How (and Why) the FBI Mysteriously Shut Down a Federal Solar Observatory

In early September 2018, though, Sunspot Solar Observatory broke into the national consciousness, and not for a stellar scientific discovery. Instead, the facility made headlines because it and the small surrounding town had been evacuated, because, rumors said, it had been shut down by the FBI.

Speculation did its thing: Perhaps the instruments on the peak had gotten too close to a good secret—whether that was of an alien presence, or goings-on at nearby military installations. Maybe the Sun itself would soon send an apocalyptic storm our way. 

The observatory remained closed for 11 days, with the organization that oversees the facility—the Association of Universities for Research in Astronomy (AURA), a consortium of educational institutions that operates telescopes for NASA and the National Science Foundation—keeping relatively mum. On September 16, 2018, though, the group released a statement: “AURA has been cooperating with an on-going law enforcement investigation of criminal activity that occurred at Sacramento Peak,” it read, in part. “During this time, we became concerned that a suspect in the investigation potentially posed a threat to the safety of local staff and residents. For this reason, AURA temporarily vacated the facility and ceased science activities at this location.”

Not long after, the public learned that the investigation dealt with the dissemination of child sexual abuse material, from a Sunspot network.

Almost exactly four years later, the case went to criminal trial. The state charged Joshua Cope, who worked as a janitor at the observatory, with two counts of the possession of child pornography, and one of its distribution. 

On Monday, September 12, 2022, Cope appeared at Alamogordo’s district courthouse, to face the evidence against him.

The day trial began, the small courtroom was filled—or sort of filled, given an attempt at social distancing—with masked members of the Cope family and family friends. In the hallway, a sign above the water fountain noted that you’re not allowed to spit tobacco into it.

Over the course of three days, witnesses from the observatory, the Cope family, the FBI, the New Mexico District Attorney’s office, and the New Mexico State University Police Department testified about events and evidence surrounding the Sunspot happenings from years ago. Their memories, analysis, and data cohered into a timeline that, strangely, leaves out the evacuation that brought Sunspot onto the nation’s radar in the first place. 

“My name is Doug Gilliam,” he began, in his testimony, “and I work at the Dunn Solar Telescope.” 

This is the site’s flagship instrument, housed in a pyramidal white building that rises 136 feet above the ground, the structure diving around 220 more feet below. Down the mountain, from the highway next to Alamogordo’s Holloman Air Force Base, you can see its spire spearing the sky, pointing up toward the nearby star that is the object of its attention. 

Gilliam, who carried crutches with him to the stand, has been overseeing the Dunn’s science operations for 20 years.

“Was there a time when you located something that was unusual?” the prosecutor, Roxeanne Esquibel, asked him.

There was. One day, in May 2018, when he was fixing the computer of an emeritus researcher, Gilliam noticed a light between the desktop tower and the wall. It was shining from a laptop, he realized, a “small form-factor Lenovo,” plugged in and partially cracked open like a book, wedged in next to the larger computer.

Curious, he took the laptop out and opened it up. The display came on. At first, he didn’t recognize the picture that appeared, till he rotated the device. There it was: adult female genitalia. The image flashed, then disappeared, and another popped up, he claimed: a male kid, standing in a darkly-lit room, wearing underwear, a T-shirt, and a cat mask. 

“As I was sitting there looking, it went black,” Gilliam says. All of this with no stated action on his part.

The whole thing was weird, he thought—but he had work to get back to, people waiting on him. He replaced the laptop and moved on. As he drove home that night, he recalled thinking, “Obviously, that first image was not good for the workplace.” The fact that a picture of a kid, though clothed, came right after gave him pause, but he didn’t think it was illegal. 

He kept quiet.

Gilliam found the laptop again, around two weeks later, when he was searching for hardware and software in a different office. This time, he testified, it was on the floor under a desk—with LEDs indicating it was powered up, but showing no display. 

He kept quiet.

The same thing happened around two weeks later, in another office, Gilliam claimed, when he discovered the computer behind some books on a shelving unit. “I never reported this to anyone,” he told Esquibel.

Sign up for Motherboard’s daily newsletter for a regular dose of our original reporting, plus behind-the-scenes content about our biggest stories.

In the defense’s cross-examination, Gilliam’s strange-seeming reticence came up. There was, after all, a laptop with no apparent owner, showing at least one pornographic image, hidden in various places around a federal facility. “If you see something, say something,” perhaps would apply here. 

“It was something you should have reported, right?” a defense lawyer, Lauren Truitt, later asked.

“Looking back on it,” Gilliam said, “yes, probably.”

The fourth time Gilliam discovered the Lenovo, he was cleaning a large room where telescope equipment lived.

