Case Document 1 Filed 06/10/15 Page 1 of 20 PagelD fit: 1 UNITED STATES DISTRICT COURT 1 5 3 4 EASTERN DIST OF NEW YORK IN THE MATTER OF AN APPLICATION FOR A To BE FILED UNDER SEAL SEARCH WARRANT FOR: AFFIDAVIT IN SUPPORT OF THE PREMISES KNOWN AND DESCRIBED AS APPLICATION FOR A -- WARRANT 11211 (Fed, R. Ct'imEASTERN DISTRICT OF YORK. SS: JOHN ROBERTSON, being duly sworn. deposes and says that he is a Special Agent with the Federal Bureau of Investigation duly appointed according to law and acting as such. Upon information and beliefi there is probable cause to believe that there is kept and concealed within THE PREMISES KNOWN AND DESCRIBED AS --BROOKLYN. NEW YORK I 1211 (the the items described in Attachment A to this affidavit, all oftvhielt constitute evidence or instrumentalities ofthe possession, access with intent to Viewv trenspottation, receipt. distribution and reproduction of sexually explicit material relating to children. in violation of 18 2251(d) and (advenising, attempting to advertise and conspiracy to advertise child pornography): 18 11.S.C. and (receipl and distribution of. conspiracy to receive and distribute. and attempt to receive and distribute child pornography); and 18 U.S.C. 2252Aia)(5)(B) and (possession of, knowing access, conspiracy ID access. or attempted access with intent to viett child pornography). Case 1:15-mj-00534-WP Document 1 Filed 06/10/15 Page 2 of 20 PageID 2 The source of your deponent?s information and the grounds for his belief are as follows:1 I. I have been a Special Agent with the FBI since November 2006 and am currently assigned to the New York Office. Since February 2013, I have been assigned to a Crimes Against Children squad and have investigated violations of criminal law relating to the sexual exploitation of children. I have gained expertise in this area through classroom training and daily work conducting these types of investigations. As a result of my training and experience, I am familiar with the techniques and methods used by individuals involved in criminal activity to conceal their activities from detection by law enforcement authorities. As part of my responsibilities, I have been involved in the investigation of numerous child pornography cases and have reviewed thousands of photographs depicting minors being sexually exploited by adults. Through my experience in these investigations, I have become familiar with methods of determining whether a child is a minor. I am also a member of the Eastern District of New York Project Safe Childhood Task Force. 2. I have personally participated in the investigation of the offenses discussed below. I am familiar with the facts and circumstances of this investigation from: my own personal participation in the investigation, my review of documents, my training and experience, and discussions I have had with other law enforcement personnel concerning the creation, distribution, and proliferation of CP. Additionally, statements attributable to individuals herein are set forth in sum and substance and in part. 1 Because this affidavit is submitted for the limited purpose of establishing probable cause for a search warrant, have not set forth each and every fact learned during the course of the investigation. Case 1:15-mj-00534-WP Document 1 Filed 06/10/15 Page 3 of 20 PageID 3 I. DEFINITIONS 3. For the purposes of the requested warrant, the following terms have the indicated meaning in this affidavit: a. The terms ?minor,? ?sexually explicit conduct? and ?visual depiction? are de?ned as set forth in Title 18, United States Code, Section 2256. b. The term ?child pornography? is defined in Title 18, United States Code, Section 2256(8) in pertinent part as ?any visual depiction, including any photograph, film, video, picture, or computer or computer-generated image or picture, whether made or produced by electronic, mechanical, or other means, of sexually explicit conduct, where . . . the production of such visual depiction involves the use ofa minor engaging in sexually explicit conduct. . c. The term ?computer? includes all types of electronic, magnetic, optical, electrochemical, or other high speed data processing devices performing logical, arithmetic, or storage functions, including desktop computers, laptops, mobile phones, tablets, server computers, and network hardware, as well as wireless routers and other hardware involved in network and Internet data transfer. d. The term Address? or ?Internet Protocol Address? means a unique numeric address used by computers on the Internet. An IP address looks like a series of four numbers, each in the range 0-255, separated by periods 121.56.97.178). Every computer attached to the Internet must be assigned an IP address so that Internet traf?c sent from and directed to that computer may be directed properly from its source to its destination. Most Internet service providers control a range of IP addresses. Some computers have static that is, long-term IP addresses, while other computers have dynamic that is, frequently changed IP addresses. 0. The term ?Internet? refers to a global network of computers and other electronic devices that communicate with each other. Due to the structure of the Internet, connections between devices on the Internet often cross state and international borders, even when the devices communicating with each other are in the same state. 