SA Campbell knocked on the door and announced Police, Arrest Warrant, Open the
door! After about 30 seconds of knocking, SAs (b)(7)(C)
heard movement from
inside the house and alerted ASAC (b)(7)(C). SA (b)(7)(C) moved to the back of the designated
rental vehicle to see if he could see into the upstairs window. SA (b)(7)(C) again announced
Police, Arrest Warrant, Open the Door. This time SA (b)(7)(C) added Joe we hear you
inside, come out or we are going to come in! At this time, the movement from within the
residence ceased.
At the time of entry, SAs (b)(7)(C)
and ASAC (b)(7)(C) were outside the front door and
(b)(7)(C)
SA
was at the rear of the apartment building. SA (b)(7)(C) used the key provided and
opened the door to BUTLER's residence. SA (b)(7)(C) announced "Police, Arrest Warrant, let
me see your hands." SA (b)(7)(C) immediately noticed two bags of groceries sitting on the floor
next to the front door, which were not present during the first entry. As SA (b)(7)(C) walked
past the kitchen, he heard movement on the stairwell around the corner. SA (b)(7)(C) again
announced, "Police, let me see your hands." BUTLER emerged from the stairwell and raised his
hands. ASAC (b)(7)(C) pulled him from the residence and conducted a search incident to arrest.
No additional occupants were identified in the residence.
(b)(7)(C)
Case No: 11-110339
OIG-301 (11/06)
Page 2 of 4
Case No: 11-110339
A wallet and other personal items were located on BUTLER. All of these items, except for
BUTLER's bus pass were returned to BUTLER's residence.
BUTLER was handcuffed behind his back, using two sets of handcuffs, due to his inability to
comfortably sit for an extended amount of time with only one set of handcuffs securing his
hands. SA (b)(7)(C) informed BUTLER that he was indicted by a Federal Grand Jury. SA
(b)(7)(C) stated to BUTLER that while SAs would not ask him any questions, he would still be
read him his Miranda Rights. SA (b)(7)(C) advised BUTLER of his rights, by reading off of
OIG Form 356 (Attachment 4). BUTLER was unable to sign this form due to hands being
restrained behind his back, but verbally acknowledged he understood his rights. BUTLER was
told it was a 30-minute ride to the Atlanta City Detention Center (ACDC), and the SAs would
not question him regarding his charges.
(b)(6), (b)(7)(C)
. These items were
inventoried (Attachment 5).
SAs locked the residence prior to departing and looked to see if there was any damage to the
residence during the entry and arrest. No damage was identified.
BUTLER was placed in the rear passenger side of the transport vehicle and his seat belt was
secured around his body. SA (b)(7)(C) drove, SA (b)(7)(C) was in the front passenger side of the
vehicle and ASAC (b)(6), (b)(7)(C) was in the rear of the vehicle with BUTLER.
At approximately 4:00 PM, the SAs returned the key to the (b)(7)(C)
and then
BUTLER was transported to the ACDC; arriving at approximately 4:30 PM. ASAC (b)(7)(C) held
up a copy of BUTLERs indictment, after he stated he didnt want ASAC (b)(7)(C) to read it
aloud, but he wanted to read it to himself. During the arrest and transport, BUTLER made no
statements, nor was asked to make any statements related to the charges. ASAC (b)(7)(C) asked
BUTLER several times if he was comfortable and BUTLER stated he was ok.
At approximately 4:30 PM, BUTLER was processed into ACDC. (b)(6), (b)(7)(C)
were turned over to the ACDC Federal Intake
Officer on duty.
On Thursday, October 13, 2011 at approximately 9:15 AM, SAs (b)(7)(C)
and ASAC
arrived at the ACDC to transport BUTLER to the USMS facility for booking
(Attachment 6), prior to his arraignment. The SAs ensured that BUTLERs belongings were
secured and they too were transported.
(b)(7)(C)
(b)(7)(C)
Case No: 11-110339
This report is the property of the Office of Investigation Services and is loaned to your agency; it and its contents may not be
OIG-301A (11/06)
Page 3 of 4
Case No: 11-110339
At approximately 10:00 AM, SAs (b)(7)(C)

and ASAC (b)(7)(C) arrived at the USMS
facility at the Russell Federal Building, located at 75 Spring St., Atlanta, Georgia. BUTLER was
turned over to the custody of the USMS and they informed the SAs that they would not allow
. SA (b)(7)(C) agreed to secure these
BUTLER to keep his (b)(6), (b)(7)(C)
items.
At approximately 3:15 PM, SAs (b)(7)(C)
transported BUTLER from the
18th floor holding cell at the Russell Federal Building to the courtroom of U.S. Magistrate Court
Judge Linda T. Walker, where he was arraigned on the charges and remanded to the custody of
the USMS until trial. SA (b)(7)(C) provided BUTLERs belongings to his Public Defender,
who was appreciative of bringing the (b)(6), (b)(7)(C) along with BUTLER during the transport.
Attachments
1. Criminal Indictment (1:11-CR-470), dated 10/11/2011
2. Arrest Warrant, dated 10/11/2011
3. Arrest Warrant Operation Plan
4. OIG Form 356, dated 10/12/2011
5. Inventory of Personal Effects, signed by SA (b)(7)(C)
6. USMS Booking Photograph, dated 10/13/2011
(b)(7)(C)
Case No: 11-110339
OIG-301 (11/06)
Page 4 of 4
IN THE UNITED STATES DISTRICT COURT
FILED IN CHAMBERS
U.SD.C. Atlanta
FOR THE NORTHERN DISTRICT OF GEORGIA
OCT 1 1 1011
ATLANTA DIVISION
JAMES N. HADEN, Clerk
By: (l;i/
Deputy Clerk
UNITED STATES OF AMERICA

