UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF NORTH CAROLINA STATESVILLE DIVISION UNITED STATES OF AMERICA v. (1) STEVEN W. CHASE ) ) ) ) ) ) ) DOCKET NO. 5:15CR15-RLV UNITED STATE’S RESPONSE TO DEFENDANT’S MOTION TO DISMISS INDICTMENT Now comes the United States of America, by and through Jill Westmoreland Rose, United States Attorney for the Western District of North Carolina, Cortney Randall, Assistant United States Attorney for said District, and Reginald E. Jones, Trial Attorney, and submits the following response opposing defendant Steven Chase’s Motion to Dismiss. As discussed more fully below, Chase was identified and arrested prior to the government’s seizure and subsequent brief operation of the “Playpen” child pornography website. As such, the government’s brief operation of Playpen to deploy a courtauthorized Network Investigative Technique (“NIT”) and to conduct authorized monitoring of user communications in order to identify website users is unrelated to the conduct for which Chase is being prosecuted. For this reason alone, Chase’s motion to dismiss is meritless and should be denied without the need for a hearing. Further, Chase mischaracterizes the facts of the government’s brief operation of Playpen and his motion to dismiss lacks support under Fourth Circuit precedent. Finally, no court has concluded that the government’s conduct was outrageous despite similar 1 Case 5:15-cr-00015-RLV-DCK Document 82 Filed 09/01/16 Page 1 of 18 allegations raised by defendants who (unlike Chase) were actually identified as a result of the government’s brief operation of the website and deployment of the NIT. I. BACKGROUND The charges in this case arise from Chase’s role as creator and primary administrator of the Playpen child pornography website operating on the anonymous Tor network. The scale of child sexual exploitation on the website was massive: more than 150,000 total members created and viewed tens of thousands of postings related to child pornography. Images and videos shared through the site were highly categorized according to victim age and gender, as well as the type of sexual activity. The site also included forums for discussion for all things related to child sexual exploitation, including tips for grooming victims and avoiding detection. Playpen operated on the anonymous Tor network. Tor was created by the U.S. Naval Research Laboratory as a means of protecting government communications. It is now available to the public. The Tor network—and the anonymity it provides—is a powerful tool for those who wish to share ideas and information, particularly those living in places where freedom of speech is not accorded the legal protection it is here. But this anonymity has a downside. The Tor network is a haven for criminal activity in general, and the online sexual exploitation of children in particular. See Over 80 Percent of DarkWeb Visits Relate to Pedophilia, Study Finds, WIRED MAGAZINE, December 30, 2014, available at: http://www.wired.com/2014/12/80-percent-dark-web-visits-relatepedophiliastudy-finds/ (last visited November 13, 2015). 2 Case 5:15-cr-00015-RLV-DCK Document 82 Filed 09/01/16 Page 2 of 18 Use of the Tor network masks the user’s actual Internet Protocol (“IP”) address, which could otherwise be used to identify a user, by bouncing user communications around a network of relay computers (called “nodes”) run by volunteers.1 To access the Tor network, users must install Tor software either by downloading an add-on to their web browser or the free “Tor browser bundle.” Users can also access Tor through “gateways” on the open Internet that do not provide users with the full anonymizing benefits of Tor. When a Tor user visits a website, the IP address visible to that site is that of a Tor “exit node,” not the user’s actual IP address. Tor is designed to prevent tracing the user’s actual IP address back through that Tor exit node. Accordingly, traditional IP address-based identification techniques used by law enforcement on the open Internet are not viable. Within the Tor network itself, certain websites, including Playpen, operate as “hidden services.” Like other websites, they are hosted on computer servers that communicate through IP addresses. They operate the same as other public websites with one critical exception: namely, the IP address for the web server is hidden and replaced with a Tor-based web address, which is a series of sixteen algorithm-generated characters followed by the suffix “.onion.” A user can only reach a “hidden service” by using the Tor client and operating in the Tor network. And unlike an open Internet website, it is not possible to use public lookups to determine the IP address of a computer hosting a “hidden service.” 1 Additional information about Tor and how it works can be found at www.torproject.org. 3 Case 5:15-cr-00015-RLV-DCK Document 82 Filed 09/01/16 Page 3 of 18 A “hidden service” like Playpen is also more difficult for users to find. Even after connecting to the Tor network, users must know the exact web address of a “hidden service” in order to access it. Accordingly, in order to find Playpen, a user had to first get the web address for it from another source—such as another Playpen user or online postings identifying Playpen’s content and location. Accessing Playpen thus required numerous affirmative steps by the user, making it extremely unlikely that any user could have simply stumbled upon it without first understanding its child pornography-related content and purpose. Although the FBI was able to view and document the substantial illicit activity occurring on Playpen, investigators faced a tremendous challenge when it came to identifying Playpen users. Because Tor conceals IP addresses, normal law enforcement tools for identifying Internet users would not work. So even if law enforcement managed to locate Playpen and its IP logs, traditional methods of identifying its users would have gone nowhere. Acting on a tip from a foreign law enforcement agency as well as information from its own investigation, the FBI determined that the computer server that hosted Playpen was located at a web-hosting facility in North Carolina and that Chase was the administrator of the server. The FBI was subsequently able to determine that Chase was also the creator and primary administrator of Playpen. On February 18, 2015, Chase was charged in the Western District of North Carolina with engaging in a child exploitation enterprise, conspiracy to advertise child pornography, advertising child pornography, transporting child pornography, and possession of child pornography. On February 19, a search warrant 4 Case 5:15-cr-00015-RLV-DCK Document 82 Filed 09/01/16 Page 4 of 18 was executed at Chase’s Naples, Florida residence. Upon entering the residence, FBI agents encountered Chase and soon thereafter observed a laptop powered on and connected to the Playpen website. Chase, the only occupant of the home, was subsequently arrested. The FBI seized, and subsequently searched the laptop, along with several other devices. A subsequent review of the evidence seized at Chase’s residence revealed files containing the Playpen logo, bookmarked links of Playpen forums, and more than 8,900 images depicting child abusive/exploitative material stored on his devices. After the defendant’s arrest on February 20, 2015, FBI subsequently seized and assumed administrative control of the website – which had already been operating for six months – for approximately two weeks in order to deploy a court-authorized Network Investigative Technique (the “NIT”) and to conduct court-authorized monitoring of user communications to identify Playpen’s users. In his motion to dismiss, Chase alleges that the government’s brief continued operation of the website to identify users amounts to “outrageous government conduct,” and therefore seeks dismissal of the Indictment. However, as previously articulated, Chase was identified and arrested prior to the government’s seizure and subsequent brief operation of the “Playpen” child pornography website. As such, the government’s brief operation of Playpen to deploy a court-authorized Network Investigative Technique (“NIT”) and to conduct authorized monitoring of user communications in order to identify website users other than Chase is unrelated to the conduct for which Chase is being prosecuted. For this reason alone, Chase’s motion to dismiss is meritless and should be denied. 5 Case 5:15-cr-00015-RLV-DCK Document 82 Filed 09/01/16 Page 5 of 18 Nevertheless, without conceding any merit to Chase’s motion to dismiss, the government will briefly address, why, even if Chase had been identified as a result of the government’s brief operation of Playpen and deployment of the NIT, his motion lacks support under Fourth Circuit precedent. The Fourth Circuit has established that a defendant alleging outrageous government conduct must demonstrate that the government has done something that shocks the court’s conscience. This Chase cannot do. II. LEGAL STANDARDS In order to obtain dismissal for purported “outrageous government conduct,” Chase must demonstrate that he suffered a constitutional due process violation that is “outrageous, not merely offensive.” United States v. Goodwin, 854 F.2d 33, 37 (4th Cir. 1998). The Fourth Circuit has “never held in a specific case that the government has violated the defendant's due process rights through outrageous conduct.” United States v. Hasan, 718 F.3d 338, 343 (4th Cir. 2013) (holding that law remains clear in the Fourth Circuit that ‘outrageous conduct’ doctrine survives in theory, but is highly circumscribed”). While other circuits have articulated a series of factors to guide an outrageousness inquiry, see e.g., United States v. Black, 733 F.3d 294, 303 (9th Cir. 2013), the Fourth Circuit has not set forth a comprehensive list. It has however consistently held that to provide relief, the doctrine requires conduct so outrageous as to shock the conscience of the court, which will only occur in rare cases. United States v. Dyess, 478 F.3d 224, 334 (4th Cir. 2007). Government conduct is not outrageous just because it involves a sting operation in a child pornography investigation. In Goodwin, the government identified its targets by 6 Case 5:15-cr-00015-RLV-DCK Document 82 Filed 09/01/16 Page 6 of 18 answering advertisements apparently seeking child pornography and by using lists transmitted by the Customs Service of the names of persons to whom such material had been sent from overseas and subsequently seized. In affirming the district court’s determination that the government’s conduct did not violate Goodwin’s due process rights, the Fourth Circuit emphasized that “outrageous” is not a label properly applied to conduct just because it is a sting operation. Id at 37. The court also held that the due process calculation must take into consideration the nature of the crime involved, noting that undercover operations provide a means by which participants in the clandestine child pornography industry can be detected. Id. The court ultimately concluded that the sting operation was “neither shocking nor offensive to traditional notions of fundamental fairness.” In United States v. Osborne, Osborne alleged that the government’s conduct in placing an advertisement and conducting a sting operation to uncover violations of 18 U.S.C. Section 2252(a)(2) was so outrageous as to have violated his Fifth Amendment right to due process of law, and that this conduct induced him to violate the law and thus constituted entrapment. The Fourth Circuit rejected this argument concluding that, “given the abundant and lenient appellate precedent concerning constitutionally permissible government conduct in undercover operations, it is clear that the government’s conduct in the sting operation involving the defendant is far from outrageous by constitutional standards.” 935 F.2d 32, 37 (4th Cir. 1991). 