Heather McConney holds her son at their home in Layton, Utah, on April 9, 2023.
Kim Raff | NBC News
The 13-year-old Utah boy hung out in the typical online spaces for someone his age: The chat app Discord. The gaming platform Roblox. And, of course, Twitter.
But for more than two months last year, on those very platforms, the boy was being sexually groomed by an adult who was 13 years older and hundreds of miles away. It started in private messages then moved into public view on Twitter.
It ended in a horror story. The boy’s father went to check on him one night and found him missing, his window open, the bedroom freezing. The boy was allegedly abducted by the man accused of grooming him, driven across state lines, and, prosecutors said, repeatedly sexually assaulted.
Heather and Ken McConney, the boy’s parents, told NBC News that they believe the kidnapping was preventable. It came after a series of missed opportunities over the span of nearly a month, where, they said, Twitter and law enforcement failed to effectively intervene despite an abundance of information posted online. They’re demanding answers.
“I need to move forward and figure out what the hell happened,” Heather said. “Where did the ball get dropped?”
This report is based on a review of archived online messages, state and federal court filings made in the two active criminal cases involving the suspect, interviews with the parents of the teen, interviews with law enforcement officials who worked on the investigation into the abduction, and an interview with the teen himself while his mother was present. NBC News is not naming the teen because he is a minor.
The McConneys reported the situation to local police in November and surrendered the boy’s iPhone after discovering explicit text messages between the boy and a man believed to have gone by @HunterFloofyFox on Twitter.
In tweets reviewed by NBC News, the accused adult identified as a “map” — a common online abbreviation for “minor-attracted person.” @HunterFloofyFox excitedly referred to the teen as “my lamb.” Both the teen and the Hunter Fox account made frequent references to the online furry community — a group of people who roleplay as anthropomorphized animal characters. Hunter Fox repeatedly talked about a trip he said the two would go on together.
Twenty-five days before the abduction, police sent a search warrant to Twitter to learn more information about the man police believe was grooming the teen. But they misspelled the username.
When the police corrected the error several weeks later, Twitter did not immediately respond, police said.
Five days later, the teen was abducted, according to prosecutors and the McConneys.
“He had photos, images of my son, on Twitter. Everybody could see it,” Heather said. “How do you not see this is a child? If you would have taken 10 seconds to go and look you would have seen it. And if you would have just released the information, we would have been able to find this person.”
On the Hunter Fox Twitter account, the adult interacted directly with the boy’s account, where he posted selfies of himself on a school bus and in other locations. NBC News did not directly view the adult reposting photos of the boy. Several tweets were removed from the adult’s account by Twitter before they could be archived.
The case illustrates how easily online predators can avoid detection online, even on the internet’s most recognized platforms. In a mountain of content, tech platforms sometimes struggle to detect and respond to real threats to children.
It also highlights the sometimes bold and grandiose security statements made by tech platform executives and managers, despite the problems those companies face every day. As the boy was being groomed, and over a month before his abduction, Elon Musk said that addressing child exploitation on Twitter was “Priority #1,” alleging he’d inherited a platform on which child exploitation was previously allowed to run rampant.
Ella Irwin, Twitter’s vice president of trust and safety, provided an accounting of the company’s interactions with law enforcement in the case, but declined to address specific questions about the days leading up to the abduction.
“We are very open to collaborating further with law enforcement on how we can speed up and better assist them with these types of investigations involving missing children and the data requests they may have in these cases,” Irwin said in an email.
In separate statements, Discord and Roblox representatives said the platforms are taking actions to detect and prevent activities that could be dangerous for children. An Apple representative said the company is working to expand features that can prevent children from interacting with predators. The company says it will soon roll out a feature that can blur nudity in videos.
The teen was rescued in Nebraska the day after he was reported missing and an Amber Alert was issued. After a separate series of emergency requests were submitted by law enforcement to Twitter, the company provided detectives with information about the suspect — a man who legally changed his name to Tadashi Kojima from Aaron Michael Zeman in 2018 — in under two hours, Irwin said in a statement.