CRIMINAL IND I CTMENT
v.
NO.
JOSEPH BUTLER
l l - CE - 470
THE GRAND JURY CHARGES THAT,
COUNT ONE
Beginning on a date unknown to the Grand Jury and continuing
to on or about June 2,
2011, in the Northern District of Georgia,
defendant JOSEPH BUTLER knowingly received child pornography using
facility of
interstate and foreign commerce,
Title 18, United States Code,
in violation of
Section 2252A (a ) ( 2 ) (A) .
COUNT TWO
On or about June 2, 2011, in the Northern District of Georgia,
defendan t
JOSEPH
BUTLER
know ing ly
possessed
containing images of child pornography

shipped and
using
computer
said images having been
transported in interstate and foreign
facility
of
interstate
and
files
foreign
commerce and
commerce,
all
in
violation of Title 18, United States Code, Section 2252A(a) (5) (Bl .
COUNT THREE
On
or
about
July
16,
2011,
in
the
Northern
District
of
Georgia, defendant J OSEPH BUTLER knowingly possessed computer files

c ontaining images of
child pornography,
said images having been
shipped and transported in interstate and foreign commerce and

using
facility
of
interstate
and
foreign
commerce,
all
in
violation of Title 18, United States Code, Section 2252A(a) (5) (B) .
COUNT FOUR
Beginning on a date unknown to the Grand Jury and continuing
to on or about June 2, 2011, in the Northern District of Georgia,
defendant JOSEPH BUTLER, using a facility of interstate a nd foreign
commerce,
knowingly received obscene visual depictions of minors
engaging in sexually explicit conduct, in violation of Title 18,

United States Code, Section 1466A(a ) (1 ) .
COUNT FIVE
On or about June 2, 2011, in the Northern Di s t r ict of Georgia,
defendant
JOSEPH
BUTLER
knowingly
possessed
obscene
visual
depictions of minors engaging in sexually explicit conduct,
said
depictions having been shipped and transported in interstate and

for.eign commerce and using a
facility of interstate and foreign
commerce, all in violation of Title 18, United States Code , Section

1466A(b) (1).
COUNT SIX
On
or
about
July
16,
2011,
in
the
Northern
District
of
Georgia, defendant JOSEPH BUTLER knowingly possessed obscene visual

depictions of minors engaging in sexual ly explicit conduct,
said
depictions having been shipped and transported in interstate and

foreign commerce and using a
facility of interstate and foreign
Minute Sheet
1 of 1
https://ecf.gand.circ11.dcn/cgi-bin/atl_mkminCR2.pl
Case 1:11-cr-00470-TWT-GGB Document 15
Filed 12/21/11 Page 1 of 1
1:11-cr-00470-TWT-GGB
USA v. Butler
Honorable Thomas W. Thrash, Jr.
Minute Sheet for proceedings held In Open Court on 12/21/2011.
TIME COURT COMMENCED: 2:10 P.M.

TIME COURT CONCLUDED: 2:35 P.M.
TIME IN COURT: 0:25
OFFICE LOCATION: Atlanta
DEFENDANT(S):
ATTORNEY(S)
PRESENT:
PROCEEDING
CATEGORY:
PLEADINGS FILED
IN COURT:
MINUTE TEXT:
HEARING STATUS:
ADDL HEARING(S)
SCHEDULED:
COURT REPORTER: Susan Baker