7 Case 5:15-cr-00015-RLV-DCK Document 82 Filed 09/01/16 Page 7 of 18 III. ARGUMENT Should the Court reach this issue, nothing to which Chase points comes even remotely close to a violation of his due process rights, let alone one that is so outrageous as to shock the conscience. The government briefly assumed control of the website Chase created in order to conduct court-authorized monitoring of user communications and deploy a court-authorized investigative technique to identify those users, who were hiding their identities via technological means. Chase may disagree with the methods the government used to catch others. That does not render the government’s court-authorized investigative techniques outrageous. Accordingly, the Court should deny the motion. A. The Government Played No Role in Creating the Crime for Which Chase is Being Prosecuted or Otherwise Encouraged His Criminal Conduct. Chase created the Playpen website, not the government. Moreover, Chase had been administrating Playpen for months when the website was identified by law enforcement. Soon thereafter, Chase was identified and arrested prior to the government’s seizure and subsequent brief operation of Playpen. The government therefore bore no responsibility for Chase’s criminal conduct and the medium by which the government ultimately identified Chase existed before and completely apart from the government’s subsequent role in briefly hosting and monitoring the website to identify its users. This matters because courts have recognized that “outrageous” conduct is more likely to be found were the government fabricates the crime and then invites the defendant along for the ride. See, e.g., United States v. Mayer, 503 F.3d 740, 754 (9th Cir. 2007) (finding no outrageous government conduct and noting that the defendant was the first to 8 Case 5:15-cr-00015-RLV-DCK Document 82 Filed 09/01/16 Page 8 of 18 broach the subject of traveling internationally to have sex with boys). That is clearly not the case here. Further, the duration of the government’s operation of Playpen was exceedingly brief: two weeks. Chase created and operated the website for months prior to being arrested and the FBI obtaining control of the server. Moreover, while briefly operating Playpen, the FBI did not post any images, videos, or links to child pornography on the website. Chase, along with Playpen users under investigation, were responsible for that content. While images, videos, and links posted by site users (both before the FBI assumed administrative control and after) generally remained available to site users for a limited time period, for reasons explained below, removing all of that content would have jeopardized the investigation and the opportunity to identify and locate the users who possessed, distributed, and accessed it. Chase claims that law enforcement made no effort to curtail the redistribution of child pornography through Playpen or to determine whether images posted pertained to new, as opposed to known, images of child pornography. See Def. Mot to Dismiss at 14. He is incorrect and views the government’s actions through an unduly narrow lens. While Playpen operated under FBI administrative control, law enforcement authorities with the FBI monitored all site postings, chat messages, and private messages continuously to comply with Title III monitoring requirements and to access and mitigate risk of imminent harm to children. In the event FBI Special Agents perceived a risk of imminent harm to a child, agents took actions to mitigate that risk and immediately forwarded available 9 Case 5:15-cr-00015-RLV-DCK Document 82 Filed 09/01/16 Page 9 of 18 identifying information, including NIT results, to the appropriate FBI office. Actions taken in any particular instance were tailored to the specific threat of harm. B. The Government Played No Role in Enhancing or Improving the Functionality of the Website Chase claims absent actual factual support that the government enhanced or improved the website’s functionality. See Def. Mot to Dismiss at 15. He is incorrect. His argument appears to be related to a misunderstanding, or misinterpretation, regarding certain postings to the website. When the FBI first assumed administrative control of the Playpen website, it experienced connectivity issues for a few days. Such connectivity issues are typical of all Tor hidden services, and eventually resolved themselves. One posting attached to Chase’s motion was made after the connectivity issues were resolved to reference the fact that the connectivity issues had resolved themselves. See Def. Ex. 3, p. 4.2 In addition, the Playpen website included a file hosting service. That service was brought back online shortly after the website itself was brought back online. The second posting attached to Chase’s motion simply commemorates that pre-existing portion of the site coming back online. No feature was added to the site. See Def. Ex. 3, p. 5. Chase also claims that the FBI was responsible for an increase in traffic to the Playpen website. See Def. Mot to Dismiss at 9. Again, Chase is incorrect. As reflected in the warrant seeking authority to deploy a Network Investigative Technique on the site, FBI analysis of historical data seized from Playpen indicated an average of 11,000 unique users 2 The reference in that posting to an “upgrade” from “token ring” to “ethernet” was nothing more than an ironic reference to old networking technology. “Token ring” refers to a networking technology from the 1980s. In actuality, the FBI did not “upgrade” anything. 10 Case 5:15-cr-00015-RLV-DCK Document 82 Filed 09/01/16 Page 10 of 18 visited the site over the course of a week. That average included information from the site’s inception until its seizure – including from the time near the site’s inception when there would have been fewer users than at the time of seizure, when the site included more users. In any event, FBI took no actions to increase the number of Playpen visitors. C. The Government’s Conduct Was Necessary Given the Anonymous Network Chase and Other Playpen Members Used When Advertising, Sharing, and Viewing Child pornography Additionally and independently, the government disagrees with Chase’s characterization of its involvement in the Playpen website. The investigative means the government undertook were necessary to combat the underground child pornography trade and, further, to root out those who hid in the shadows of the Internet to exploit children. As the government explained to the judges who authorized the NIT and the Title III – and as those judges apparently agreed – the brief, continued operation of Playpen in order to deploy the NIT was necessary to identify individuals actively sharing child pornography. Playpen users used technology to conceal their identities and locations. They did not do so for fear of discovery of some lawful, if distasteful, pursuit. Rather, they sought a safe haven where they could share depictions of small children being raped, sodomized, beaten, humiliated, and victimized in nearly every conceivable fashion without fear of law enforcement intervention. But for the government’s investigation, these offenders would have succeeded in remaining hidden. The government explained, in great detail, the problem it faced in identifying these criminals and why other investigative 11 Case 5:15-cr-00015-RLV-DCK Document 82 Filed 09/01/16 Page 11 of 18 alternatives were simply not likely to succeed. See Def. Ex. 1, p. 22-24, ¶¶ 29-32 and Gov. Ex. 1, p. 38-43, ¶¶ 63-753. Chase also suggests that the government should have identified his fellow offenders using other means. See Def. Mot. to Dismiss at 21. His proposals, unsurprisingly, fail to account for the sort of advanced technical means that Playpen users employed. As the government explained in its application for the Title III authorization, for the NIT to have an opportunity to work, members had to be able to continue to access the website with as minimal an interruption in the operation of the site as possible. This was necessary to avoid creating suspicion that a law enforcement interdiction was taking place. The government and the signing judicial official recognized that interruptions in the service of the Playpen website would tip-off suspects that law enforcement infiltration was taking place. To be sure, agents considered seizing Playpen and removing it from existence immediately. Doing so might have ended child pornography trafficking on Playpen, but it would have come at a great cost: squandering any hope of identifying and apprehending the offenders responsible for engaging in hands-on exploitation as well as identifying and prosecuting those users. In other words, while such a tactic might have answered the immediate issue of child pornography trafficking on Playpen, it would have done nothing to address the larger problem. For the same reason, the other investigative alternatives Chase claims would have been preferable—e.g., allowing users to login, thus permitting the deployment of the NIT, but restrict users’ ability to download images from the website, 3 “Playpen” is referenced in the affidavits as “Website A.” 12 Case 5:15-cr-00015-RLV-DCK Document 82 Filed 09/01/16 Page 12 of 18 or disabling portions of the site that contained child pornography while allowing users to navigate other portions of the site, see Def. Mot. to Dismiss at 14, would likely have tipped users off to the fact of law enforcement infiltration and thus prevented law enforcement from identifying them. Numerous child pornography bulletin boards similar in structure and function to Playpen currently operate on the Tor network. Collectively, the bulletin boards contain hundreds of thousands of user accounts and tens of thousands of postings that facilitate access to a momentous stockpile of images and videos of child pornography. Law enforcement agents can view and document those websites, their contents, and the child pornography images and videos trafficked through them. Because they operate as Tor hidden services, however, the location of the computer servers hosting the websites, the locations and identities of their users who are perpetrating crimes against children, and their child victims, remain unknown. Moreover, utilizing an alternative means would have frustrated agents’ attempts to obtain information that could help identify and rescue child victims from ongoing abuse. Accordingly, it was the judgment of law enforcement that the seizure and continued operation of Playpen for a discrete period of time, paired with the deployment of a NIT and monitoring of user communications, was necessary and appropriate to identify Playpen users. Two federal judges authorized the means for implementing that investigation. Stopping the unlawful possession and dissemination of child pornography, and rescuing children from ongoing abuse and exploitation, requires more than merely shutting down a facility through which such materials are disseminated. It was imperative that law 13 Case 5:15-cr-00015-RLV-DCK Document 82 Filed 09/01/16 Page 13 of 18 enforcement authorities also identify and apprehend the perpetrators. Here, the FBI briefly assumed administrative control over an existing facility through which users were already posting and accessing child pornography to deploy a court-authorized investigative technique and engage in court-authorized monitoring of user communications. These tactics—designed to identify the perpetrators—were necessitated by the particular anonymizing technology deployed by the users of the site. Undoubtedly, the decision whether to simply shut down a website like Playpen or to allow it to continue operating was a difficult one for law enforcement, given that users would continue to be able to post and access child pornography. Here, that difficult decision, which was disclosed to two different judges, was amply justified by the particular facts of the investigation. To date, the resulting investigation has identified or recovered at least 38 children who were subject to sexual abuse and exploitation by site users. The strong rationale supporting this investigation counsels against any finding of outrageousness. D. No Court Has Concluded that the Government’s Conduct was Outrageous Despite Similar Allegations raised by Defendants who (unlike Chase) were Actually Identified as a Result of the Government’s Brief Operation of the Website and Deployment of the NIT Chase has largely piggy-backed on the arguments of defendants who were identified as a result of the government’s brief operation of Playpen and deployment of the NIT who have characterized the government’s conduct as “outrageous” and, consequently, sought the extraordinary remedy of dismissal. Notably, Chase did not identify a single Playpen case that resulted in dismissal of an indictment. He does not because he cannot. Simply put, no court has concluded that the government’s conduct in this matter was outrageous. 