Kojima has been charged with four counts of sexual assault in Nebraska along with federal kidnapping, coercion and child pornography charges. Kojima has pleaded not guilty in Nebraska and awaits a trial scheduled for June.
Kojima’s attorney in Nebraska said, “As a practical matter, I do not have any comment.”
Groomed in plain sight
Before the abduction, the McConneys said they lived happy and full lives in a suburb outside of Salt Lake City. Heather, 40, is an Air Force medic and physician assistant student, and Ken, 53, works for an energy company doing safety work.
Their teen son had plenty of friends, his parents said, and liked to play golf and build Legos.
The couple said they’ve strived to be very open with their children. They have two teenagers together, and Ken has two adult children from previous relationships.
“We try to really ensure that they knew of the dangers of the world,” Heather said. “We don’t hide things from our kids.”
Heather McConney’s teen son communicated with the man accused of grooming him through an Apple iPhone.
Kim Raff | NBC News
She said she warned her kids not to talk to strangers and took precautions with her children’s electronics. She said she didn’t let them have phones until they were 12. And on their phones, she used parental controls, blocking the use of certain websites and apps and requiring approval to download new applications.
When her son started gravitating toward online games, she tried to watch his behavior as much as she could. When he started to use the computer more and became isolated, she chalked it up to teenage moodiness.
What Heather didn’t know was that her teenage son was apparently being groomed on apps she thought were safe for children.
She said, based on conversations with her son, their interactions began on Discord and Roblox.
Kojima eventually began to interact with the teen on other platforms like Twitter, according to Heather and prosecutors, and on more under-the-radar messaging apps including Telegram, where the conversations turned more personal. Heather said she never thought an app like Twitter would appeal to her teenage son and that she hadn’t even heard of some of the other apps he was using to communicate with Kojima.
Twitter requires that users be 13 years or older, but the McConneyss’ son was able to create an account while he was 12 years old by lying about his birth year.
“This guy had him make several accounts through several different things so that he always had a way to communicate with him if he were to get in trouble and get something taken away,” Heather said. In the federal complaint against Kojima, prosecutors said that he used numerous apps to communicate with the teen.
On Twitter, the Hunter Fox account would post notes and poetry that appeared to be about the teen, according to online archives.
Heather said she finally discovered the grooming when the 13-year-old was using his phone past the family’s agreed lights-out time (8:30 p.m.) on Nov. 20. Heather went to retrieve the phone and heard him talking to someone.
Heather took the phone and brought it to her room.
“I kept hearing it buzzing and buzzing, and I’m like, ‘Who is texting him?'” she said.
When Heather unlocked the phone, she was deeply disturbed by what she found. In one text message she saw, the sender excitedly told her son that he got a new job in Utah and would be moving there.
Ken said that when he read the text message exchange between the man and his son, it came off as distinctly childlike: “It was like he was a really young child trying to talk to another child.”
Heather said that the man asked her son for geolocation pins to their house and the nearby school bus stop, which their son sent. “It scared the absolute s— out of us,” she said.
A delayed investigation
After the initial discovery of the communications, the McConneys say they grounded their teen and took away his electronic devices. But they didn’t fully comprehend the scope of the communications their son was having with the adult.
Nine days later, on Nov. 29, the McConneys say they discovered that their son had located a discarded cell phone somewhere in the house that he was using to continue conversations with the man.
At that point, Heather said she discovered that the messages turned sexual when the suspect started sending her son pornography, asking what his reaction was. After the teen reacted, the suspect said that his parents would never understand, according to Heather’s recollection of the messages she said she viewed.
Heather said that she found that her son had sent explicit pictures of himself to the suspect. That was the moment when the reality of the alleged grooming sunk in.
“My heart sank. I was just sick to my stomach,” Heather said. “Because then I was starting to understand what was happening.”
After Heather discovered the messages, Ken contacted the National Center for Missing & Exploited Children, which referred him to the Layton City Police Department. The McConneys filed a police report and pulled their teenage children out of school for a week, fearing for their safety.
The local police petitioned a state judge for a search warrant on Dec. 2 to be served to Twitter. The search warrant, obtained by NBC News, was granted and sent to Twitter on the same day.