DEPUTY CLERK: Sheila Sewell
[1]Joseph Butler Present at proceedings

Nicole Kaplan representing Joseph Butler
Robert McBurney representing USA
Change of Plea;
Plea Agreement. Notice of Sentence Date.
Defendant informed of (his/her) rights. Defendant enters plea of
GUILTY counts 1. Limited Waiver of Appeal contained in the plea
agreement. Copies of Notice of Sentence Date to counsel, defendant,
USM, USPO. Government to dismiss remaining counts at sentencing.
Hearing Concluded
Sentencing Hearing set for 2/28/12 at 10:00 a.m. in Courtroom 2108;
12/21/2011 3:06 PM
Case 1:11-cr-00470-TWT-GGB Document 15-1
on his behalf. The Defendant could also elect to testify. If, however, the Defendant
did not wish to testify, that fact could not be used against him, and the Government
could not compel him to incriminate himself. If the Defendant were found guilty
after a trial, he would have the right to appeal his conviction.
3. The Defendant understands that, by pleading guilty, he is giving up all of
these rights and that there will not be a trial of any kind. By pleading guilty, the
Defendant also gives up all rights to pursue any affirmative defenses, Fourth and
Fifth Amendment claims, and other pretrial motions that have been filed or could
have been filed.
4. Finally, the Defendant understands that, for the Court to accept his guilty
plea, he may have to answer, under oath, questions posed to him by the Court
concerning the rights he is giving up and the facts of his case. The Defendant
acknowledges that his answers, if untruthful, may later be used against him in a
prosecution for perjury or false statements.
III. ACKNOWLEDGMENT OF PENALTIES
5. The Defendant understands that, based on his plea of guilty, he will be
subject to the following maximum and mandatory minimum penalties:
(a)
Maximum term of imprisonment: 20 years
(b)
Mandatory minimum term of imprisonment: five years.
(c)
Term of supervised release: five years to life.
(d)
Maximum fine: $250,000.
(e)
Full restitution to all victims of the offense(s) and relevant conduct.
(f)
Mandatory special assessment: $100.
(g)
Forfeiture of any and all proceeds from the commission of the offense
and any and all property used to facilitate the offense.
The Defendant understands that, before imposing sentence in this case, the Court
shall consider, among other factors, the provisions of the United States Sentencing
Guidelines and that the Court has the discretion to depart or vary from those
Guidelines.
IV. PLEA AGREEMENT
6. The Defendant, his counsel, and the United States Attorney for the
Northern District of Georgia (lithe Government"), as counsel for the United States,
have reached a negotiated plea in this case, the terms of which are set forth in the
subsequent paragraphs of this document for the Court's consideration and approval.
A. Factual Basis
7.
The Defendant acknowledges that the Government could prove by
admissible evidence and beyond a reasonable doubt the following facts:

(a)
the Defendant's collection of child pornography -- meant throughout

this document to include both sexually explicit images of minors and
obscene visual depictions of minors engaging in sexually explicit
conduct -- contained images of pre-pubescent minors;
(b)
the Defendant's collection of child pornography contained images

legally defined as sadistic;
(c)
the Defendant used an internet-connected computer to receive child

pornography; and
(d)
the Defendant's collection of child pornography exceeded 600 images

in size.
B. Sentencing Recommendations
8. The Government will recommend that the Defendant receive the two-level
adjustment for acceptance of responsibility pursuant to Section 3El.l of the
Sentencing Guidelines, and the additional one-level adjustment if the offense level
3
is 16 or higher. However, the Government will not be required to recommend

acceptance of responsibility if, after entering this Plea Agreement, the Defendant
engages in conduct inconsistent with accepting responsibility. Thus, by way of
example only, should the Defendant falsely deny or falsely attempt to minimize
Defendant's involvement in relevant offense conduct, give conflicting statements
about Defendant's involvement, or participate in additional criminal conduct,
incl uding unlawful personal use of a controlled substance, the Government will not
be required to recommend acceptance of responsibility.
9. Because the Defendant promptly entered a plea of guilty and thereby
conserved limited judicial and prosecutorial resources, the parties further agree to
recommend that the Defendant receive a one-level downward variance. (There may
be additional requests or motions for variances or departures at sentencing. This
paragraph merely documents the agreement between the parties as to a one-level
downward variance resulting from the Defendant's prompt plea.)
c. Forfeiture
10. The Defendant agrees to forfeit, waive and abandon all right, claim, and
interest in any of the property seized by law enforcement in this District in this case,
and further agrees that the United States Department of Education, Office of
Inspector General, may use, sell, destroy or otherwise dispose of such property as
said agencies see fit.
D. Restitution
11. The Defendant agrees to pay full restitution to all victims of the offense
to which he is pleading guilty as well as all relevant conduct, including, but not
limited to, any counts dismissed as a result of this Plea Agreement. The Defendant
understands that the amount of restitution owed to any victims will be determined
at or before sentencing. The Defendant also agrees to cooperate fully in the
4
investigation of the amount of restitution and identification of victims.