The fifth and final appearance was August 21, 2018. “This was the day events started to unfold,” he said. The computer was sitting on the floor of an office, open again like a book, near a package of toilet paper. The students who had come for the summer—his original suspects—were now gone, and only a few people had access to the building. 

One of them was an observatory janitor, Joshua Cope.

Gilliam, still not having said anything, soon moved on to sorting cables. Then, though, his phone rang. It was his supervisor, calling from the National Solar Observatory headquarters in Boulder, Colorado. The supervisor asked him how operations were going. 

“I told him that we had something strange going on with a laptop,” Gilliam said from the witness stand. 

The events did indeed then start to unfold: Soon, Gilliam was querying the laptop’s IP address, and calling his boss back to report. 

When his phone rang not long after, it was with the FBI. 

Peña regularly uses law-enforcement software to search for people who are sharing files suspected to contain child sexual abuse material—looking for file hash values and names known to be associated with underage exploitation. For this, Peña sometimes uses a package called ShareazaLE—a law-enforcement-specific version of the public software Shareaza. 

Shareaza is a peer-to-peer file-sharing client that lets users download files from multiple peer-to-peer networks, including the popular BitTorrent protocol and Gnutella. In such networks, people get files from other users, and share their own files with other users. You remember Limewire. 

ShareazaLE lets agents like Peña find instances of people sharing suspected child sexual abuse material. They can then log semi-identifying information like their IP address and go search historical data on that same address’s activity. 

In July 2018, he came across an IP address that pointed back to Sunspot, a facility that owns its own block of addresses. The history showed suspicious activity dating back to that January. 

That activity had continued, and he continued to log it. “It was on all the time,”  Peña testified. “It was eating up a lot of space on our law-enforcement software.”

In such instances, investigators can try to download suspected child sexual abuse material from their suspicious peer-sharer, thus catching them in the act of distribution, and being able to tell whether a file with letter-number combos like “8yo” actually show what that implies. Peña wasn’t successful at downloading, but in collaboration with special agent in charge Jay Ratliff, who also testified, the office was eventually able to partially download two “files of interest.” 

“Files of puppies and kittens are of no interest to law enforcement,” Ratliff said. The two partial videos, which the prosecution played for the court, did indeed, and definitively, not show puppies or kittens. 

The National Solar Observatory was notified of what was going on, and they tried to help localize the problem, and shut down certain wifi networks for a period of time.

Because the IP address led back to Sunspot, though, this activity wasn’t actually New Mexico’s concern: Sunspot is a federal facility. It was the FBI’s domain.

Enter Lisa Kite Hill, who works in Las Cruces for the Albuquerque Field Office. Notified of the Sunspot suspicions in early August, Hill soon began talking to the National Solar Observatory. On August 21, they told her about a man who’d found a roving, running laptop in the facility. And that’s when Gilliam’s phone rang.

After finding that reason, which remained unstated in court, Gilliam was alone at the observatory for around three hours. (This was not the facility closure and evacuation that made headlines, which would occur a couple weeks later.)

When Hill got to Sunspot, a forested subalpine landscape ultra-different from the desert down the mountain, that afternoon, Gilliam led her to the room where the laptop sat, doing whatever it was doing. Hill took photos of the device with her FBI-issued phone, and determined to keep it in the state it was: on, up and running.

When she left, she asked a few favors of Gilliam: to lock the office door, to take notes, to keep quiet, to keep his eyes open. If he heard anyone asking about the laptop, get back in touch with the FBI.

Gilliam also had something to ask of the FBI: Could he wipe his fingerprints from the computer? “They said, ‘Absolutely not,’” Gilliam testified.

After the laptop disappeared into an evidence vault, Gilliam said, he took note of some human behavior: Cope was “frantic.” Upset about the locked doors. Claiming security was lax, and the observatory needed to do something about it. Things that belonged to him were missing, and he should be able to, say, throw a laptop down if he wanted. 

No one else heard these conversations, Gilliam told the defense.

Hill never considered Gilliam a suspect. “Not after I met him, no,” Hill said. He was older, and had worked at Sunspot for two decades: It was unlikely that he would suddenly start downloading contraband in 2018.

Hill’s photos of the computer in its original state and original place never made it into evidence, because she did not download them from her phone before the FBI upgraded it and wiped the device. The laptop itself went into the FBI’s temporary evidence room, still on, and pictures were taken there. 

Now-retired Thomas Durham was an FBI special agent who examined evidence in the Cope case, searching the computer for evidence of child sexual abuse material, documenting Shareaza’s presence, and trying to find evidence of its owner, who he found was simply identified as “owner” in the user profile. 

While Durham didn’t find anything to point to “owner”’s real name, Shareaza was indeed installed aboard, and set to distribute content to other users—and inside two of its folders were 25 videos of suspected child sexual abuse material. In court, the prosecution played a representative sample of the videos.