14 Case 5:15-cr-00015-RLV-DCK Document 82 Filed 09/01/16 Page 14 of 18 To the government’s knowledge, two courts have ruled upon a Playpen motion to dismiss for outrageous conduct to date, United States v. Michaud, CR15-5351RJB (W.D. Wash.) and U.S. v. Chauvin, CR15-265 (E.D. LA.). In United States v. Michaud, a case where a defendant was actually identified as a result of the government’s brief operation of the website and deployment of the NIT, the district court denied the request to dismiss and offered a clear and succinct assessment: It is easy to argue, and, my gosh, we hear it in all kinds of cases, that the other side’s position is outrageous. Well, you know, that’s a high standard. From the standpoint of one who stands between the defendant and the government, and represents neither side, you look at what happened and look inward. I am not shocked by this. I did not find it outrageous. To the extent that this Court reaches this issue, it should come to the same conclusion. CONCLUSION The Court should deny Chase’s motion because the conduct about which he complains had nothing to do with the conduct for which he is charged. Should this Court reach this issue, however, the court should deny the motion in any event because Chase fails to point to any due process violation, let alone one that is so outrageous as to shock the conscience. The government’s conduct in this investigation was court-authorized and specifically targeted to identify serious criminals using technology to obscure their identity while exploiting children. That conduct was neither inappropriate nor outrageous. That Chase disagrees with those methods is no reason to dismiss his Indictment. RESPECTFULLY SUBMITTED, this the 1st day of September, 2016. JILL WESTMORELAND ROSE UNITED STATES ATTORNEY 15 Case 5:15-cr-00015-RLV-DCK Document 82 Filed 09/01/16 Page 15 of 18 s/ Cortney S. Randall Assistant United States Attorney NC Bar Number: 31510 Attorney for the United States United States Attorney’s Office 227 West Trade Street, Suite 1650 Charlotte, North Carolina 28202 Telephone: 704.344.6222 Fax: 704.344.6629 E-mail: cortney.randall@usdoj.gov s/ Reginald E. Jones Trial Attorney Mississippi Bar Number: 102806 Attorney for the United States U.S. Department of Justice, Criminal Division Child Exploitation and Obscenity Section Telephone: 202.616.2807 Reginald.Jones4@usdoj.gov 16 Case 5:15-cr-00015-RLV-DCK Document 82 Filed 09/01/16 Page 16 of 18 CERTIFICATE OF SERVICE The undersigned hereby certifies that on this day, September 1, 2016, the foregoing was duly served upon counsel for the defendant by electronic means via the Court’s ECF system to: Peter Adolf Attorney for Defendant Peter_Adolf@fd.org s/ Cortney S. Randall Assistant United States Attorney NC Bar Number: 31510 Attorney for the United States United States Attorney’s Office 227 West Trade Street, Suite 1650 Charlotte, North Carolina 28202 Telephone: 704.344.6222 Fax: 704.344.6629 E-mail: cortney.randall@usdoj.gov s/ Reginald E. Jones Trial Attorney Mississippi Bar Number: 102806 Attorney for the United States U.S. Department of Justice, Criminal Division Child Exploitation and Obscenity Section Telephone: 202.616.2807 Reginald.Jones4@usdoj.gov 17  Case 5:15-cr-00015-RLV-DCK Document 82 Filed 09/01/16 Page 17 of 18 18 Case Document 82 Filed 09/01/16 Page 18 of 18 IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF VIRGINIA ALEXANDRIA DIVISION IN THE MATTER OF THE APPLICATION OF THE UNITED STATES OF AMERICA 2 CASE NO. FOR AN ORDER AUTHORIZING THE INTERCEPTION OF- ELECTRONIC UNDER SEAL COMMUNICATIONS ATTACHMENT A Case Document 82-1 Filed 09/01/16 Page 1 Of 62 IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF VIRGINIA ALEXANDRIA DIVISION - 2&15 20 A 8: :9 IN THE MATTER OF THE APPLICATION OF THE UNITED STATES OF AMERICA i COMMUNICATIONS - DER SEAL APPLICATION FOR AN ORDER AUTHORIZING INTERCEPTION OF ELECTRONIC COMMUNICATIONS The United States of America, by and through Assistant United States Attorney Whitney Dougherty Russell and. Trial Attorney Michael Grant (hereinafter ?the prosecutors?), hereby applies to the Court pursuant to Section 2518 of Title 18, United States Code, for an Order authorizing the interception of electronic communications. In support of this application, counsel states the following: I 1. The prosecutors are investigative or law enforcement of?cers of the United States within the meaning of Section 2510(7) Of Title 18, United States Code, that is, attorneys authorized by law to prosecute or participate in the prosecution of offenses enumerated in Section 2516(l)(c) of Title 18, United States Code. 2. A copy of the memorandum of an of?cial specially designated by the Attorney General of the United States authorizing this application is attached to this application as Exhibit A. I 3. This application is for an order pursuant to Section 2518 Of States Code, authorizing the interception of electronic communications of - and other unidenti?ed administrators and users of the child pornography web-site upf45jv3bziuctml.onion occurring 1 . Case Document 82-1 Filed 09/01/16 Page 2 of 62 over the private message function FACILITY and private chat function FACILITY of the TARGET WEBSITE, concerning offenses enumerated in Section 2516 of Title 18, United States Code. 4. The prosecutors have'discussed the circumstances of the above offenses with Special Agent Cal-iope Bletsis of the Federal Bureau of Investigation, who has participated in the conduct of this investigation, and have examined the af?davit of Special Agent Bletsis, which is attached as Exhibit to this application and is incorporated herein by reference. Based upon that af?davit, your applicants state upon information and belief that: a. there is probable cause to believe that the TARGET SUBJECTS have committed, are committing, and will continue to commit violations of the following offenses: i. 18 U.S.C. Engaging in a Child Exploitation Enterprise; ii. 18 U.S.C. 2251(d)(l) and Advertising and Con3piracy to Advertise Child Pornography; 18 and Receipt and Distribution and I Conspiracy'to Receive and Distribute Child Pornography; iv. 18 U.S.C. and Knowing Access or Attempted Access With Intent to View Child Pornography; and b. there is probable cause that the TARGET SUBJECTS, during the period of interception authorized by this Order, will use TARGET FACILITY and TARGET FACILITY 2 (together referred to as the in furtherance of the offenses described above; c. There is probable cause to believe that the interception of electronic 2 Case Document 82-1 Filed 09/01/16 Page 3 of 62 communications of the TARGET SUBJECTS over the TARGET FACILITIES will reveal: (I) the nature, extent and methods of Operation of the TARGET unlawful activities; (2) the identity of the TARGET SUBJECTS and their victims, accomplices, aiders and abettors, co-conspirators and participants in their illegal activities, or information that may be use?il in establishing the identity of their victims, accomplices, aiders and abettors, co?conspirators and participants in their illegal activities; (3) the advertising, receipt, and distribution of child pornography related to those activities; (4) the existence and locations of records relating to those activities; and (5) the location and identity of computers used to further the target offenses; in addition, these electronic communications are eXpected. to constitute admissible evidence of the commission of the above~described offenses. It is expected that monitoring of the electronic communications of the TARGET SUBJECTS over the TARGET FACILITIES, if authorized, will provide valuable evidence against the TARGET SUBJECTS and others currently unknown to law enforcement involved in illegal activities that cannot reasonably be obtained by other means; and d. It. has been established as detailed in the attached Af?davit that normal investigative procedures have been tried and have failed, reasonably appear unlikely to succeed if tried, or are too dangerous to employ. 5. There are no previous applications which are known to have been made to any judge of competent jurisdiction for approval of the interception of the oral, wire or electronic communications of any of the same individuals, facilities, or premises speci?ed in this Application, except as set forth in the affidavit. 3 Case Document 82-1 Filed 09/01/16 Page 4 of 62 6. This Court has territorial jurisdiction to issue the requested order under 18 U.S.C. 2518(3) because the computer server intercepting all communications and on which the TARGET WEBSITE, including the TARGET FACILITIES, are located will be in Newington, VA, in the Eastern District of Virginia during the period of interception. WHEREFORE, there is probable cause to believe that the TARGET SUBJECTS are engaged in the commission of offenses involving violations of Title 18, United States Code, Sections 2251 and 2252A, and that during the period of interception applied for herein, the TARGET SUBJECTS will use the TARGET FACILITIES to communicate with each other and with others as yet unknown, in connection with the commission of the above~described offenses. The prosecutors also believe that, if the interception herein applied for' is authorized by this Court, electronic communications of the TARGET SUBJECTS concerning those offenses will be intercepted. 7. On the basis of the allegations contained in this application, which in turn is based on the attached affidavit of Special Agent Bletsis: IT IS HEREBY REQUESTED that this Court issue an order pursuant to the power conferred upon it by Section 2518 of Title 18, United States Code, authorizing FBI and/or individuals employed by or Operating under a contract with the government and acting under the supervision of the FBI, to intercept electronic communications of the TARGET SUBJECTS, occurring over the TARGET FACILITIES, until such electronic communications are intercepted that fully reveal: (1) the nature, extent and methods of operation of the TARGET unlawful activities; (2) the identity of the TARGET SUBJECTS and their victims, accomplices, aiders and abettors, co?conSpirators and participants in their illegal activities, orinformation that may be useful in establishing 4 Case Document 82-1 Filed 09/01/16 Page 5 of 62 the identity of their victims, accomplices, aiders and abettors, co?conspirators and participants in their illegal activities; (3) the receipt and distribution of child pornography related to those activities; (4) the existence and locations of records relating to those activities; (5.) the location and identity of computers used to further the target offenses; and (6) admissible evidence of the commission, of the above-described offenses - or for a period of thirty (30) days, to be measured from the earlier of the day on which the investigative or law enforcement of?cer first begins to conduct an interception under the Order or 10 days after the Order is entered, whichever is earlier from the date of this authorization. IT IS FURTHER REQUESTED that this Court direct that its Order be executed as soon as practicable after it is signed and that all monitoring of electronic communications shall be conducted in accordance with Chapter 119 of Title 18, United States Code, as outlined in Agent Bletsis?s af?davit. That is, the computer server intercepting all communications. and on which the TARGET FACILITIES are located will be in Newington, VA, in the Eastern District of Virginia during the period of interception. A ccpy of intercepted communications will be sent to a facility in -MD, where certain FBI personnel 'will be stationed while the TARGET WEBSITE remains operating. Each private message and private chat will be reviewed over a secure system, and based on the identities of the sender and recipient and the content of the private message or private chat, monitOring personnel will determine as soon as practicable after interception whether the private message or private chat appears to be relevant to the investigation or otherwise criminal in nature. If the private message or private chat is not criminal in nature, the private message or private chat will be marked "minimized" and not accessed 5 Case Document 82-1 Filed 09/01/16 Page 6 of 62 by other members of the investigative team. If the private message or private chat appears to be privileged, it will be marked "privileged" and secured from access by other members of the investigative team. If a private message or private chat appears to be relevant to the investigation or otherwise criminal in nature, it will be marked "non- minimized" and may be shared with the other agents and monitors involved in the investigation. If a private message or private chat is marked "minimized" it will not be disseminated to members of the investigative team. All intercepted private messages and private chats will be sealed with the court upon the expiration of the court's order authorizing. the interception. It is anticipated that the monitoring location will be staffed at all times,vat which time intercepted communications will be monitored and read. The monitoring location will be kept secured with access limited to only authorized monitoring personnel and their supervising agents. IT IS FURTHER REQUESTED that the prosecutors or any other Assistant United States Attorney or Department of Justice Trial Attorney familiar with the facts-of this case, shall cause to be provided to the Court a report on or about the ?fteenth and thirtieth day following the date of the Order or the date interception begins, whichever is later, showing the progress that has been made tov?Vard achievement of the authorized objectives- and the need for continued interception, although if the Order is renewed for a further period of interception, the