E. Additional Waivers
12.
Appeals.
To the maximum extent permitted by federal law, the
Defendant voluntarily and expressly waives the right to appeal his conviction and
sentence and the right to collaterally attack his conviction and sentence in any post
conviction proceeding (including, but not limited to, motions filed pursuant to 28
U.S.C. 2255) on any ground, except that the Defendant may file a direct appeal of
an upward departure or variance from the applicable sentencing guideline range as
determined by the Court at sentencing. The Defendant understands that this Plea
Agreement does not limit the Government's right to appeal, but if the Government
does appeal, the Defendant may file a cross-appeal.
13. FOIA/Privacy Act. The Defendant hereby waives all rights, whether
asserted directly or by a representative, to request or receive from any department
or agency of the United States any records pertaining to the investigation or
prosecution of this case, including, without limitation, any records that may be
sought under the Freedom of Information Act, Title 5, United States Code, Section
552, or the Privacy Act of 1974, Title 5, United States Code, Section 552a.
F. Dismissal of Counts
14. The Government agrees that, upon the entry of the Judgment and
Commitment Order, all remaining counts in the above-styled case shall be dismissed
pursuant to Standing Order No. 07-04 of this Court and to Rule 48(a) of the Federal
Rules of Criminal Procedure. The Defendant understands that the Probation Office
and the Court may still consider the conduct underlying any dismissed counts in
determining relevant conduct under the Sentencing Guidelines and a reasonable
sentence under Title 18, United States Code, Section 3553(a).
G. Sex Offender Registry

15. The Defendant understands that by pleading guilty, he will be required
to register as a sex offender upon his release from prison as a condition of
supervised release pursuant to 18 U.s.C. 3583(d). The Defendant also understands
that, independent of supervised release, he will be subject to federal and state sex
offender registration requirements, and that those requirements may apply
throughout his life. The Defendant understands that he shall keep his registration
current, shall notify the state sex offender registration agency or agencies of any
changes to his name, place of residence, employment, or student status, or other
relevant information. The Defendant shall comply with requirements to periodically
verify in person his sex offender registration information.
The Defendant
understands that he will be subject to possible federal and state penalties for failure
to comply with any such sex offender registration requirements. If he resides in
Georgia following release from prison, he will be subject to the registration
requirements of O.C.G.A. 42-1-12 and related provisions. The Defendant further
understands that, under 18 U.s.C. 4042(c), notice will be provided to certain law
enforcement agencies upon his release from confinement following conviction.
H. Miscellaneous Provisions
16. The parties reserve the right to inform the Court and the Probation Office
of all facts and circumstances regarding the Defendant and this case, and to respond
to any questions from the Court and the Probation Office and to any misstatements
of fact or law. Except as expressly stated elsewhere in this Plea Agreement, the
parties reserve the right to make recommendations regarding application of the
Sentencing Guidelines.
17.
The Defendant understands and agrees that the Government's
recommendations incorporated within this Agreement or otherwise discussed

6

Page 1 of 5
UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF GEORGIA
ATLANTA DIVISION
UNITED STATES OF AMERICA

-vs-
Case No. 1:11cr470-TWT
JOSEPH BUTLER
Defendants Attorney
Nicole M. Kaplan
JUDGMENT IN A CRIMINAL CASE

(For Offenses Committed On or After November 1, 1987)
The defendant pleaded guilty to Count(s) 1 of the Indictment.
Accordingly, the defendant is adjudged guilty of such count(s) which involves the following offense:
Title & Section
Nature of Offense
Count No.
18 USC 2252(a)(2)(A)
Receipt of child pornography
The defendant is sentenced as provided in pages 2 through 5 of this judgment. The sentence is imposed
pursuant to the Sentencing Reform Act of 1984.
Count(s) remaining are dismissed on the motion of the United States.
It is ordered that the defendant shall pay the special assessment of $100.00 which shall be due immediately.
IT IS FURTHER ORDERED that the defendant shall notify the United States attorney for this district within
thirty days of any change of name, residence, or mailing address until all fines, restitution, costs and special
assessments imposed by this judgment are fully paid.
(b)(6), (b)(7)(C)
Defendants Soc. Sec. No.