2 See also Ashcro?? v. ree Speech Coalition, 535 US. 234 (2002) (analyzing constitutional validity ofthe definitions set forth in 18 U.S.C. 2256(8)). Case 1:15-mj-00534-WP Document 1 Filed 06/10/15 Page 4 of 20 PageID 4 d. The term ?storage medium? is any physical object upon which computer data can be recorded. Examples include hard disks, RAM, ?oppy disks, flash memory, CD-ROMs, and other magnetic or optical media. e. ?Bulletin Board? means an Internet-based website that is either secured (accessible with a password) or unsecured, and provides members with the ability to view postings by other members and make postings themselves. Postings can contain text messages, still images, video images, or web addresses that direct other members to speci?c content the poster wishes. Bulletin boards are also referred to as ?internet forums? or ?message boards.? A ?post? or ?posting? is a single message posted by a user. Users of a bulletin board may post messages in reply to a post. A message ?thread,? often labeled a ?topic,? refers to a linked series of posts and reply messages. Message threads or topics often contain a title, which is generally selected by the user who posted the ?rst message of the thread. Bulletin boards often also provide the ability for members to communicate on a one?to-one basis through ?private messages.? Private messages are similar to e-mail messages that are sent between two members of a bulletin board. They are accessible only by the user who sent/received such a message, or by the Website Administrator. f. ?Chat? refers to any kind of communication over the Internet that offers a real-time transmission of text messages from sender to receiver. Chat messages are generally short in order to enable other paiticipants to respond quickly and in a format that resembles an oral conversation. This feature distinguishes chatting from other text-based online communications such as Internet forums and email. g. ?Computer passwords, pass-phrases and data security devices,? refer to information or items designed to restrict access to or hide computer software, documentation, or data. Data security devices may consist of hardware, software, or other programming code. A password or pass-phrase (a string of alpha-numeric characters) usually operates as a sort of digital key to ?unlock? particular data security devices. Data security hardware may include devices, chips, and circuit boards. Data security software of digital code may include programming code that creates ?test? keys or ?hot? keys, which perform ceitain pre?set security functions when touched. Data security software or code may also compress, hide, or ?booby-trap" protected data to make it inaccessible or unusable. and reverse the progress to restore it. 4 Case 1:15-mj-00534-WP Document 1 Filed 06/10/15 Page 5 of 20 PageID 5 II. BACKGROUND OF THE INVESTIGATION A. 4. A website (?Website operated on a network (?the Network?) available to Internet users who are aware of its existence. The Network is designed speci?cally to facilitate anonymous communication over the Internet. In order to access the Network, a user must install computer software that is publicly available, either by downloading software to the user?s existing web browser, downloading free software available from the Network?s administrators, or downloading a publicly?available third-party application. Using the Network prevents someone attempting to monitor an Internet connection from learning what sites a user visits and prevents the sites the user visits from learning the user?s physical location. Because of the way the Network routes communication through other computers, traditional IP identification techniques are not viable. 5. Websites that are accessible only to users within the Network can be set up within the Network and Website A was one such website. Accordingly, Website A could not generally be accessed through the traditional Internet. Only a user who had installed the appropriate software on the user?s computer could access Website A. Even after connecting to the Network, however, a user had to know the exact web address of Website A in order to access it. Websites on the Network are not indexed in the same way as websites on the traditional Internet. Accordingly, unlike on the traditional Internet, a user could not simply perform a Google search for the name of Website A, obtain the web address for Website A, and click on a link to navigate to Website A. Rather, a user had to have obtained the web address for Website A directly from another source, such as other users of Website A, or from online postings describing both the sort of content available on Website A and its location. Accessing Website UI Case 1:15-mj-00534-WP Document 1 Filed 06/10/15 Page 6 of 20 PageID 6 A therefore required numerous affirmative steps by the user, making it extremely unlikely that any user could have simply stumbled upon Website A without first understanding its content and knowing that its primary purpose was to advertise and distribute child pornography. 