FAYETTEVILLE, Arkansas — Former 19 Kids and Counting reality star Josh Duggar could have circumvented anti-porn software he and his wife installed on their computer by using a sophisticated operating system that was discovered by authorities during their investigation, a witness testified Thursday.
Duggar, the oldest child of his famous fundamentalist Christian family, was arrested in Arkansas in April and charged with “knowingly” receiving and possessing child sexual abuse materials. He pleaded not guilty and faces up to 20 years in prison and a fine of up to $250,000 for each count if he is convicted.
Jeff Wofford, vice president of technology at Covenant Eyes, the software Duggar and his wife used as an “accountability” mechanism to avoid any pornographic content, told prosecutors that Duggar would not have been able to discreetly download and view child sexual abuse materials given that he had a “mature teen” rating for his subscription, which blocked anything pornographic on his devices. The software would generate a regular report for Anna Duggar, his “ally,” detailing any “incidents” of him accessing “bad” content, Wofford added.
But when prosecutors asked if Duggar would have been able to circumvent the software if he downloaded what is known as a Linux partition, a sophisticated operating system, Wofford replied “yes.” That’s because the partition basically splits one computer into two separate devices, and the tracking software wouldn’t have worked on the Linux side, he said.
Witnesses told the court on Thursday that Duggar's work computer did have a Linux partition, and that potential linkages to child sexual abuse materials were detected by investigators on that side of the computer.
Meanwhile, Duggar's iPhone, MacBook Pro, SD cards, and thumb drives contained "no evidence" of child sexual abuse materials across videos, images, and "artifacts" within the devices, Homeland Security Investigator Marshall Kennedy testified on Thursday. An anonymous browser was on his MacBook Pro, but the only downloaded content involved popular films and children's movies.
Kennedy said he then referred Duggar's HP desktop computer to James Fottrell, a top forensics investigator at the Department of Justice, for supplementary review. Fottrell's deep look into a virtual copy of what Duggar's work computer looked like at the moment it was seized revealed that a Linux partition was installed on Duggar’s HP work computer, he testified on Thursday.
Prosecutors showed jurors screenshots of what Fottrell would have viewed as he examined Duggar’s desktop. On the Microsoft Windows side (which he used for his business) of the HP computer, Fottrell found files involving the setup of the Linux partition.
This also signified that someone had to be behind the keyboard. It’s “impossible” for anyone to use the Microsoft and Linux sides of the computer simultaneously, Fottrell said, and someone would need to process the installation tools and then be “physically present” to select which side of the computer to boot up once it's installed.
When he reviewed the Linux side, Fottrell said he found it was installed on May 13, 2019, just days before the child sexual abuse activity linked to Duggar was first reported.
He also noticed a certain kind of browser that allows for anonymous online surfing, as well as a media player — both of which would not have come preinstalled on the Linux system. Fottrell said the version of secret browser on the Linux side matched the version Detective Amber Kalmer said she noticed in her initial findings of child sexual abuse content.
Prosecutors asked Fottrell to review the desktop files, browser bookmarks, file manager, and the cache folder he studied on the Linux side, as well as other detailed file types that trace activity on the device.
In one portion of the in-depth testimony, Fottrell discussed how the anonymous browser's bookmarks were for certain sites known for "all kinds of criminal activity" and wouldn't have come preloaded — someone would have had to manually add them, he told the court.
Fottrell then explained how his search process led him to "thumbnails" in multiple folders on the Linux side that depicted child sexual abuse materials. In one folder, he saw thumbnails of "multiple images of a minor girl, 8 to 10 years old" that were "very sexually explicit."
Fottrell said they were "well-known images" through his decades of experience investigating child exploitation and that they are popularly "traded."
"The existence of thumbnails is evidence that full-size versions previously existed on the computer," said Fottrell, who will continue to testify on Friday.
The jury also heard from Duggar’s former employee Matthew Waller, who worked as a salesperson at Wholesale Motorcars until late April 2019, about a month before authorities say child sexual abuse materials were recorded and associated with an IP address located at the business.
Attorneys questioned whether Waller in fact recalled the password “Intel1988” to Duggar’s HP desktop computer in the car lot’s shedlike office. Waller told the defense he “vaguely” recalled the password, although prosecutors retorted that he had previously said he did not.
Homeland Security Investigator Jeffrey Pryor also spoke to the court, reiterating accounts of the search warrant executed at Wholesale Motorcars on Nov. 8, 2019.
The search warrant was served nearly six months after Kalmer initially found child sexual abuse materials downloaded by an IP address in May 2019. Kalmer testified on Wednesday that content her monitoring software flagged involved video footage as well as a series of 65 images of prepubescent girls that focused on their “vaginal areas.”
The trial comes after his wife announced the birth of their seventh child on Nov. 16. His father, Jim Bob Duggar, also recently announced he is running for Arkansas state Senate. He and his wife, Michelle Duggar, have called the allegations against their son “very serious” and “continue to pray” for Josh and Anna’s family.
Jim Bob and Michelle Duggar, who became famous for their large household and ultraconservative beliefs via the TLC reality show and spinoffs, admitted in a 2015 Fox News interview that Josh Duggar had molested five girls when he was a teenager, including his four younger sisters and a family babysitter. In the interview, they said he and the girls received counseling and the family did not believe there was any future threat of wrongdoing; in their view, he had only been “curious about girls.”