XXX-XX
(b)(6), (b)(7)(C)
Defendants Date of Birth:
Defendants Mailing Address:
Robert A. Deyton Detention Facility
11866 Hasatings Bridge Road
Lovejoy, Georgia 30250
Date of Imposition of Sentence: March 21, 2012
Signed this the 22nd day of March, 2012.
/s/Thomas W. Thrash
THOMAS W. THRASH
UNITED STATES DISTRICT JUDGE
1:11cr470-TWT : JOSEPH BUTLER
Page 2 of 5
IMPRISONMENT
The defendant is hereby committed to the custody of the United States Bureau of Prisons to be imprisoned
for a term of 120 months.
The defendant is remanded to the custody of the United States Marshal.
The Court makes the following recommendations to the Bureau of Prisons: That the defendant be designated
to a facility which meets Bureau of Prisons criteria, that is closest to the defendants brother in South Carolina
RETURN
I have executed this judgment as follows:
Defendant delivered on
at
to
, with a certified copy of this judgment.
UNITED STATES MARSHAL
By:
Deputy U. S. Marshal
Page 3 of 5
SUPERVISED RELEASE
Upon release from imprisonment, the defendant shall be on supervised release for a term of five (5) years.
While on supervised release, the defendant shall not commit another federal, state or local crime and shall
not illegally possess a controlled substance. The defendant shall comply with the standard and special
conditions that have been adopted by this court (set forth below). If this judgment imposes a restitution
obligation, it shall be a condition of supervised release that the defendant pay any such restitution that remains
unpaid at the commencement of the term of supervised release. The defendant shall comply with the
following additional conditions:
The defendant shall report in person to the probation office in the district to which the defendant is released
within 72 hours of release from the custody of the Bureau of Prisons.
Pursuant to 41 USC 14135a(d)(1) and 10 USC 1565(d), which requires mandatory DNA testing for federal
offenders convicted of felony offenses, the defendant shall cooperate in the collection of DNA as directed by
the probation officer. The defendant shall participate in the mental health aftercare program including a
psychosexual evaluation and counseling if deemed necessary and comply with the conditions of the sex
offender contract under the guidance and supervision of the U. S. Probation Officer. If able, the defendant
shall be required to contribute to the cost of services for such treatment.
The defendant shall not own, possess or have under his/her control any firearm, dangerous weapon or other
destructive device.
Pursuant to 18 U.S.C. 3583(d), the defendant shall submit his/her person, and any property, house,
residence, vehicle, papers, computer, other electronic communication or data storage devices or media, and
effects, to search at any time, with or without a warrant, by any law enforcement or probation officer with
reasonable suspicion concerning a violation of a condition of probation or unlawful conduct by the defendant,
and by any probation officer in the lawful discharge of the officers supervision functions.
The defendant shall participate in the mental health aftercare program including a psychosexual evaluation
and counseling if deemed necessary and comply with the conditions of the sex offender contract under the
guidance and supervision of the U. S. Probation Officer.
The defendant shall permit confiscation and/or disposal of any material considered contraband or any other
item which may be deemed to have evidentiary value related to violations of supervision.
The defendant shall register himself as a sex offender with the local police, local sheriff, and state police in
whatever jurisdiction he may reside upon release from imprisonment. He shall register at each new agency
and jurisdiction if he changes residences.
Page 4 of 5
STANDARD CONDITIONS OF SUPERVISION

While the defendant is on supervised release pursuant to this judgment, the defendant shall not commit
another federal, state or local crime. In addition:
1.
The defendant shall not leave the judicial district without the permission of the court or probation
officer;
2.
The defendant shall report to the probation officer as directed by the court or probation officer and
shall submit a truthful and complete written report within the first five days of each month;
3.
The defendant shall answer truthfully all inquiries by the probation officer and follow the instructions
of the probation officer;
4.
The defendant shall support his or her dependents and meet other family responsibilities;
5.
The defendant shall work regularly at a lawful occupation unless excused by the probation officer for
schooling, training, or other acceptable reasons;
6.
The defendant shall notify the probation officer within 72 hours of any change in residence or
employment;
7.
The defendant shall refrain from the excessive use of alcohol and shall not purchase, possess, use,
distribute, or administer any narcotic or other controlled substance, or any paraphernalia related to
such substances, except as prescribed by a physician, and shall submit to periodic urinalysis tests
as directed by the probation officer to determine the use of any controlled substance;
8.
The defendant shall not frequent places where controlled substances are illegally sold, used,
distributed, or administered;
9.
The defendant shall not associate with any persons engaged in criminal activity, and shall not
associate with any person convicted of a felony unless granted permission to do so by the probation
officer;
10.
The defendant shall permit a probation officer to visit him or her at any time at home or elsewhere and
shall permit confiscation of any contraband observed in plain view by the probation officer;
11.
The defendant shall notify the probation officer within 72 hours of being arrested or questioned by a
law enforcement officer;
12.
The defendant shall not enter into any agreement to act as an informer or a special agent of a law
enforcement agency without the permission of the court;
13.
As directed by the probation officer, the defendant shall notify third parties of risks that may be
occasioned by the defendants criminal record or personal history or characteristics, and shall permit
the probation officer to make such notifications and to confirm the defendants compliance with such
notification requirement.


Page 5 of 5
FINE
The Court finds that the defendant does not have the ability to pay a fine and cost of incarceration. The Court
will waive the fine and cost of incarceration in this case.
UNIT
TED STAT
TES DEPA
ARTMEN
NT OF ED
DUCATIO
ON
OFFIC
CE OF INS
SPECTOR
R GENERA
AL
TECH
HNOLOGY
Y CRIMES
S DIVISIO
ON
DATE:
April 30
0, 2012
RED BY:
PREPAR
(b)(7)(C)
Special Agent
A
CASE TITLE:
T
Joseph BUTLER
B
CASE NUMBER:
N
11-110339
REPORT RE:
Destructtion of Evideence
(b)(7)(C)
(b)(7)(C)
(b)(7)(C)
(b)(7)(C) , after con
On Marcch 27, 201 Assistant Unitted States Atttorney
nsultation with
BUTLER
Rs Defense Counsel agrreed to the destruction off evidence oobtained from
m BUTLERs
home. Per the defensse counsel and
a BUTLER
R, they did nnot want the evidence retturned or
d to BUTLER
Rs family.
provided
On Aprill 24, 2012 th

he reporting agent
a
witnesssed all of thhe evidence bbeing shreddded at C.W.
Austin Company,
C
Au
ustell, GA 30
0168. The in
nvoice numbber for the ddestruction iss 12DD1184.
Date Preparred: April 30, 20