6. The Network?s software protects users? privacy online by bouncing their communications around a distributed network of relay computers run by volunteers all around the world, thereby masking the user?s actual IP address which could otherwise be used to identify a user. 7. Third party software (?Network Monitoring Program? or ?Investigative Software?) is available to identify the IP address ofthe P2P computer sending the file. Such software monitors and logs Internet and local network traf?c. 8. The Network also makes it possible for users to hide their locations while offering various kinds of services, such as web publishing, forum/website hosting, or an instant messaging server. Within the Network itself, entire websites can be set up which operate the same as regular public websites with one critical exception - the IP address for the web server is hidden and instead is replaced with a Network?based web address. A user can only reach such sites if the user is using the Network client and operating in the Network. Because neither a user nor law enforcement can identify the actual IP address ofthe web server, it is not possible to determine through public lookups where the computer that hosts the website is located. Accordingly, it is not possible to obtain data detailing the activities ofthe users from the website server through public lookups. 9. Website A was a child pornography bulletin board and website dedicated to the advertisement and distribution of child pornography and the discussion of matters pertinent to the sexual abuse of children, including the safety and security of individuals who Case 1:15-mj-00534-WP Document 1 Filed 06/10/15 Page 7 of 20 PageID 7 seek to sexually exploit children online. On or about February 20, 2015, the computer server hosting Website A was seized from a web-hosting facility in Lenoir, North Carolina. The website operated in Newington, Virginia, from February 20, 2015, until March 4, 2015, at which time Website A ceased to operate. Between February 20, 2015, and March 4, 2015, law enforcement agents acting pursuant to an order of the United States District Court for the Eastern District of Virginia monitored electronic communications of users of Website A. Before, during, and after its seizure by law enforcement, law enforcement agents viewed, examined and documented the contents of Website A, which are described below. 10. According to statistics posted on the site, Website A contained a total of 1 17,773 posts, 10,622 total topics, and 214,898 total members as of March 4, 2015. The website appeared to have been operating since approximately August 2014, which is when the first post was made on the message board. On the main page ofthe site, located to either side ofthe site name were two images depicting partially clothed prepubescent girls with their legs spread apait, along with the text underneath stating, ?No cross-board reposts, .72 preferred, filenames, include preview, Peace out.? Based on my training and experience, I know that: ?no cross-board reposts? refers to a prohibition against material that is posted on other websites from being ?re- posted? to ?Website and refers to a preferred method of compressing large files or sets of ?les for distribution. Two data-entry fields with a corresponding ?Login? button were located to the right of the site name. Located below the aforementioned items was the message, "Warning! Only registered members are allowed to access the section. Please login below or ?register an account? hyperlink to the registration page)] with ?[Website Below this message was the "Login" section, consisting of four data-entry ?elds with the corresponding text, "Username, Password, Minutes to stay logged in, and Always stay logged in." Case 1:15-mj-00534-WP Document 1 Filed 06/10/15 Page 8 of 20 PageID 8 1. Upon accessing the ?register an account? hyperlink, there was a message that informed users that the forum required new users to enter an email address that looks to be valid. However, the message instructed members not to enter a real email address. The message further stated that once a user registered (by selecting a user name and password), the user would be able to ?ll out a detailed pro?le. The message went on to warn the user ?[F]or your security you should not post information here that can be used to identify you.? The message further detailed rules for the forum and provided other recommendations on how to hide the user?s identity for the user?s own security. 12. After accepting the above terms, registration to the message board then required a user to enter a username, password, and e-mail account; although a valid e-mail account was not required as described above. 13. After successfully registering and logging into the site, the user could access any number of sections, forums, and sub?forums. Some of the sections, forums, and sub- forums available to users included: How to; General Discussion; [Website information and rules; and Security Technology discussion. Additional sections, forums, and sub?forums included Jailbait Boy; Jailbait Girl; Preteen Boy; Preteen Girl; Pre-teen Videos Girl Pre-teen Videos Boys Toddlers; and Kinky Fetish Scat. Based on my training and experience, I know that ?jailbait? refers to underage but post?pubescent minors; the abbreviation means hardcore depictions of penetrative sexually explicit conduct); and ?scat? refers to the use of feces in various sexual acts, watching someone defecating, or simply seeing the feces. An additional section and forum was also listed in which members could exchange usernames on a Network?based instant messaging service that Case 1:15-mj-00534-WP Document 1 Filed 06/10/15 Page 9 of 20 PageID 9 I know, based upon my training and experience, to be commonly used by subjects engaged in the online sexual exploitation ofchildren. 