application for renewal may serve as the report on orabout the thirtieth day. If any of the above-ordered reports should become due on a weekend or holiday, such repon shall become due on the next business day thereafter. IT IS FURTHER REQUESTED that the Court direct that the Court?s Order, as well as the supporting Application, Af?davit (along with its attachments), proposed 6 Case Document 82-1 Filed 09/01/16 Page 7 of 62 Orders, and all interim reports ?led with the Court, be Sealed until further order of this Court, except that copies of the Order, in full or redacted form, may be served on FBI agents as necessary to effectuate the Court?s Order. Moreover, the Government hereby requests authorization to disclose the existence of the Interception Order and the contents of pertinent collected electronic communications, pursuant to Title 18, United States Code, Sections 2517(2) and (3), as appropriate for the purposes of providing relevant facts to a Court in support of any complaints, arrestwarrants or search warrants. In addition, the Government requests authorization to disclose facts, pursuant to Title 18, United States Code, Sections 2517(2) and (3), as necessary to provide relevant testimony at any preliminary hearings, detention hearings, grand jury proceedings and other proceedings pertaining to the TARGET SUBJECTS and others as yet unknown. The. Government also requests authorization to disclose facts to foreign investigative or law enforcement of?cers, pursuant to Title 18, United States Code, Section 2517(7), as necessary to the preper performance of the of?cial duties of the offer making or receiving such disclosure, and that foreign investigative or law enforcement of?cers may use or disclose such facts or derivatiVe evidence to the extent such use or disclosure is appropriate to the proper performance of their official duties. IT IS FURTHER REQUESTED that no inventory or return of the results of the foregoing interception need be made, other than the above required reports, before 90 days from the date of the expiration of the Order, or any extension of the Order, or at such time as the Court in its, discretion may require. IT IS FURTHER REQUESTED that, upon an ex parte showing of good cause to a judge of competent jurisdiction, the service of the above inventory or return may be 7 Case Document 82-1 Filed 09/01/16 Page 8 of 62 postponed for a further reasonable period of time. I declare under penalty of peljury that the foregoing is true and correct. EXECUTED in Alexandria, Virginia, on February 20, 2015. submitted, DANA J. BOENTE UNITED STATES A ORNEY By: A W?Him?Ey Do?gherty Russell Assistant UnitedStates Attorney DAMON KING ACTING CHIEF Child Exploitation and Obscenity Section Criminal Division US. Department of Justice Michael Grant Trial Attorney Case Document 82-1 Filed 09/01/16 Page 9 of 62 IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF VIRGINIA ALEXANDRIA DIVISION IN THE MATTER OF THE APPLICATION OF THE UNITED STATES OF AMERICA 2 CASE NO. FOR AN ORDER AUTHORIZING THE .: INTERCEPTION OF ELECTRONIC UNDER SEAL COMMUNICATIONS EXHIBIT A Case Document 82-1 Filed 09/01/16 Page 10 of 62 Of?ce of the Attorney General Washington, D.C. ORDERNO. 3055-2009 SPECIAL DESIGNATION OF CERTAIN OFFICIALS OF THE CWAL DIVISION AND NATIONAL SECURITY DIVISION TO AUTHORIZE APPLICATIONS FOR COURT ORDERS FOR INTERCEPTION 0F WIRE OR ORAL COMMJNICATIONS By virtue of the authority vested in me as'the Attorney General, including 28 U.S.C. 510, 5 11.3.70, 33' 301, and 18 U.S.C. 2516(1), and in order to preclude anyconten?on that the designations by the prior Attorney General have lapsed, the following of?cials are hereby specially designated to exercise the power conferredby section 2516(1) of title 18, United States Code, to authorize applications to a Federal judge jurisdiction for orders authorizing or approving the interception ofwirc and oral communications by the Federal Bureau of Investigation or a Federal agency having responsibility for the investigation of the offense(s) as to which such application is made; when such interception may provide evidence of any of the offenses Speci?ed in section 2516 of title 13, United States Code: - 1. The Assistant Attorney General in charge of the Criminal Division, any Acting Attorney General in charge of the Criminal Division, any Deputy Assistant. Attorney General of the Criminal Diyision, and any Acting Deputy Assistant Attorney General of the Criminal Division; 2.. The Assistant Attorney General for National Security, any Acting Assistant Attorney General for National Security, any Deptny Assistant Attorney General for National Security, and any Acting Deputy Assistant Attorney General for National Security, with respect to those matters delegated to the sopcrvisicn and responsibility of the Assistant Attorney General for Nation-al'Securi ry. These of?cials of the National Security Division shall exercise this authority through, and in coordination with, the Of?ce of Enforcement Operations within the Criminal Division. Attomcy General Order No. 29434008 of January 22, 2008, is revoked effective at 1 1:59 of the day following the date of this orderDate I Eric H. Hugger, It. 3 Attorney General Case Document 82-1 Filed 09/01/16 Page 11 of 62 U.S. Department of Justice Criminal Division Washingmn, D. C. 20530 The Honorable Dana J. Boente United States Attorney FEB 18 ?n5 Eastern District Of Virginia Alexandria, Virginia Attention: Keith Becker and Michael Grant, Trial Attorneys, U.S. Department of Justice, Criminal Division, Child Exploitation and Obscenity Section Dear Mr. Boente: An appropriate official hereby approves an application to be made to a federal judge of competent jurisdiction for an order under Section 2518 of Title 18, United States Code, authorizing, for a thirty (30) day period, the interception of electronic communications occurring over the private message function and private chat function of the website ?upf45jv3bziuctml.onion,? in connection with an investigation into possible violations of federal felonies by Steven W. Chase, and others as yet unknown. The above?described application may be made by you or any other attorney on your staff who is an investigative or law enforcement officer of the United States within the meaning of Section 2510(7) of Title 18, united States Code. Sincerely, eslie R. CaldWell ssistant Attorney General riminal Division n?bl FEB 1 a 2015 A co - we STANT ATTORNEY an} File 09/01/16 Page 12 of62 Date cm Lm Case Docume 82-1 FILED IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF VIRGINIA FEB 20 A 8: 1:2 ALEXANDRIA DIVISION CLERK us carat IN THE MATTER OF THE APPLICATION Ararat-ASE OF THE UNITED STATES OF AMERICA CASE NO. 1:15-Es-4 FOR AN ORDER AUTHORIZING THE - INTERCEPTION OF ELECTRONIC UNDER SEAL COMMUNICATIONS - AFFIDAVIT IN SUPPORT OF APPLICATION FOR AN ORDER AUTHORIZING IN TERCEPTION OF ELECTRONIC COMMUNICATIONS I, Caliope Bletsis, being duly sworn, state the following: INTRODUCTION 1. I have been employed as a Special Agent with the Federal Bmeau of Investigation (FBI) since December 2004., and I am currently assigned to the Violent Crimes Against Children Section, Major Case Coordination Unit I currently investigate federal violations concerning child pornography and the sexual exploitation of children and have gained experience through training in seminars, classes, and everyday work related to these types of investigations. I have participated in the execution of numerous warrants involving the search and Seizure of computers, computer equipment, S'o?Ware, and electronically stored information, in conjunction with criminal investigations pertaining to child pornography the seXual exploitation of children. I have received training in the area of child pornography and child exploitation, and have had the opportunity to observe and review numerous examples of child pornography (as de?ned in 18 U.S.C. 2256) in all forms of media including computer media. I am an ?investigative or law enforcement of?cer? of the United States within the meaning of Section 2510(7) of Title 18, United States Code, and am Case Document 82-1 Filed 09/01/16 Page 13 of 62 empowered by law to conduct investigations of, and to make arrests for, offenses enumerated in Section 25.16 of Title 18, United States Code. 2. This af?davit is submitted in support of the Government's Application for an Order under Title 18, United States Code, Section 2518, authorizing the interception, for a period of up to thirty days, of the electronic communications of _and other unidenti?ed administrators and users of a child pornography website Upf45jv3bziuotml.onion, hereinafter the occurring over the private message function FACILITY and private chat function FACILITY of the TARGET WEBSITE. 3. As a result of my personal participation in this investigation, through information obtained from other federal and foreign law enforcement agents and witnesses, including physical surveillance and the review of documents, and on the basis of other information that I have reviewed and determined to be reliable, I allege facts to show that: at. There is probable cause to believe that the TARGET SUBJECTS have committed, are committing, and will continue to commit offenses speci?ed in Title 18, United States Code, 2252A(g), Engaging in a Child Exploitation Enterprise; 18 U.S.C. 2251(d)(l) and Advertising and Conspiracy to Advertise Child Pornography; l8 U.S.C. and Receipt and Distribution of, and Censpiracy to Receive and Distribute Child Pornography, and 18 U.S.C. and Knowing Possession of, Access or Attempted Access With Intent to View The actual name of TARGET WEBSITE is known to law enforcement. The site remains active and disclosure of the name of the site would potentially alert its members to the fact that; law enforcement action is being taken againSt the site, potentially provoking members to notify other members of law enforcement action, ?ee, and/or destroy evidence. Accordingly, for purposes of the con?dentiality and integrity of the ongoing investigation involved in this matter, speci?c names and other identifying factors have been replaced with generic terms and the website will be identi?ed as 2 Case Document 82-1 Filed 09/01/16 Page 14 of 62 Child. Pornography (collectively, the b. There is probable cause to believe that particular electronic communications of TARGET SUBJECTS concerning the TARGET OFFENSES will be obtained through interception of? electronic communications occurring over TARGET FACILITY I and TARGET FACILITY 2-(together referred to as the In particular, these communications are eXpected to lead to the revelation of evidence concerning the TARGET OFFENSES, including the content of communications between and among the TARGET SUBJECTS. In addition, these electronic communications are expected to constitute admissible evidence of the commission of the TARGET OFFENSES. 4. The requested Order is sought for a period of time until the interception fully reveals the manner in which the TARGET SUBJECTS and their confederates participate in the TARGET OFFENSES, or for a period of thirty (30) days, whichever occurs ?rst, pursuant to Title 18, United States Code, Section 2518(5). Pursuant to Section 2518(5) of Title 18, United States Code, it is further requested that the 30-day period be measured from the earlier of the date on which investigative or law enforcement of?cers begin to conduct interception under this Court?s Order or 10 days from the date of this Court?s Order. 