012
(b)(7)(C)
Case No: 11-1110339
This report is the property

y of the Office of
o Inspector Geeneral and is loaaned to your aggency; it and itss contents may not be
n permission. The
T report is FOR OFFICIAL
L USE ONLY and its disclossure to unauth
horized
reproduced without written
persons is prohibited.
p
Pub
blic availability
y to be determin
ned by 5 U.S.C. 552.
OIG-301A (11/06)
(
Pagee 1 of 1
Prosecutive Status
Declined Crininal Action
Index Name
(b)(6), (b)(7)(C)
Declined Date
(b)(6), (b)(7)(C)
Declined Reason
(b)(7)(E)
Declined Attorney Code
US Attorney
Declined Assistant Attorney
(b)(7)(C)
Declined Venue
(b)(6), (b)(7)(C)
This report is the property of Office of Investigation Services and is loaned to your agency; it and its contents may not be reproduced
availability to be determined by 5 U.S.C.552
Page 4 of 5
Attachments (all attachments from documents)
DOCUMENT FILENAME
Referral Cover Letter_20140210.pdf_(b)(6), (b)(7)(C)

(b)(6), (b)(7)(C) Referral Report_20140210.pdf_(b)(6),
(b)(7)(C)
(b)(6), (b)(7)(C)
This report is the property of Office of Investigation Services and is loaned to your agency; it and its contents may not be reproduced
availability to be determined by 5 U.S.C.552
Page 5 of 5
UNITED STATES
DEPARTMENT OF EDUCATION

(b)(6), (b)(7)(C)
ADMINISTRATIVE REFERRAL
(b)(6), (b)(7)(C)
TABLE OF CONTENTS
Section A..
Section B..
Section C..
Section D..
Section E..
(b)(6), (b)(7)(C)
SUMMARY
BACKGROUND
INVESTIGATION
INDIVIDUALS
ATTACHMENTS
(b)(6), (b)(7)(C)
Name of Reporting Agent
Name of Approving Official
Signature
Signature
Date
Date
-OFFICIAL USE ONLY-
The above activities violated 18 U.S.C. 1001, False statements; various sections of 5 C.F.R. Part
2635, Standards of Ethical Conduct for Employees of the Executive Branch; Office of the Chief
Information Officer (OCIO) Departmental Directive 1-104: Personal Use of Government
Equipment and Information Resources; and other standards specified in the report.
SECTION B BACKGROUND
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
.
-OFFICIAL USE ONLY-
Page 3
interviewed (b)(6), (b)(7)(C) on (b)(6), (b)(7)(C) (Attachment 6). (b)(6), (b)(7)(C) read and
signed the Acknowledgement of Rights for Federal Employees (Garrity warning). (b)(6), (b)(7)(C)
voluntarily made statements and provided a signed sworn affidavit to (b)(6), (b)(7)(C) interviewed
(b)(6), (b)(7)(C) a second time on (b)(6), (b)(7)(C) (Attachment 7). (b)(6), (b)(7)(C) read and signed
the Acknowledgement of Rights and Obligations for Federal Employees (Kalkines warning).
(b)(6), (b)(7)(C) made statements and provided a signed sworn affidavit to
.
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
SECTION C INVESTIGATION
Section I: (b)(6), (b)(7)(C), non-responsive
Outside Employment
Use of Government Resources for
review of email sent and received from (b)(6), (b)(7)(C)s government assigned email
address, (b)(6), (b)(7)(C) @ed.gov, revealed that
(Attachment 8). (b)(6), (b)(7)(C)
.
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
-OFFICIAL USE ONLY-
Page 4
(b)(6), (b)(7)(C)
admitted to using
Department resources including government time, phone, email, scanner, copier, and laptop for
his outside employment with (b)(6), (b)(7)(C) . He acknowledged he should not have used government
equipment for outside employment.
(b)(6), (b)(7)(C)
-OFFICIAL USE ONLY-
Page 5
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
-OFFICIAL USE ONLY-
Page 6
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
.
(b)(6), (b)(7)(C)
-OFFICIAL USE ONLY-
Page 8
(b)(6), (b)(7)(C)
.
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
.
(b)(6), (b)(7)(C)
.
Misuse of Government Resources
The Departmental Directive Office of the Chief Information Officer (OCIO): 1-104, Personal
Use of Government Equipment and Information Resources, specifies the limited circumstances
under which employees may use government equipment and information resources for other than
office business. The Standards of Ethical Conduct require that each employee use government
equipment and information resources only for authorized uses. The Department permits
occasional personal use of government equipment and information resources, including facsimile
-OFFICIAL USE ONLY-
Page 9
machines, computers, photocopiers, telephones, printers, wireless devices, electronic mail, and
electronic services, provided that such use:
Incurs only a negligible additional expense, if any, to the Department;

