“He had photos, images of my son, on Twitter. Everybody could see it,” Heather said. “How do you not see this is a child? If you would have taken 10 seconds to go and look you would have seen it. And if you would have just released the information, we would have been able to find this person.”
On the Hunter Fox Twitter account, the adult interacted directly with the boy’s account, where he posted selfies of himself on a school bus and in other locations. NBC News did not directly view the adult reposting photos of the boy. Several tweets were removed from the adult’s account by Twitter before they could be archived.
The case illustrates how easily online predators can avoid detection online, even on the internet’s most recognized platforms. In a mountain of content, tech platforms sometimes struggle to detect and respond to real threats to children.
It also highlights the sometimes bold and grandiose security statements made by tech platform executives and managers, despite the problems those companies face every day. As the boy was being groomed, and over a month before his abduction, Elon Musk said that addressing child exploitation on Twitter was “Priority #1,” alleging he’d inherited a platform on which child exploitation was previously allowed to run rampant.
Ella Irwin, Twitter’s vice president of trust and safety, provided an accounting of the company’s interactions with law enforcement in the case, but declined to address specific questions about the days leading up to the abduction.
“We are very open to collaborating further with law enforcement on how we can speed up and better assist them with these types of investigations involving missing children and the data requests they may have in these cases,” Irwin said in an email.
In separate statements, Discord and Roblox representatives said the platforms are taking actions to detect and prevent activities that could be dangerous for children. An Apple representative said the company is working to expand features that can prevent children from interacting with predators. The company says it will soon roll out a feature that can blur nudity in videos.
The teen was rescued in Nebraska the day after he was reported missing and an Amber Alert was issued. After a separate series of emergency requests were submitted by law enforcement to Twitter, the company provided detectives with information about the suspect — a man who legally changed his name to Tadashi Kojima from Aaron Michael Zeman in 2018 — in under two hours, Irwin said in a statement.
Kojima has been charged with four counts of sexual assault in Nebraska along with federal kidnapping, coercion and child pornography charges. Kojima has pleaded not guilty in Nebraska and awaits a trial scheduled for June.
Kojima’s attorney in Nebraska said, “As a practical matter, I do not have any comment.”
Groomed in plain sight
Before the abduction, the McConneys said they lived happy and full lives in a suburb outside of Salt Lake City. Heather, 40, is an Air Force medic and physician assistant student, and Ken, 53, works for an energy company doing safety work.
Their teen son had plenty of friends, his parents said, and liked to play golf and build Legos.
The couple said they’ve strived to be very open with their children. They have two teenagers together, and Ken has two adult children from previous relationships.
“We try to really ensure that they knew of the dangers of the world,” Heather said. “We don’t hide things from our kids.”
She said she warned her kids not to talk to strangers and took precautions with her children’s electronics. She said she didn’t let them have phones until they were 12. And on their phones, she used parental controls, blocking the use of certain websites and apps and requiring approval to download new applications.
When her son started gravitating toward online games, she tried to watch his behavior as much as she could. When he started to use the computer more and became isolated, she chalked it up to teenage moodiness.
What Heather didn’t know was that her teenage son was apparently being groomed on apps she thought were safe for children.
She said, based on conversations with her son, their interactions began on Discord and Roblox.
Kojima eventually began to interact with the teen on other platforms like Twitter, according to Heather and prosecutors, and on more under-the-radar messaging apps including Telegram, where the conversations turned more personal. Heather said she never thought an app like Twitter would appeal to her teenage son and that she hadn’t even heard of some of the other apps he was using to communicate with Kojima.
Twitter requires that users be 13 years or older, but the McConneys’ son was able to create an account while he was 12 years old by lying about his birth year.
“This guy had him make several accounts through several different things so that he always had a way to communicate with him if he were to get in trouble and get something taken away,” Heather said. In the federal complaint against Kojima, prosecutors said that he used numerous apps to communicate with the teen.
On Twitter, the Hunter Fox account would post notes and poetry that appeared to be about the teen, according to online archives.
Heather said she finally discovered the grooming when the 13-year-old was using his phone past the family’s agreed lights-out time (8:30 p.m.) on Nov. 20. Heather went to retrieve the phone and heard him talking to someone.
Heather took the phone and brought it to her room.
“I kept hearing it buzzing and buzzing, and I’m like, ‘Who is texting him?’” she said.
When Heather unlocked the phone, she was deeply disturbed by what she found. In one text message she saw, the sender excitedly told her son that he got a new job in Utah and would be moving there.
Ken said that when he read the text message exchange between the man and his son, it came off as distinctly childlike: “It was like he was a really young child trying to talk to another child.”