The initial search warrant stated that law enforcement had reason to believe that evidence of child sexual exploitation was stored in Twitter’s records, and requested that Twitter provide nearly all available information about the account they believed belonged to the suspect. Twitter has a special online portal through which such requests are sent.
The initial search warrant, however, listed an account name that doesn’t appear to have ever existed on Twitter. The suspect’s primary Twitter account appears to have been @HunterFloofyFox. But the initial search warrant requested records related to the account @HunterFluffyFox.
A request for a second, corrected warrant was submitted to a judge 20 days later.
What happened between the issuance of the first warrant and the issuance of the corrected warrant is not entirely clear given gaps in information provided by Twitter and police, but the McConneys said the time wasted could have been crucial to the prevention of the teen’s eventual abduction.
Twitter responded to the first warrant to note that the account referenced did not exist, Irwin said, though she did not respond to questions about when that response was sent.
Sgt. Juan Moreno, who supervised detective Nick Nalder, who was in charge of the McConney case, said it’s not clear how the error was introduced. Nalder did not respond to requests for comment.
Police denied requests from NBC News and the teen’s father to see the original police report. The teen’s father was flummoxed.
Ken said, “I just assumed, and obviously incorrectly, that law enforcement was going to take over and ensure that nothing’s gonna happen.”
Throughout December and after the first warrant was issued, the Hunter Fox Twitter account repeatedly interacted with the teen’s account and tweeted that he was going on a trip with the teen and that he intended to marry him. The teen’s parents had taken away his phone but were unaware that he was continuing to use Twitter through the family’s virtual reality headset.
On Dec. 13, the user posted a shirtless photo of himself, along with the text, “Love you my sweet baby Lamb — daddy will do his best to be home before the holidays.”
On Dec. 14, the teen responded to the account, writing, “shit, man I’m all packed and ready to go.”
On Dec. 17, the user posted a photo of marijuana products, writing, “Did I mention we’re going on a ‘trip~’? Hehehe Can’t wait, my Lamb! Lesgooo! x/3 I guess we’re going on two kinds of trips, nyehe! I love you, baby boi! x/3”
On Dec. 19, the user tweeted, “My Lamb and I are getting married on the trail~! x3 Wehehe, I love you, my Lamb! :/3”
The McConneys said police did not notify them of the continued interactions. Layton Police Department declined to comment on whether it was actively monitoring the interactions as they were occuring and if it notified the McConneys about them.
On Dec. 22, a second search warrant, also obtained by NBC News, was issued and served to the company with the correct account name.
Moreno said Twitter did not respond to that warrant before the teen was abducted five days later.
In a statement provided to NBC News, Irwin said that “as a general rule we respond to any law enforcement request within a matter of 2-3 business days depending on the type of request.” The second warrant served to Twitter was served two days before the weekend of the Christmas holiday.
Police submitted an emergency request for information after the kidnapping, but Moreno said that Twitter also pushed back on that request.
“They didn’t give us anything initially. We talked to them and provided them more information to clearly articulate that we did have an exigent situation here and then they provided us the information that we needed,” he said.
Irwin said that Twitter responded to the emergency request within two hours, and that police did not initially notify the company that the request was in relation to a missing child case. Police did not respond to a specific question about that claim.
Drawn back in
As the McConneys were waiting for police and Twitter to investigate, the teen was drawn back into communications with the Hunter Fox account.
After the second phone was taken away, the teen used a Meta Quest virtual reality headset to access Twitter and communicate with the Hunter Fox account.
Afterward, the Hunter Fox account tweeted, “I’m going to spend my life with him. I am so .. so lucky .. We played VR chat together for about an hour. Today I heard his voice for the first time since 20th Nov 2022. This is already the best Christmas. I love you.”
In the days leading up to the abduction, the account tweeted photos of marijuana products along with the text, “I guess we’re going on two kinds of trips, nyehe! I love you, baby boi! x/3” and directly stated his intent to assault the teen.
On Dec. 27, Ken went downstairs to check on his sons and immediately felt a chill.
“I thought, ‘This is not right.’ I opened the door and his blinds are up and his window was open,” Ken said. He climbed out of the window and frantically searched their yard for his teenage son. Nothing. His passport and piggy bank were missing.