Does not impede that employees or other employees ability to do their job;
Occurs during off-duty hours (off-duty hours are the periods of time when an employee is
not expected to be working, such as during a lunch break or before and after scheduled
work hours), whenever possible; and
Is not for the purpose of generating income for the employee or another individual (i.e.,
the employee is not using the equipment in connection with an initiative intended to make
money).
voluntarily admitted to using his

government scanner, printer, phone, and email for his employment with
(Attachment
6). He admitted he sent emails about (b)(6), (b)(7)(C) during on-duty hours. (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
. He stated
he made copies using the office copier. He sometimes used his government phone and email.
(b)(6), (b)(7)(C)
.
Email
(b)(6), (b)(7)(C)
Their communication was primarily

through (b)(6), (b)(7)(C)s government email.
was surprised that (b)(6), (b)(7)(C) used his
government email to communicate about (b)(6), (b)(7)(C) . (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
They thought it was surprising since (b)(6), (b)(7)(C) had

restrictions on outside activities. They thought the federal government would have similar rules.
The Technology Crimes Division provided email for (b)(6), (b)(7)(C) @ed.gov to (b)(6), (b)(7)(C)
reviewed (b)(6), (b)(7)(C)s email and identified email related to his outside employment with
(Attachment 28). During the period of (b)(6), (b)(7)(C)
the
review found 238 emails related to (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
.
Further, the review revealed (b)(6), (b)(7)(C) used his government email to (b)(6), (b)(7)(C)
(Attachment 29). The review showed that for the period (b)(6), (b)(7)(C)
sent or received approximately 60 emails related to (b)(6), (b)(7)(C)
.
-OFFICIAL USE ONLY-
Page 10
The review revealed (b)(6), (b)(7)(C) conducted (b)(6), (b)(7)(C)

government email (Attachment 30). (b)(6), (b)(7)(C)
using his
(Attachment 6).
Government Laptop
completed an examination of (b)(6), (b)(7)(C)s government computer,
(Attachment 31). The examination located various documents related to (b)(6), (b)(7)(C)
. The examination also located email communication
(b)(6),
(b)(7)(C)
involving
s government email and (b)(6), (b)(7)(C). The documents associated with
(b)(6), (b)(7)(C) were located in email or within the (b)(6), (b)(7)(C)
user profile. The metadata
indicated a Department profile created or modified the documents. The examination located
spreadsheets titled, (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
(Attachment
32).
The examination revealed (b)(6), (b)(7)(C) used USB devices, which appeared, based on
document titles, to contain documents related to (b)(6), (b)(7)(C) . In his interview, (b)(6), (b)(7)(C)
voluntarily admitted to using a personal USB device to transfer documents from his personal
computer to his government computer (Attachment 6).
Government Phone
A review of (b)(6), (b)(7)(C) s government phone logs for (b)(6), (b)(7)(C) revealed there were 144
calls between (b)(6), (b)(7)(C) and (b)(6), (b)(7)(C)
(Attachment 33). (b)(6), (b)(7)(C) placed 104 of the calls to
, but abandoned 14
of the calls before someone answered. The total duration of calls was approximately 5 hours and
41 minutes.
(b)(6), (b)(7)(C)
Government Time
obtained copies of (b)(6), (b)(7)(C)s time and attendance records for Calendar Year
, and created a comprehensive spreadsheet of his time and attendance
(Attachment 34). (b)(6), (b)(7)(C) did not complete a comprehensive analysis of all of (b)(6), (b)(7)(C) s
outside activities compared to his submitted time.
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
conducted analysis of (b)(6), (b)(7)(C)s activity associated with (b)(6), (b)(7)(C)s personal
cell phone number (b)(6), (b)(7)(C) (Attachment 35). In response to a subpoena, Verizon
(b)(6), (b)(7)(C)
-OFFICIAL USE ONLY-
Page 11
Wireless provided records from (b)(6), (b)(7)(C)