14. A review of the various topics within the above forums revealed each topic contained a title, the author, the number of replies, the number of views, and the last post. The ?last post? section of a particular topic included the date and time of the most recent posting to that thread as well as the author. Upon accessing a topic, the original post appeared at the top of the page, with any corresponding replies to the original post included in the post thread below it. Typical posts appeared to contain text, images, thumbnail-sized previews of images, compressed ?les (such as Roshal Archive ?les, commonly referred to as ?.rar? ?les, which are used to store and distribute multiple ?les within a single links to external sites, or replies to previous posts. 15. A review of the various topics within the ?[Website information and rules,? ?How to,? ?General Discussion,? and ?Security Technology discussion? forums revealed that the majority contained general information in regards to the site, instructions and rules for how to post, and welcome messages between users. 16. A review of topics within the remaining forums revealed the majority contained discussions about, and numerous images that appeared to depict, child pornography and child erotica depicting prepubescent girls, boys, and toddlers. Examples of these are as follows: a. On February 3, 2015, a user posted a topic entitled ?Buratino-06" in the forum ?Pre-teen Videos - Girls that contained numerous images depicting child pornography of a prepubescent or early pubescent girl. One of these images depicted the girl being orally penetrated by the penis ofa naked male; b. On January 30, 2015, a user posted a topic entitled ?Sammy? in the forum "Pre-teen Photos Girls? that contained hundreds of images depicting child pornography ofa prepubescent girl. One of these images depicted the female Case 1:15-mj-00534-WP Document 1 Filed 06/10/15 Page 10 of 20 PageID 10 being orally penetrated by the penis ofa male; and c. On September 16, 2014, a user posted a topic entitled ?9yo Niece - Horse.mpg? in the ?Pre-teen Videos - Girls forum that contained four images depicting child pornography of a prepubescent girl and a hyperlink to an external website that contained a video file depicting what appeared to be the same prepubescent girl. Among other things, the video depicted the prepubescent female, who was naked from the waist down with her vagina and anus exposed, lying or sitting on top of a naked adult male, whose penis was penetrating her anus. 17. A list of members, which was accessible after registering for an account, revealed that approximately 100 users made at least 100 posts to one or more of the forums. Approximately 31 of these users made at least 300 posts. In total, Website A contained thousands of postings and messages containing child pornography images. Those images included depictions of nude prepubescent minors lasciviously exposing their genitals or engaged in sexually explicit conduct with adults or other children. 18. Website A also included a feature referred to as ?[Website Image Hosting.? This feature of Website A allowed users of Website A to upload links to images of child pornography that are accessible to all registered users of Website A. On February 12, 2015, an FBI Agent accessed a post on Website A titled ?Giselita? which was created by a particular Website A user. The post contained links to images stored on ?[Website Image Hosting.? The images depicted a prepubescent girl in various states of undress. Some images were focused on the nude genitals of a prepubescent girl. Some images depicted an adult male's penis partially penetrating the vagina of a prepubescent girl. Text sections of Website A provided forums for discussion of methods and tactics to use to perpetrate child sexual abuse. For example, on January 8, 2015, a user posted a topic entitled "should i proceed?" in the forum "Stories - Non-Fiction? that contained a detailed accounting of an alleged encounter between the user and a 5 year old girl. The user wrote felt amazing 10 Case 1:15-mj-00534-WP Document 1 Filed 06/10/15 Page 11 of 20 PageID 11 feeling her hand touch my dick even if it was through blankets and my pajama The user ended his post with the question, ?should I try to proceed?? and further stated that the girl ?seemed really interested and was smiling a lot when she felt my cock.? A different user replied to the post and stated, her see the bulge or even let her feel you don't know how she might react, at this stage it has to be very B. COURT AUTHORIZED USE OF NETWORK INVESTIGATIVE TECHNIQUE 19. Websites generally have Internet Protocol address logs that can