5. The statements contained in this af?davit are based in part on: information provided by FBI Special Agents; written reports about this and other investigations that I have received, directly or indirectly, from other law enforcement agents, including foreign law enforcement agencies as described below; information gathered from the service of administrative subpoenas; the results of physical and electronic surveillance conducted by federal agents; independent investigation and analysis by FBI agents/employees/Computer 3 Case Document 82-1 Filed 09/01/16 Page 15 of 62 forensic professionals; and my experience, training and background as a Special Agent with the FBI. 6. Because this af?davit is being submitted for the limited purpose of securing authorization for the collection of electronic communications, I have not included each and every fact known to me concerning this investigation. Instead, I have set forth only the facts that I believe are necessary to establish the necessary foundation for an order authorizing? the interception of electronic communications occurring over the Internet via communications occurring OVer TARGET FACILITY 1 and TARGET FACILITY 2. RELEVANT STATUTES 7. This investigation concerns alleged violations of: Title 18, United States Code, 2252A(g), Engaging in a Child Exploitation Enterprise; 18 U.S.C. 2251(d)(1) and Advertising and Conspiracy to Advertise Child Pornography; 18 U.S.C. and Receipt and Distribution of, and Conspiracy to Receive and Distribute Child Pornography; and 18 U.S.C. and Knowing Possession of, Access or Attempted Access With Intent to View Child Pornography. a. 18 U.S.C. 2252A(g) prohibits a person from engaging in a child exploitation enterprise. A person engages in a child exploitation enterprise if the person violates, inter alia, federal child pornography crimes listed in Title 18, Chapter 110, as part of a series of felony violations constituting three or more separate incidents and involving more than one victim, and commits those offenses in concert with three or more other persons; b. 18 U.S.C. 2251(d)(1) and prohibits a person from knowingly making, printing or publishing, or causing to be made, printed or published, or conspiring to make, 4 Case Document 82-1 Filed 09/01/16 Page 16 of 62 print or publish, any notice or advertisement seeking or offering: (A) to receive, exchange, buy, produce, display, distribute, or reproduce, any visual depiction, if the production of such visual depiction involves the use of a minor engaging in sexually explicit conduct and such visual depiction is of such conduct, or (B) participation in any act of sexually eXplicit conduct by or with any minor for the purpose of producing a visual depiction of such conduct; c. 18 U.S.C. and prohibits a person from knowingly receiving or distributing, or conspiring to receive or distribute, any child pornography or any material that contains child pornography, as de?ned in 18 U.S.C. 2256(8), that has been mailed, or using any means or facility of interstate or foreign commerce shipped or transported in or affecting interstate or foreign commerce by any means, including by computer; and d. 18 U.S.C. and prohibits a person from knowingly possessing or knowingly accessing with intent to View, or attempting to do so, any material that contains an. image of child pornography, as de?ned in 18 U.S.C. 2256(8), that has been mailed, or shipped or tranSported using any means or facility of interstate or foreign commerce or in or affecting interstate or foreign commerce by any means, including by computer, or that was produced using materials that have been mailed or Shipped or transported in or affecting interstate or foreign commerce by any means, including by computer. DESCRIPTION OF TARGET FACILITIES 8. TARGET FACILITY l: The private message function of the TARGET WEBSITE is similar to e-mail messages and allows the TARGET SUBJECTS to send and 5 Case Document 82-1 Filed 09/01/16 Page 17 of 62 receive communications with other users and/or administrator(s) of the TARGET WEBSITE, such that the private message is only accessible to the user who sent or received such a message and the site administrator(s). 9. TARGET FACILITY 2: The private chat function of the TARGET WEBSITE allows the TARGET SUBECTS to communicate in real-time directly with each other and the communications are only visible and accessible to the users engaged in the private chat and the administrator(s). 10. Other than TARGET FACILITY ?l and TARGET FACILITY 2, described above, there are no other private areas of the TARGET WEBSITE where communications are only visible to some, but not all, registered users. TARGET SUBJECTS 11. ?all other current users and administrators of the TARGET WEBSITE remain unidenti?ed. DEFINITIONS OF TECHNICAL TERMS USED IN THIS AFFIDAVIT 12. The following definitions apply to this Af?davit: a. ?Bulletin Board? means an Internet?based website that is either secured (accessible with a password) or unsecured, and provides members with the ability to view postings by other members and make postings themselves. Postings can contain text messages, still images, video images, or web addresses that direct other members to Specific content. Bulletin boards are also referred to as ?internet forums? or ?message boards.? A ?post? or ?posting? is a single message posted by a user. Users of a 6 Case Document 82-1 Filed 09/01/16 Page 18 of 62 bulletin board may post mes-sages in reply to a post. A message ?thread,? often labeled a ?topic,? refers to a linked series of posts and reply messages. Message I threads or topics often contain a title, which is generally selected by the user who posted the?rst message of the thread. Bulletin boards often also provide the ability for members to communicate on a one-to-one basis through ?private messages.? Private messages are similar to e-mail messages that are sent between two members of a bulletin board. They are accessible only by the user who sent/received such a message, or by the site administrator. b. ?Child erotica," as used herein, means any material relating to minors that serves a sexual purpose for a given individual, including fantasy writings, letters, diaries, books, sexual aids, souvenirs, toy-s, costumes, drawings, and image-s or videos of minors that are not sexually explicit. I 0. ?Child Pornography,? as used herein, is de?ned in 18 U.S.C. 2256(8) as any visual depiction of sexually explicit conduct Where the production of the visual depiction involved the use of a minor engaged in sexually explicit conduct, the visual depiction is a digital image, computer image, or computer-generated image that is, or is indistinguishable from, that of a minor engaged in sexually explicit conduct, or the visual depiction has been created, adapted, or modi?ed to appear that an identi?able-minor is engaged in sexually explicit conduct. d. ?Computer,? as used herein, is de?ned pursuant to 18 U.S.C. 1030(e)(l) as ?an electronic, magnetic, Optical, electrochemical, or other high speed data processing device performing logical or storage functiOns, and includes any data storage facility or communications facility directly related to or operating in conjunction with such 7 Case Document 82-1 Filed 09/01/16 Page 19 of 62 device." e. ?Computer Server? or ?Server,? as used herein, is a computer that is attached to a dedicated network and serves many users. A web server, for example, is a computer which hosts the data associated with a website. That web server receives requests from a user and delivers information from the server to the user?s computer via the Internet. A domain name system server, in essence, is a computer on the Internet that routes communications when a user types a domain name, such as into his or her web browser. Essentially, the domain name must be translated into an Internet Protocol address so the computer hosting the web site may be located, and the DNS server provides this function. f. ?Computer hardware,? as used herein, consists of all equipment which can receive, capture, collect, analyze, create, display, convert, store, conceal, or transmit electronic, magnetic, or similar computer impulses or data. Computer hardware includes any data-processing devices (including, but not limited to, central processing units, internal and peripheral storage devices such as fixed disks, external hard drives, ?Oppy disk drives and diskettes, and other memory storage devices); peripheral input/output devices (including, but not limited to, keyboards, printers, video display monitors, and related communications devices such as cables and connections), as well as any devices, mechanisms, or parts that can be used to restrict access to computer hardware (including, but not. limited to, physical keys and locks). g. ?Computer software,? as used herein, is digital information which can. be interpreted, by a computer and any of its related components to direct the way they work. Computer software is stored in electronic, magnetic, or other digital form. It 8 Case Document 82-1 Filed 09/01/16 Page 20 of 62 commonly includes programs to run operating systems, applications, and utilities. h. ?Computer-related documentation,? as used herein, consists of written, recorded, printed, or electronically stored material which explains or illustrates how to con?gure or use computer hardware, computer software, or other related items. i. ?Computer passwords, pass-phrases and data security devices,? as used herein, consist of information or items designed to restrict access to or hide computer software, documentation, or data. Data security devices may consist of hardware, software, or other programming code. A password or pass-phrase (a string of alpha- numeric characters) usually Operates as a sort of digital key to ?unlock? particular data security devices. Data security hardware may include devices, chips, and circuit. boards. Data security software of digital code may include programing code that creates ?test? keys or ?hot? keys, which perform certain pro-set security functions when touched. Data security software or code may also compress, hide, or ?booby-trap? protected data to make it inaccessible or unusable, as well as reverse the progress to restore it. j. ?Hyperlink? refers to an item on a web page which, when selected, transfers the user directly to another location in a hypertext document or to .some other web page. k. The ?Internet? is a global network of computers and other electronic devices that communicate with each other. Due to the structure of the Internet, connections between devices on the Internet often cross state and international borders, even when the devices communicating with each other are in the same state. 1. ?Internet Service Providers? as used herein, are commercial organizations that are in business to. provide individuals and businesses access to the 9 Case Document 82-1 Filed 09/01/16 Page 21 of 62 Internet. ISPs provide a range of functions for their customers including access to the Internet, web hosting, e?mail, remote storage, and co?location of computers and other communications equipment. ISPs can offer a range of Options in providing access to the Internet including telephone based dial?up, broadband based access via digital subscriber line or cable television, dedicated circuits, or satellite based subscription. ISPs typically charge a fee based upon the type of connection and volume of data, called bandwidth, which the connection supports. Many ISPs assign each subscriber an account name a user name or screen name, an ?e~mail address,? an e-mail mailbox, and a personal password selected by the subscriber. By using a computer equipped with a modem, the subscriber can establish communication with an ISP over a telephone line, through a cable system or via satellite, and can access the Internet by using his or her account name and personal password. m. ?I?Internet Protocol address? or address? refers to a unique number used by a computer to access the Internet. IP addresses can be ?dynamic,? meaning that the Internet Service Provider assigns a different unique number to a computer every time it accesses the Internet. IP addresses might also be ?static,? if an ISP assigns a user?s computer a particular IP address which is used each time the computer accesses the Internet. IP addresses are also used by computer servers, including web servers, to communicate with other computers. 11. ?Minor? means any person under the age of eighteen years. 53; 18 U.S.C. 2256(1). o. A ?Proxy Server? is a server (a computer system Or an application) that acts as an intermediary for requests from clients seeking resources from other servers. Proxy 10 Case Document 82-1 Filed 09/01/16 Page 22 of 62 servers can facilitate access to content on. the World Wide Web and prove anonymity. p. The terms ?records,? ?documents,? and ?materials,? as used herein, include all information recorded in any form, visual or aural, and by any means, whether in handmade form (including, but not limited to, writings, drawings, painting), photographic form (including, but not limited to, micro?lm, micro?che, prints, slides, negatives, videotapes, motion pictures, photocopies), mechanical form (including, but not limited to, phonograph records, printing, typing) or electrical, electronic or magnetic form (including, but not limited to, tape recordings, cassettes, compact discs, electronic or magnetic storage devices such as ?oppy diskettes, hard disks, CD-ROMS, digital video disks Personal Digital Assistants Multi Media Cards memory sticks, optical disks, printer buffers, smart cards, memory calculators, electronic dialers, or electronic notebooks, as well as digital data ?les and printouts or readouts from any magnetic, electrical or electronic storage device). q. ?Sexually explicit conduct? means actual or simulated sexual intercourse, including genital-genital, oral?genital, anal-genital, or oral-anal, whether between persons of the Same or opposite sex; bestiality; masturbation; sadistic or masochistic abuse; or lascivious exhibition of the genitals or pubic area of any person. 18 U.S.C. 2256(2). r. ?Visual depictions? include undeveloped ?lm and videotape, and data stored on computer disk or by electronic means, which is capable of conversion into a visual image. ?g 18 U.S.C. 2256(5). 