One of Durham’s logs shows that Shareaza was accessed, as were other files, after the laptop was in custody, but before it went to the RCFL. That could mean it was updating itself in the background, since the computer was running..  Two hours after Hill took possession of the Lenovo, Durham found, it also connected to two other wifi networks. The computer did not remain in its original state while in custody, in other words.

In his investigation, though, Durham also checked out evidence seized from another location: Cope’s residence, where he lived in a be-porched trailer on the family’s property.

On September 14, 2018, agents showed up at the Cope residence. And there, they found the kinds of things they’d come for: 20-30 thumb drives and media cards, along with other computers, in Cope’s trailer and a car he drove. Five of the flash drives, the RCFL’s analysis later revealed, had been plugged into the roving laptop in 2018. Of those, three housed suspected child sexual abuse material, deleted files in a world where little is ever really deleted. And two of the drives pointed toward Cope as their owner: One was named JC_01, and another had a file named “labassignmentenglishjoshuacope.”

Given this evidence, Truitt posited an alternate scenario: What if someone had taken someone else’s thumb drive, stuck it in a laptop, put files on it, deleted them, and put the drive back with that person’s belongings?

“Is that technically possible, and would you draw the same conclusions as you have here?” she asked. 

“Yes,” Durham said.

It was hot, as it tends to be in the Tularosa Basin that time of year. They parked in the shade and kept the car, and its AC, running. Hill and her partner interviewed Cope for two recorded hours, during which Hill says he denied the allegations, sometimes changing his statements, but admitted to once moving the laptop from a chair, to stop it from overheating. When she confronted him about suspected child sexual abuse material an onsite investigation was then revealing on his thumb drive, he asked which one. 

“JC_01,” she told him. 

“He said, ‘Yeah, that’s mine,’” Hill testified.

After two hours, Hill told Cope they were going to end the interview but couldn’t return to the house till the search was over. So they stood outside the car, in the shade, making small talk. The recorder remained in the car. 

There is thus no record, beyond memory and testimony, of what went on over the next hour. Hill claimed that Cope brought up addiction in his family, and said child porn is an addiction like other kinds. He began to talk, she said, about rehabilitation programs, and how he’d done all the research on them. Conclusion: They don’t work. He didn’t want to be on a sex-offender registry. He didn’t want to hurt a child.

People like him would, she says he said, be better off dead.

With that statement of potential self-harm, Hill said she had to take him to the hospital. He, in turn, expressed concern that his mother wouldn’t love him. 

It didn’t matter what he did, Hill recalled telling him, his mother—in court that day—would love him. 

Then Hill asked if Cope would make a recorded statement.

In an excerpt of that recording played for the court, Cope admitted the thumb drives belonged to him. “I can’t trust the fact that I don't remember any of this going on,” he said.

The laptop, Hill testified, was never fingerprinted. “I did not think it was necessary after we talked to Mr. Cope,” she said. Cope did not testify.

Some things, Esquibel noted in hers, hide in plain sight: In this case, that would include both a person, Joshua Cope, and an object, a laptop. 

When the defense took over, Truitt hit back. “You know what?” Truitt said. “She’s right.” 

“The real perpetrator was hiding in plain sight,” Truitt continued. 

That person, she alleged, was the chief observer, Doug Gilliam. He didn’t report what he claimed to have seen. “That doesn’t make sense, folks,” Truitt proclaimed. 

“Something was going down,” she said, “and Mr. Gilliam knew that.”

“Agent Hill,” she continued, “failed to investigate the most obvious suspect in this case.” 

The argument didn’t fly with the prosecution. “That’s what you call desperation,” Esquibel said in a rebuttal.

The argument didn’t fly with the jury, either. 

With little delay, they found Cope guilty of two counts of child-pornography possession, and one count of distribution. He is currently awaiting sentencing.

The community, at least on one dark night when trial wrapped up for the evening, was cloistered. The residential roads had signs proclaiming they were for residents only. The road to the telescopes was, meanwhile, for authorized vehicles only. The way to the visitors’ center, shut for the night, was blocked off. The public website was even down.

That evening, a storm rolled into Alamogordo, thousands of feet below. Driving down from Sunspot, you could see it coming. Relentless lightning, the kind that makes even atheists think of anger striking down from above, cut the sky, illuminating thick carpets of rain in the distance. The tempest took hours to reach town, finally blowing in like a breaking wave. 

That sounds like a metaphor, but it’s not, not really. It is just, in fact, what happened, and simple at least in relative terms because it involves hard science—that of molecules, electromagnetism, fluid dynamics, photons—and no humans or their hard drives.