Ken came back upstairs and told his wife, Heather: “Call the police. He’s gone.”
Heather said it took police over 45 minutes to arrive at their home. Ken methodically drove the grid of their neighborhood with their other son searching for any sign of their missing teen.
Afterward, Heather went to look at their home security camera footage. The system had been wiped clean, she said, suspecting her son had done it. She went door to door to ask if neighbors could check their security footage.
That afternoon, police issued an Amber Alert. Shortly after, Heather said people online came to her aid and quickly found the Twitter accounts. She said she received thousands of messages on social media.
In replies to some of the tweets from @HunterFloofyFox, users frantically tagged Musk: “@elonmusk this guy has taken a 13 year old boy, take his account down and retweet the amber alert,” one user tweeted the day after the teen was kidnapped.
Musk did not reply. Archives of the account preserved online indicate that the account belonging to the suspect stayed online at least through Jan. 1 — five days after the abduction.
After the worst day of their lives, the McConneys’ son was recovered early on the morning of Dec. 28 in Nebraska.
But it wasn’t the Amber Alert or the data provided by Twitter that saved him, according to Moreno. A person called in a suspicious vehicle at a gas station nearly 800 miles from Salt Lake City, and when an officer showed up and ran the teen’s name, he appeared in the National Center for Missing & Exploited Children’s missing children database. Kojima was arrested.
According to Heather, the teen was held until his older half-brother, who lived in Kansas, could pick him up.
Looking for answers
In the three months that have passed since the ordeal, the McConneys have tried to process what happened to them and how. They’ve sought therapy, trying to unpack what occurred.
For Heather, Twitter’s involvement has become a focal point.
Heather questioned whether or not Musk’s chaotic takeover of the platform and the sizable layoffs he enacted at the company might have potentially slowed down how quickly the company could respond to law enforcement requests.
In October, Musk fired some of the company’s top legal employees. In November, the company halved the number of engineers and a wave of resignations followed. In January, an NBC News investigation found that despite Musk’s claims that he’d crack down on child exploitation on the platform, hundreds of recent tweets offering to trade and sell child sex abuse material were easy to find.
While many of the internal machinations of Twitter’s child safety team remain unclear, there has been data to suggest that Twitter’s responsiveness has lagged since Musk took over.
According to data from the National Center for Missing & Exploited Children reported by The New York Times, Twitter’s average response time to takedown requests for child sexual abuse material more than doubled in December to 3.5 days.
“We have been trying to reach out and find an attorney that can help us,” Heather said, noting that they’ve considered legal action against Twitter. “People need to understand what is happening on these platforms, and how to prevent it and I think something has got to be done.”
And as their story has been picked apart and analyzed by local and online onlookers, the McConneys say they’ve both faced accusations from onlookers of pushing their child away with homophobia or biphobia. They say that’s not the case.
“We’ve always told our kids, ‘If you want to be a unicorn, be a unicorn, that’s never going to change how I feel about you. I support you,'” Heather said. “Somehow he was able to make my son feel that he couldn’t talk to us about stuff, which is such a deviation from everything we’ve ever told our kids.”
Ken says his mental health has taken a toll and that he’s developed what he characterizes as severe anxiety and depression problems. “I am constantly angry at the world,” he said.
At first, it was hard for the family to leave their house, but Ken said he’s found some moments of hope.
Ken said some in his community have offered inspiration. The other day, a family of strangers offered to pray with the teen in the grocery store, saying they recognized him from the news.
The McConneys’ son is back in school. His parents said discussion of what occurred isn’t a taboo subject in the household, but the teen isn’t open to talking about it just yet.
But Heather says she thinks the teen is starting to process what happened. “I think now he is starting to understand a little bit about the manipulation that went on. But I don’t think he even has a grasp on the full extent of how grooming really works,” she said. “He has his side of the story, but it’s a side that’s been severely manipulated.”
Heather and Ken say they let him play PlayStation sometimes. The teen says he’s also started to enjoy playing with airsoft guns with friends at a local arena. He has a phone — but it’s not connected to the internet and can’t download social media applications.