5. ?Website? consists of textual pages of information and associated graphic images. The textual information is stored in a speci?c format known as Hyper?Text Mark?up ll Case Document 82-1 Filed 09/01/16 Page 23 of 62 Language and is transmitted from web servers to various web clients via Hyper?Text Transport Protocol SUMMARY or PROBABLE CAUSE 13. The TARGET SUBJECTS are the administrators and users of the TARGET WEBSITE who regularly send and receive illegal child pornography via the TARGET WEBSITE which operates as a ?hidden services? located on the Tor network, further described below. This TARGET WEBSITE is dedicated to the advertisement and distribution of child pornography, the discussion of matters pertinent to child sexual abuse, including methods and tactics offenders use to abuse children, as well as methods and tactics offenders use to avoid law enforcement detection while perpetrating online child sexual exploitation crimes such as the TARGET OFFENSES. As of February 12, 2015, a law enforcement agent visited the TARGET WEBSITE, in an undercover capacity, and con?rmed that the site remains active, accessible and substantially the same as described herein. 14. The TARGET WEBSITE operates on an anonymity network available to Internet users known as ?The Onion Router? or ?Tor? network. Tor was originally designed, implemented, and deployed as a project of the US. Naval Research Laboratory for the primary purpose of protecting government communications. It is now available to the public at large. Information documenting what Tor is and how it works is provided on the publicly accessible Tor website at In order to access the Tor network, a user must install Tor software either by downloading an add?on to the user?s web browser or by downloading the free ?Tor browser bundle? available at 2 Users may also access the Tor network through so-called ?gateways? on the open Internet such as ?onion.to" and ?tor2web.org," however, use of those gateways does not provide users with the anonymizing bene?ts of the Tor 12 Case Document 82-1 Filed 09/01/16 Page 24 of 62 15. Tor software protects users? privacy online by bouncing their communications around a distributed network of relay computers run by volunteers all around the world, thereby masking the user?s actual IP address Which could otherwise be used to identify a user. It prevents someone attempting to monitor an Internet connection from learning what sites a user visits, prevents the sites the user visits from learning the user?s physical location, and it lets the user access sites which could otherwise be blocked. Because of the way Tor routes communications through other computers, traditional IP identi?cation techniques are not viable. When a user on the Tor. network accesses a website, for example, the IP address of a Tor ?exit node,? rather than the user?s actual IP address, shows up in the website?s IP log. An exit node is the last computer through which a user?s communications were routed. There is no practical way to trace the user?s actual IP back through that Tor exit node IP. In that way, using the Tor network Operates similarly to a proxy server. 16. Tor also makes it possible for users to hide their locations while offering various kinds of services, such as web publishing, forum/Website hosting, or an instant messaging server. Within the Tor network itself, entire websites can be set up as ?hidden services.? Hidden services, like other websites, are hosted on computer servers that communicate through IP addresses and operate in the same manner as regular public websites with one critical exception. The IP address for the web server is hidden and instead is replaced with a Tor-based web address, which is a series of algorithm-generated characters, such as ?asdlkas9dflku7f? followed by the suf?x ?.onion.? A user can only reach these hidden services if the user is using the Tor client and operating in the Tor network. And unlike an open Internet website, is not possible to determine through public. lookups the IP address of a computer hosting a Tor hidden service. Neither law enforcement nor users can therefore determine the location of the computer that network. 13 Case Document 82-1 Filed 09/01/16 Page 25 of 62 hosts the website through these public lookups. Finding and Accessing the TARGET WEBSITE 17. Accordingly, unlike on the traditional Internet, a user may not simply perform a Google search for the name of the TARGET WEBSITE on Tor to obtain and click on a link to the site. A user might obtain the web address directly from communicating with other users of the board, or from Internet postings describing the sort of content available on the TARGET WEBSITE as well as the site?s location. For example, there is a Tor ?hidden service? page that is dedicated to pedophilia and child pornography. That ?hidden service? contains a section with links to Tor hidden services that contain child pornography, including the TARGET WEBSITE. Accessing the TARGET WEBSITE therefore requires numerous af?rmative steps by a user, making it extremely unlikely that any user could simply stumble upon the website without understanding its purpose and content. In addition, upon. arrival at the TARGET WEBSITE, the user sees images of prepube'scent females partially clothed and whose legs are spread with instructions for joining the site before one can enter. Accordingly, there is probable cause to believe that, for the reasons described below, any user who successfully accesses the TARGET WEBSITE has knowingly accessed with intent to view child pomegraphy, or attempted to do so. Description of TARGET WEBSITE Content and Criminal Use of the TARGET FACILITIES 18. Between September 16, 2014 and February 3, 2015, FBI Special Agents, acting in an undercover capacity, connected to the Internet via the Tor Browser and accessed TARGET WEBSITE.3 The TARGET WEBSITE is a message board website whose primary purpose is the 3 As of February 18, 2015, the URL of the TARGET WEBSITE had changed from muff7i44irwslimwubnion to upf45jv3bziuctm1.onion. 1 am aware from my training and experience that it is possible For a website to be moved 14 Case Document 82-1 Filed 09/01/16 Page 26 of 62 advertisement and distribution of child pornography. According to statistics posted on the site, TARGET WEBSITE contained a total of 95,148 posts, 9,333 total tepics, and 158,094 total members. Based on the earliest known post, the website appeared to have been operating since approximately August 19, 2014. 19. On-the main page of the site, located to either side of the site name were two images depicting partially clothed prepubescent females with their legs spread apart, along with the text underneath stating, ?No cross-board reposts, .72 preferred, ?lenames, include preview, Peace out.? Based on my training and experience, I know that: ?no cross-board reposts?f refers to a prohibition against material that is posted on other websites from being ?re- posted? to TARGET and refers to a preferred method of compressing large ?les or sets of ?les for distribution. Two data-entry ?elds with a corresponding ?Login? button were located to the right of the site name. Located below the aforementioned items was the message, "Warning! Only registered members are allowed to access the section. Please login below or ?register an account? (a hyperlink to the registration page) with Below this message was the "Login" section, consisting of four data-entry ?elds with the corresponding text, "Username, Password, Minutes to stay logged in, and Always stay logged in." 20. Upon accessing the ?register an account? hyperlink, the following message was displayed: IMPORTANT. READ ALL OF THIS PLEASE. I will add to this as needed. from one URL to another without altering its content or functionality. I am also aware from the instant investigation that the administrator of the TARGET WEBSITE periodically changes the location and URL of the TARGET WEBSITE in Order to avoid law enforcement detection. An FBI agent accessed the TARGET WEBSITE in an undercover capacity on February 18, 2015, at its new URL, and determined that its content has not changed. 15 Case Document 82-1 Filed 09/01/16 Page 27 of 62 The so?ware we use for this forum requires that new users enter an email address, and checks that what you enter looks approximately valid. We can't turn this off but the forum operators do NOT want you to enter a real address, just something that matches the pattern. No con?rmation email will be sent. This board has been intentionally con?gured so that it WILL NOT SEND EMAIL, EVER. Do not forget your password, you won't be. able to recover it. After you register and login to this forum you will be able to ?ll out a detailed pro?le. For your security you should not post information here that can be used to identify you. Spam, ?ooding, advertisements, chain letters, pyramid schemes, and solicitations are forbidden on this forum. Note that it is impossible for the staff or the owners of this forum to con?rm the true identity of users or monitor in realtime all messages posted, and as such we are not responsible for the content posted by those users. You remain solely responsible for the content of your posted messages. The forum software places a cookie, a text ?le containing bits of information (such as your usemarne and password), in your browser's cache. This is ONLY used to keep you logged in/out. This website is not able to see your IP and can not collect or send any other form of information to your computer except what you expressly upload. For your own security when browsing or Tor we also recomend that you turn off javascript and disable sending of the 'referer' header." 21 .. After accepting the above terms, registration to the message board then requires a user to enter a username, password, and e-mail account; although a valid e-mail account was not required as described above. After registering and logging into the site, the following sections, forums, and sub?forums, along with the corresponding number of topics and posts in each, were observed: Section Forum Topics Posts General Category information and rules 25 236 How to 133 863 Security TechnOIOgy discussion 281 2,035 Request 650 2,487 General Discussion 1,390 13 ,918 The INDEXES 10 119 Trash Pen 87 1,273 16 Case Document 82-1 Filed 09/01/16 Page 28 of 62 Chan Jailbait4 Boy Jailbait - Girl Preteen Boy Preteen Girl Jailbait Videos Girls Boys Jailbait Photos Girls Boys Pre~teen Videos Girls HC5 Girls Boys HC Boys Pre?teen Photos Girls HC Girls Boys Boys Web?cams A Girls Boys Potpourri Family Incest Toddlers Artwork Kinky Fetish Bondage Chubby Feet Panties, nylons, spandex Peeing Scat 58 271 32 264 643 34 339 1,427 514 154 2,334 257 3,763 8,282 183 2,590 39 20,992 5,635 1,256 193 5,314 4,902 330 135 2,423. 12 1,718 1,336 314 222 309 21 8 369 865 232 4 Based on my training and experience, I know that ?jailbait? refers to underage but post-pubescent minors. 5 Based on my training and experience, I know that the following abbreviations respectively mean: HC - hardcore, depictions of penetrati've sexually explicit conduct; SC softcore, depictions of non-penetrative sexually explicit conduct; NN - non-nude, depictions of subjects who are fully or partially clothed. 17 Case Document 82-1 Filed 09/01/16 Page 29 of 62 Spanking 28 ?25 1 Vintage 84 878 Voyeur 37 454 Zoo 25 2.22 Other Languages Italiano 34 1,277 Portugues 69 905 Deutsch 66 570 Espanol 168 1,6] 4 Nederlands 1 8 264 Russian 8 239 Stories Fiction 99 505 Non??ction 122 675 22. . An additional section and forum was also listed in which members could exchange usernames on a Tor-network~based instant messaging service that I know, based upon my training and experience, to be commonly used by subjects engaged in the online sexual exploitation of children. Another service available to users was. the ability to send private chat messages between users. 23. A review of the various topics within. the above forums revealed each topic contained a title, the author, the number of replies, the number of views, and the last post. The last post section included the date and time of the post as well as the author. Upon accessing a topic, the original post appeared at the top of the page, with any corresponding replies to the original post included the post thread below it. Typical posts appeared to: contain text, images, thUmbnail-sized previews of images, compressed ?les (such as Roshal Archive ?les, commonly referred to as ?.rar? ?les, which are used to store and distribute multiple ?les within a single links to external sites, or replies to previous posts. 24. A review of the various topics within the information and 18 Case Document 82-1 Filed 09/01/16 Page 30 of 62 rules,? ?How to,? ?General Discussion,? and ?Security Technology discussion? forums revealed the majority contained general information in regards to the site, instructions and rules for how to post, and welcome messages between users. 