and the analysis focused on calls between (b)(6), (b)(7)(C)
comparing the phone log to (b)(6), (b)(7)(C), (b)(7)(E)
. After
The analysis revealed there were approximately 166 calls totaling 616 minutes or
approximately 10 hours of calls during on-duty hours. The analysis estimated (b)(6), (b)(7)(C), (b)(7)(E)s
calls (b)(6), (b)(7)(C), (b)(7)(E)
cost the government approximately
$478.36 based on his hourly salary. (b)(6), (b)(7)(C), (b)(7)(E)
.
(b)(6), (b)(7)(C), (b)(7)(E)
. The
analysis revealed that there were approximately 117 calls totaling 453 minutes or approximately
9 hours that occurred during on-duty hours. The analysis estimated (b)(6), (b)(7)(C)s calls on his
personal cell phone between (b)(6), (b)(7)(C)
cost the government approximately $363.41
based on his hourly salary. (b)(6), (b)(7)(C), (b)(7)(E)
.
An (b)(6), (b)(7)(C)
employee training profile revealed (b)(6), (b)(7)(C) received the
following training (Attachment 37):
- Information Security System Awareness (Department)
- Specialized IT Security Training (Department)
(b)(6), (b)(7)(C) - Ethics Training (Department)
(b)(6), (b)(7)(C) - IT Security Awareness Training (Department)
(b)(6), (b)(7)(C)
- ED Cyber Security & Privacy Awareness Training 2012 (Department)
(b)(6), (b)(7)(C)
- Ethics Training 2012 (Department)
(b)(6), (b)(7)(C) - Ethics Training (
)
(b)(6), (b)(7)(C) - IT Security Awareness 2013 (Department)
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
compiled a sample of daily activities that reflect (b)(6), (b)(7)(C)s various activities and
use of government resources. Based on (b)(6), (b)(7)(C)s admissions, the reporting agent does not
suspect anyone other than (b)(6), (b)(7)(C) of using his government email, phone number, and the
government scanner regarding (b)(6), (b)(7)(C) activities. Therefore, the
described emails and
phone calls made and received by (b)(6), (b)(7)(C) rather than as activity occurring on
(b)(6), (b)(7)(C)s government email and phone.
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
Unless otherwise specified, (b)(6), (b)(7)(C) completed the actions through his government email,
(b)(6), (b)(7)(C) @ed.gov, and phone number, (b)(6), (b)(7)(C) . (b)(6), (b)(7)(C)s personal cell
phone is (b)(6), (b)(7)(C) (Attachment 36a). (b)(6), (b)(7)(C)
.
-OFFICIAL USE ONLY-
Page 12
Sample Summary of Daily Activity for (b)(6), (b)(7)(C)

(b)(6), (b)(7)(C)
-OFFICIAL USE ONLY-
Page 13
(b)(6), (b)(7)(C)
.
Sample Daily Activity for (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
-OFFICIAL USE ONLY-
Page 14

(b)(6), (b)(7)(C)
-OFFICIAL USE ONLY-
Page 15

(b)(6), (b)(7)(C)
-OFFICIAL USE ONLY-
Page 16
(b)(6), (b)(7)(C)
-OFFICIAL USE ONLY-
Page 17

2015-02 Education Department FOIA

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

2015-02 Education Department FOIA

Uploaded by

Copyright:

Available Formats

11-000479

OFFICE OF INSPECTOR GENERAL

Assistant Special Agent in Charge

UNITED STATES DEPARTMENT OF EDUCATION

OIG FILE NO:

DATE: July 12, 2012

OFFICE: TCD, Region 11

, Assistant Special Agent in Charge

-OFFICIAL USE ONLY-

accepted the case for

-OFFICIAL USE ONLY-

-OFFICIAL USE ONLY-

ENTITIES AND INDIVIDUALS

U.S. Department of Education, Federal Student Aid

-OFFICIAL USE ONLY-

Interview of BUTLER, JOSEPH H.

-OFFICIAL USE ONLY-

UNITED STATES DEPARTMENT OF EDUCATION

Internet History and web/firewall log analysis

Case No: 11-110339

Internet History and web/firewall log analysis

Internet History and web/firewall log analysis

Internet History and web/firewall log analysis

UNITED STATES DEPARTMENT OF EDUCATION

Analysis of Microsoft Word Documents and other Files

Case No: 11-110339

Analysis of Microsoft Word Documents and Embedded Images

Q0004B: Image of a Memorex CD-RW, unmarked/unlabeled, approximately 700 MB in

Analysis of Microsoft Word Documents and Embedded Images

Analysis of Microsoft Word Documents and Embedded Images

Q0003B Microsoft Word Documents

OFFICE OF INSPECTOR GENERAL

Technology Crimes Division

Digital Forensic Report

TCD Digital Forensic Report

U.S. Department of Education, 61 Forsyth Street, Atlanta, GA 30303

FOR OFFICIAL USE ONLY

UNITED STATES DEPARTMENT OF EDUCATION

October 12, 2011

Synopsis of the Arrest of BUTLER

751 North Indian Creek Dr. Apt #108

Date Prepared: October 16, 2011

Case No: 11-110339

Synopsis of the Arrest of BUTLER

Case No: 11-110339

During SA (b)(7)(C) s meeting with the (b)(7)(C)

Date Prepared: October 16, 2011

Case No: 11-110339

Synopsis of the Arrest of BUTLER

Case No: 11-110339

. These items were

inventoried (Attachment 5).

Date Prepared: October 16, 2011

Case No: 11-110339

Synopsis of the Arrest of BUTLER

Case No: 11-110339

At approximately 10:00 AM, SAs (b)(7)(C)

Date Prepared: October 16, 2011

Case No: 11-110339

IN THE UNITED STATES DISTRICT COURT

FOR THE NORTHERN DISTRICT OF GEORGIA

JAMES N. HADEN, Clerk

UNITED STATES OF AMERICA

THE GRAND JURY CHARGES THAT,