be used to locate and identify the site?s users. In such cases, after the seizure of a website whose users were engaging in unlawful activity, law enforcement could review those logs in order to determine the IP addresses used by users of Website A to access the site. A publicly available lookup could then be performed to determine what Internet Service Provider owned the target IP address. A subpoena could then be sent to that ISP to determine the user to which the IP address was assigned at a given date and time. 20. However, because of the Network software utilized by Website A, any such logs of user activity would contain only the IP addresses of the last computer through which the communications of Website A users were routed before the communications reached their destinations. The last computer is not the actual user who sent the communication or request for information, and it is not possible to trace such communications back through the Network to that actual user. Such IP address logs therefore could not be used to locate and identify users of Website A. 21. Accordingly, on February 20, 2015, the same date Website A was seized, the United States District Court for the Eastern District of Virginia authorized a search warrant to allow law enforcement agents to deploy a Network Investigative Technique on Website ll Case 1:15-mj-00534-WP Document 1 Filed 06/10/15 Page 12 of 20 PageID 12 A in an attempt to identify the actual IP addresses and other identifying information of computers used to access Website A. 22. Pursuant to that authorization, on or about and between February 20, 2015, and March 4, 2015, each time any user or administrator logged into Website A by entering a username and password, the FBI was authorized to deploy the NIT which would send one or more communications to the user?s computer. Those communications were designed to cause the receiving computer to deliver to a computer known to or controlled by the government data that would help identify the computer, its location, other information about the computer, and the user ofthe computer accessing Website A. That data included: the computer?s actual IP address, and the date and time that the NIT determined what that IP address was; a unique identifier generated by the NIT a series of numbers, letters, and/or special characters) to distinguish the data from that of other computers; the type of operating system running on the computer, including type Windows), version Windows 7), and architecture 86); information about whether the NIT had already been delivered to the computer; the computer?s Host Name; the computer's active operating system username; and the computer?s MAC address. C. ACTIVITY OF 23? ON WEBSITE A 23. According to data obtained from logs on Website A, monitoring by law enforcement, and the deployment of a NIT, a user with the user name ?plowden23? engaged in the following activity on Website A. 24. The pro?le page of user ?plowden23? indicated this user originally registered an account on Website A on September 3, 2014. Profile information on Website A may include contact information and other information that is supplied by the user. It also Case 1:15-mj-00534-WP Document 1 Filed 06/10/15 Page 13 of 20 PageID 13 contains information about that user?s participation on the site, including statistical information about the user?s posts to the site and a categorization ofthose posts. According to the user ?plowden23?s? pro?le, this user was a ?newbie? Member of Website A. Further, according to the Statistics section of this user?s pro?le, the user ?plowden23? had been actively logged into the website for a total of 216 hours on or about and between September 3, 2014 and March 1, 2015. 25. According to data obtained from logs on Website A, monitoring by law enforcement, and the deployment of a NIT, on February 26, 2015, the user ?plowden23? engaged in the following activity on Website A from IP address 67.243.156.191. During the session described below, this user browsed Website A after logging into Website A with a username and a password. 26. On February 26, 2015, the user ?plowden23? with IP address 67.243.156.191 accessed the post entitled ?Valya thread? in the section ?Pre-teen Videos Girls Based upon my training and experience I know that is a common acronym for ?hardcore.? Among other things, this post contained a set of 16 images that depicted a prepubescent female, wearing white stockings with a hole cut in the genital area. In two of the images the prepubescent female is depicted holding a phallic shaped object in or around her exposed genitals. Two of the images depict the prepubescent female bent over at the waist with the image focused on her exposed genitals and anus. Several of the remaining images depict the prepubescent female engaged in genital intercourse with an adult male. 27. During the following additional sessions, the user ?plowden23? also browsed Website A after logging into Website A with a username and password. During these sessions, the user?s IP address information was not collected. Case 1:15emje00534eVVP Document 1 Filed 06/10/15 Page 14 of 20 PagelD 14 28. On Februar) 25. 2015. the user "plondenzs" accessed a post rhat contained a link to a series