25. A review of topics within the remaining forums revealed the majority contained discussions, as well as numerous images that appeared to depict child pornography and child erotica of prepubescent females, males, and toddlers. Examples of these are as follows: On February 3, 2015, the user posted a topic entitled in the forum ?Pre-teen Videos Girls that contained numerous images depicting a prepubescent or early pubescent female engaged in sexually explicit conduct. One of these images depicted the female being orally penetrated by the penis of a naked male. On January 30, 2015, the user posted a topic entitled in the forum ?Pro-teen Photos Girls that contained hundreds of images depicting a prepubescent female engaged in sexually explicit conduct. One of these images depicted the female being orally penetrated by the penis of a male. On Se tember 16, 2014, the user posted a topic entitled in the ?Pre-teen Videos - Girls forum that contained four images depicting a prepubescent female engaged in sexually explicit conduct and a hyperlink to an external website that contained a video ?le depicting what appeared to be the same prepubescent female. Among other things, the video depicted the prepubescent female, who was naked from the waist down with her vagina and anus exposed, lying or sitting on tOp of a naked adult male, whose penis was penetrating her anus. 26. A list of members, which was accessible after registering for an account, revealed that approximately 100 users made at least 100 posts to one or more of the forums. Approximately 31 of these users made at least 300 posts. Analysis of available historical data seized from the TARGET WEBSITE, as described below, revealed that on average over 1,500 unique users visited the website daily and over 11,000 unique users visited the website over the course of a week. A private message feature, TARGET FACILITY 1, also appeared to be available on the site, after registering, that allowed users to send other users private messages, 19 Case Document 82-1 Filed 09/01/16 Page 31 of 62 referred. to as ?personal messages" or which are only accessible to the sender and recipient of the message. Review of the site demonstrated that the site administrator made a posting on January 28, 2015, in response to another user in which he stated, among other things, ?Yes PMs should now be ?xed. As far as a limit, I haVe not deleted one yet and I have a few hundred there now. . 27. Further review revealed numerous additional posts referencing private messages or PMs regarding posts related to child pornography, including one posted by a user stating, ?Yes i can help if you are a teen boy and want to fuck your little sister. write me a private message.? 28. Additionally, law enforcement agents reviewed hundreds of private messages occurring over TARGET FACILITY 1 that were in furtherance of the TARGET OFFENSES and/or provided information on the identities of the TARGET SUBJECTS. These, private messages were collected over the server for the TARGET WEBSITE, and law enforcement was able to access these messages through the server cepy that was obtained from the search warrant for the TARGET WEBSITE in January 2015. Examples of these messages, which law enforcement believes discusses the sexual abuse of minors, are as follows: a. On January 10, 2015, the user sent a private message to the user stating: ?Hi, thnx! She is cute and tasty arround 1,5yo on that play with her everytime I have her alone, started from arround 3/4 now 3,5. also have another niece, also 3,5 but they are not sisters, and. as tasty as the other one Never had them together at once unfortunately! I only tried anal once with the niece in my avatar when she was 2,5, almost got the head of my cock Never penetrated their pussies (except with my tongue) and 20 Case Document 82-1 Filed 09/01/16 Page 32 of 62 never cummed inside their asses or pussies directly (all too dangerous) For the rest, I did thought a c0uple of times to show them on my webcam, naked etc, but never got to do tha b. On January 6, 2015, user - sent a private message to that contained the following: ?My personal feelings are that were you to have a consensual sexual relationship with a child that she enjoyed, two things might make her regret it in her late teens and early twenties. One is the knowledge that her sexual partner was her father and two, the sex was recorded. My name -alludes to my 1080p HD hidden camera glasses 1 have for recording purposes although I plan to use them with another little girl in my life, a 5 year old brunette pixie not related to me by blood. POV porn is another favorite of mine. c. On December 16, 2014, the user - sent a private message to the user _stating the following: ?but contact me only if you are ready to rape your sisters. when you think they are too goo-d for you then don't waste my time!? 29. Based on my training and experience and the review of the site by law enforcement believe that the private message function of the TARGET WEBSITE site, described above as TARGET FACILITY 1, is being used to communicate regarding the dissemination of child pornography and to share information among users that may assist in the identi?cation of the TARGET SUBJECTS. 30. The TARGET WEBSITE also includes a feature referred to as Image Hosting.? This feature of the TARGET WEBSITE allows users of the TARGET WEBSITE to upload images of child pornography that are in turn, only accessible to users of the TARGET WEBSITE. On February 12, 2015, an FBI agent operating in an 21 Case Document 82-1 Filed 09/01/16 Page 33 of 62 undercover capacity accessed a post on the TARGET WEBSITE titled -which was created by the TARGET WEBSITE user_ The post contained links to images stored on Image Hosting". The images depicted a prepubescent female in various states of undress. Some images were focused. on the nude genitals of a prepubescent female. Some images depicted an. adult male's penis partially penetrating the vagina of a prepubescent female. 31. The TARGET WEBSITE also includes a feature referred to as File Hosting." This feature of TARGET WEBSITE allows users of TARGET WEBSITE to upload videos of child pornography that are in turn, only accessible to users of TARGET WEBSITE. On February 12, 2015, an FBI Agent operating in an undercover capacity accessed a post on the TARGET WEBSITE titled ?which was created by the TARGET WEBSITE user -The post contained a link to a video ?le stored on File Hosting." Thevideo depicted an adult male masturbating and ejaculating into the mouth of a nude, prepubescent female. 32. The TARGET WEBSITE also includes a feature referred to as Chat. On February 6, 2015, an FBI Special Agent accessed Chat" which was hosted on the same URL as the TARGET WEBSITE. The hyperlink to access Chat? was located on the main index page of the TARGET WEBSITE. After logging in to Chat, more than 50 users were observed to be logged in to the service. While logged in to Chat, the following observations were made: a. User -posted a link to an image that depicted four females performing oral sex on each other. At least two of the females depicted were prepubescent. 22 Case Document 82-1 Filed 09/01/16 Page 34 of 62 User - posted a link to an image that depicted a prepubescent female with an amber colored object inserted into her vagina. 0. User -posted a link to an image that depicted two prepubescent females laying on a bed with their legs in the air exposing their genitals. d. Other images that appeared to depict child pornography were also observed. .33. The images. described above, as well as other images, were captured and are maintained as evidence. 34. Messages posted in Chat are generally public and available for all users to see. A review of Chat showed that it also contained a feature allowing users 0t: Chat to send messages privately, over TARGET FACILITY 2, which are only visible to the sender and intended recipient(s). Examples of messages sent using TARGET FACILITY 2 were collected over the server for the TARGET WEBSITE, and law enforcement was able to access these messages through the server copy that was obtained from the search warrant for the TARGET WEBSITE in January 2015. Examples of these messages, which law enforcement believes discusses the sexual abuse of minors, are as follows: a. On January 14, 2015, the user - sent a private chat message to -stating ?made it easier when daughter comes still calls me when she gets cource shes 20 a good fuck b. On January 14, 2015, the user sent a private chat message to _that stated I want to cover that in cum.? Prior to this message,?had sent multiple private chat messages that contained links to images located on, hidden services with the path 23- Case Document 82-1 Filed 09/01/16 Page 35 of 62 after the address. The links were no longer active, but based on my training and experience, I know members of sites such as the TARGET WEBSITE often send images of child pornography. The links o?en expire after a certain amount of time or the original uploader deletes the ?le. c. On Janurary 14, 2015, the user sent two private chat messages to that stated ?gotta love the internet meet like minded folks? and ?alone man but another pedo helped me. get started with her.? 35. Based on my training and experience and the review I of the site by law enforcement agents, I believe that the private chat function of the site, described above as the TARGET FACILITY 2, is being used to communicate regarding the dissemination of child pornography and to share information among users that may assist in the identi?cation of the TARGET SUBJECTS. 36. A review of message threads also revealed that users. discussed traveling to foreign countries with the intent to sexually abuse children in. a foreign country. One example of this type of discussion is where user -posted a thread on October 8, 2014, titled ?Travel Advice in Asia, SE Asia, and Australia,? and asked need to take a vacation soon somewhere in Asia or Southeast Asia (though possibly as far as Australia). Can anyone give me some tips for the best places to go to ?nd accessible girls (10-13) in the I need to know to ?nd some girls for a few to play is Another user, - responded on October 8, 2104, and stated, ?[Y]ou can try phillippines, don?t go to Indonesia." A second user, -responded on October 11, 2014, and stated ?[Y]ou will ?nd that in most countries child brothels are in the small villages and towns, not in cities. . .Most brothels will let the very young do BJs, but no fucking which is left with the older girls. In Asian countries, a 24 Case Document 82-1 Filed 09/01/16 Page 36 of 62 child brothel is quite easy to ?nd, just ask is to arrange a girl to be delivered to your hotel.? Target Website Sub-Forums 37. While the entirety of the TARGET WEBSITE is dedicated to child pornography, the following sub-forums of the TARGET WEBSITE were reviewed and determined to contain the most egregious examples of child pornography and/or dedicated to textual descriptions of sexually abusing children: Pro-teen Videos - Girls Pro-teen Videos - Boys (0) Pro-teen Photos - Girls Pro-teen Photos Boys Potpourri - Toddlers; Potpourri - Family Play Pen - Incest; Spanking; Kinky Fetish Bondage; (I) Peeing; Scat?; Stories Non?Fiction; (1) Zoo; Webcams Girls; and Webcams Boys. Identi?cation and Seizure of the Computer Server Hosting the TARGET WEBSITE 38. In December of 2014, a foreign law enforcement agency advised the FBI that it suspected IP address 192.198.81.106, which is a United States-based IP address, to be associated with the TARGET WEBSITE. A publicly available Website provided information that the IP Address 192.198.81.106 was owned by -a server hosting company headquartered at Through further investigation, FBI veri?ed that TARGET WEBSITE was hosted from the previously referenced IP address. - Search Warrant was obtained and executed at ?in January 2015 and a copy of the server (hereinafter the "Target Server") that was assigned IP Address 6 Based on my training. and experience, ?scat? refers to sexually explicit activity involving defecation and/or feces. 25 Case Document 82-1 Filed 09/01/16 Page 37 of 62 FBI Agents reviewed the contents of the Target Server and observed that it contained a copy of the TARGET WEBSITE. A copy of the Target Server is currently located on a computer server at a government facility in Newington, VA, in the Eastern District of Virginia. 