Heather said that the man asked her son for geolocation pins to their house and the nearby school bus stop, which their son sent. “It scared the absolute s— out of us,” she said.
A delayed investigation
After the initial discovery of the communications, the McConneys say they grounded their teen and took away his electronic devices. But they didn’t fully comprehend the scope of the communications their son was having with the adult.
Nine days later, on Nov. 29, the McConneys say they discovered that their son had located a discarded cell phone somewhere in the house that he was using to continue conversations with the man.
At that point, Heather said she discovered that the messages turned sexual when the suspect started sending her son pornography, asking what his reaction was. After the teen reacted, the suspect said that his parents would never understand, according to Heather’s recollection of the messages she said she viewed.
Heather said that she found that her son had sent explicit pictures of himself to the suspect. That was the moment when the reality of the alleged grooming sunk in.
“My heart sank. I was just sick to my stomach,” Heather said. “Because then I was starting to understand what was happening.”
After Heather discovered the messages, Ken contacted the National Center for Missing & Exploited Children, which referred him to the Layton City Police Department. The McConneys filed a police report and pulled their teenage children out of school for a week, fearing for their safety.
The local police petitioned a state judge for a search warrant on Dec. 2 to be served to Twitter. The search warrant, obtained by NBC News, was granted and sent to Twitter on the same day.
The initial search warrant stated that law enforcement had reason to believe that evidence of child sexual exploitation was stored in Twitter’s records, and requested that Twitter provide nearly all available information about the account they believed belonged to the suspect. Twitter has a special online portal through which such requests are sent.
The initial search warrant, however, listed an account name that doesn’t appear to have ever existed on Twitter. The suspect’s primary Twitter account appears to have been @HunterFloofyFox. But the initial search warrant requested records related to the account @HunterFluffyFox.
A request for a second, corrected warrant was submitted to a judge 20 days later.
What happened between the issuance of the first warrant and the issuance of the corrected warrant is not entirely clear given gaps in information provided by Twitter and police, but the McConneys said the time wasted could have been crucial to the prevention of the teen’s eventual abduction.
Twitter responded to the first warrant to note that the account referenced did not exist, Irwin said, though she did not respond to questions about when that response was sent.
Sgt. Juan Moreno, who supervised detective Nick Nalder, who was in charge of the McConney case, said it’s not clear how the error was introduced. Nalder did not respond to requests for comment.
Police denied requests from NBC News and the teen’s father to see the original police report. The teen’s father was flummoxed.
Ken said, “I just assumed, and obviously incorrectly, that law enforcement was going to take over and ensure that nothing’s gonna happen.”
Throughout December and after the first warrant was issued, the Hunter Fox Twitter account repeatedly interacted with the teen’s account and tweeted that he was going on a trip with the teen and that he intended to marry him. The teen’s parents had taken away his phone but were unaware that he was continuing to use Twitter through the family’s virtual reality headset.
On Dec. 13, the user posted a shirtless photo of himself, along with the text, “Love you my sweet baby Lamb — daddy will do his best to be home before the holidays.”
On Dec. 14, the teen responded to the account, writing, “shit, man I’m all packed and ready to go.”
On Dec. 17, the user posted a photo of marijuana products, writing, “Did I mention we’re going on a ‘trip~’? Hehehe Can’t wait, my Lamb! Lesgooo! x/3 I guess we’re going on two kinds of trips, nyehe! I love you, baby boi! x/3”
On Dec. 19, the user tweeted, “My Lamb and I are getting married on the trail~! x3 Wehehe, I love you, my Lamb! :/3”
The McConneys said police did not notify them of the continued interactions. Layton Police Department declined to comment on whether it was actively monitoring the interactions as they were occuring and if it notified the McConneys about them.
On Dec. 22, a second search warrant, also obtained by NBC News, was issued and served to the company with the correct account name.
Moreno said Twitter did not respond to that warrant before the teen was abducted five days later.
In a statement provided to NBC News, Irwin said that “as a general rule we respond to any law enforcement request within a matter of 2-3 business days depending on the type of request.” The second warrant served to Twitter was served two days before the weekend of the Christmas holiday.
Police submitted an emergency request for information after the kidnapping, but Moreno said that Twitter also pushed back on that request.
“They didn’t give us anything initially. We talked to them and provided them more information to clearly articulate that we did have an exigent situation here and then they provided us the information that we needed,” he said.
Irwin said that Twitter responded to the emergency request within two hours, and that police did not initially notify the company that the request was in relation to a missing child case. Police did not respond to a specific question about that claim.