39. While possession of the server data will provide important evidence concerning the criminal activity that has occurred on the server and the TARGET WEBSITE, the identities of the administrators and users of TARGET WEBSITE will remain unknown. Sometimes, non? Tor-based websites have IP address logs that can be used to locate and identify the board?s users. In such cases, a' publicly available lockup would be performed to determine what ISP owned the target IP address, and a subpoena would be sent to that ISP to determine the user to which the IP address was assigned at a given date and time. However, in the case of TARGET WEBSITE, the logs of member activity will contain only the IP addresses of Tor ?exit nodes? utilized by board users. Those IP address logs cannot be used to locate and identify the administrators and users of TARGET WEBSITE. 26 Case Document 82-1 Filed 09/01/16 Page 38 of 62 27 Case Document 82-1 Filed 09/01/16 Page 39 of 62 28 Case Document 82-1 Filed 09/01/16 Page 40 of 62 29 Case Document 82-1 Filed 09/01/16 Page 41 of 62 52. Accordingly, on February 19, 2015, FBI personnel executed a court?authorized search at the Naples, FL, residence of the suSpected administrator of the TARGET WEBSITE. That individual was apprehended and the FBI has assumed administrative control of the TARGET WEBSITE. The TARGET WEBSITE will continue to operate from the government- controlled. computer server in Virginia, on which a copy of TARGET WEBSITE currently resides. These actions will take place for a limited period of time, not to exceed 30 days, in order to locate and identify the administrators and users of TARGET WEBSITE through the deployment of the network investigative technique described below. Such a tactic is necessary in order to locate and apprehend the TARGET SUBJECTS who are engaging in the continuing sexual abuse and exploitation of children, and to locate and rescue children from the imminent harm of ongoing abuse and exploitation. DEPLOYMENT 0F NETWORK INVESTIGATIVE TECHNIQUE 7 As explained supra, footnote 3, the administrator of the TARGET WEBSITE periodically changes its location and URL in order to avoid law enforcement detection. As of Februar 18, 2015, investigation has revealed the current IP address of the TARGET WEBSITE to be 199.241 . 1 88.206. 30 Case Document 82-1 Filed 09/01/16 Page 42 of 62 53. As noted above, the TARGET WEBSITE will operate from a government facility- in Newington, Virginia, within the Eastern District of Virginia, and remain online and accessible to the TARGET SUBJECTS for a limited period of time. During the period of this authorization, FBI expects to concurrently deploy a court?authorized Network Investigative Technique on the TARGET WEBSITE in an attempt to identify the actual IP addresses and other identifying information for computers used by TARGET SUBJECTS to access the TARGET WEBSITE. The NIT will send one or more communications to TARGET SUBJECTS that access the TARGET WEBSITE after the date of its deployment, which communications are designed to cause the computer receiving it to deliver data that will help identify the computer, its location, other information about the computer, and the user of the computer accessing the TARGET WEBSITE. In particular, the NIT is designed to reveal to the government the computer?s actual IP address, the date and time that the NIT determines what that IP address is, a unique session identi?er to distinguish the data from that of other computers and other information, and other information that may assist in identifying computers that accesses the TARGET WEBSITE and their users. Separate authorization will be sought from this Court for the execution of that search warrant and the deployment of the NIT. TARGET SUBJECTS COMMUNICATIONS ON THE TARGET WEBSITE 54. TARGET SUBJECTS can communicate 0n the TARGET WEBSITE in four ways: (1) through postings or reply postings on the website, which may include videos, images, or links to videos or images, which are visible and accessible to any user who accesses the board, including law enforcement agents; (2) through the public chat feature of the website, which may also include videos, images, or links to videos or images, which are visible and accessible to any user who accesses the board, including law enforcement agents; (.3) through TARGET 31 Case Document 82-1 Filed 09/01/16 Page 43 of 62 FACILITY 2, the private chat feature on the website, which is similar to the public chat function but is only visible and accessible to the users engaged in the private chat; and (4) through TARGET FACILITY 1, the private message function, which. is similar to e-mail mess-ages and which are only accessible to the user who sent .or received such a message and the site administrator(s). Other than the private messaging ?mction and. private chat function, there are no private areas of the TARGET WEBSITE where communications are only visible to some, but not all, registered users. 55. In order to access any of the content of the TARGET WEBSITE, it is necessary to register with a username and a password. Only users of the TARGET WEBSITE who register with a username and a password have access to the private messaging and private chat functions. The private message function is not an ?instant messaging? system where users communicate in real time, but rather Operates similar to sending and receiving e-mails. The private chat function is similar to an ?instant messaging? system where. the users communicate in real time, but only with other users who are engaged in the private chat. Multiple examples of public postings on the TARGET WEBSITE where TARGET SUBJECTS discuss the use of private messaging and private chat are described herein. 56. TARGET SUBJECTS communicate anonymously on the sites, using aliases known as ?screen names.? TARGET SUBJECTS rarely, if ever, post any personally identi?able information that would allow law enforcement to identify the TARGET SUBJECTS or the . TARGET SUBJECTS actual location on areas of the TARGET WEBSITE accessible to all users. In fact, the site speci?cally cautions its users not to post or share any identifying information as described in the rules of TARGET WEBSITE listed in paragraph 20 of this af?davit. Based upon my training and experience, users are more likely to send information that 32 Case Document 82-1 Filed 09/01/16 Page 44 of 62 is identifying or that could corroborate other identifying information in private messages or private chats exchanged only between board users. For example,? _Reviewing private messages, private chats, and postings in private areas of the TARGET WEBSITE in real time will allow agents to act upon any identifying details or details about child victims immediately upon the sending or receipt of such a message or chat, rather than waiting for the later execution of a search warrant to retrieve historical private message or private chat data. That information received in real time can be paired with information gathered via the NIT and other information. available in postings to help to identify or corroborate the identity of TARGET SUBJECTS. Also based upon my training and experience, users often privately trade child pornography which is facilitated by communication via private messages or private chat. Users may directly send child pornography via private message or private chat, or exchange information that allows them to trade child pornography via other digital platforms for example, another e-mai'l account, a ?le hosting website, or other Schild pornography websites. Child pomegraphy that is traf?cked via ?le uploading websites is often made available Only for a limited period of time, which is a security measure by the user in order to avoid detection. Where law enforcement agents are able to intercept a communication directing a user to a file sharing website or to download location, that 33 Case Document 82-1 Filed 09/01/16 Page 45 of 62 file can be downloaded by law enforcement and therefore preserved as evidence. Accordingly, reviewing such messages in real time may provide crucial evidence of child pornography traf?cking which would not be available by reviewing historical messages. Furthermore, I am aware from training and experience as well as the review of seized data ?om the TARGET WEBSITE that the administrators and moderators of the website communicate with each other regarding the administration, management and facilitation of the TARGET WEBSITE via private messaging. During the period of time that the TARGET WEBSITE will Operate from a government facility, those administrators and moderators may communicate via private messages or private chats regarding any changes made to the TARGET WEBSITE and the potential of law enforcement in?ltration of the site. Law enforcement agents will be able, following the apprehension of .0 communicate as the main administrator of the TARGET WEBSITE. However, law enforcement would not be able, absent the interception of private messages, to learn in real time about communications between other administrators and moderators suggesting an awareness of changes made to the TARGET WEBSITE (to facilitate the investigatiVe techniques discussed herein) and potential actions those administrators and moderators may take to alert others, obstruct justice or destroy evidence. While the TARGET WEBSITE is operating at a government facility for a limited period of time, FBI will have access to all users? private messages and private chats, which may include videos, images, or links to videos or images, which are visible and accessible only to certain users of the sites. PERSONS LIKELY TO BE INTERCEPTED 57. The INTERCEPTEES include ?and those TARGET SUBJECTS who send or receive private messages or private chats on the TARGET WEBSITE during the 30- day period of this authorization. At this time, because of the anonymous nature of the Tor 34 Case Document 82-1 Filed 09/01/16 Page 46 of 62 network and the choice of the TARGET SUBJECTS to utilize that ?mctional'ity, the actual identities of the TARGET SUBJECTS are unknown. NECESSITY FOR COLLECTION OF PRIVATE MESSAGES AND PRIVATE CHATS 58. Based on my training and experience as a Special Agent, as well as the experience of other law enforcement officers involved in this investigation, and based upon all of the facts set forth herein, it is my belief that the seizure of the TARGET WEBSITE in conjunction with its continued Operation for a limited period of time, the deployment of a NIT to attempt to identify actual IP addresses used by the TARGET SUBJECTS, and the interception of electronic communications ?of the TARGET SUBJECTS occurring over the TARGET FACILITIES as applied for herein, is the only available investigative technique with a reasonable likelihood of securing the evidence necessary to prove beyond a reasonable doubt the identity of the TARGET SUBJECTS and that they are engaging in the TARGET OFFENSES. I believe that such combination of investigative steps are the only available technique likely to provide law enforcement with the critical information needed for this investigation, evidence of the actual identity of the TARGET SUBJECTS and that of their accomplices, aiders and abettors, co?conspirators and participants in illegal activities, who have deployed advanced technology to remain anonymous while conducting their illegal activity; the nature, extent and methods of operation of TARGET unlaw?il activities; the existence and locations of records relating to those activities; communications between TARGET SUBJECTS and their accomplices, aiders and abettors, co-conspirators and participants in those illegal activities; and the location and identity of computers used to further the TARGET OFFENSES. 59. The interception of private messages and private chats in real time is necessary for several reasons. TARGET SUBJECTS communicate anonymously on the sites, using aliases 35 Case Document 82-1 Filed 09/01/16 Page 47 of 62 known as ?screen names.? As described above, private messaging and private chat is only available to users who register with a usernarne and password. TARGET SUBJECTS rarely, if ever, post any personally identi?able information that would allow law enforcement to identify the TARGET SUBJECTS or the TARGET SUBJECTS actual location on areas of the TARGET WEBSITE accessible to all users. In my training and experience, users are more likely to send information that is identifying or that could corroborate other identifying information in private messages and private. chats exchanged only between board users or within private areas only chats in real time will allow, agents to act upon any identifying details or details about child victims immediately upon the sending or receipt of such a message, rather than waiting for the later execution of a search warrant to retrieve historical private message and private chat data. That information received in real time can be paired with information gathered via the NIT and other information available in postings to help to- identify or corroborate the identity of TARGET SUBJECTS. 60. Interception of private messages and private chats is also necessary for the identi?cation and protection of potential victims of child sexual abuse. There are postings to the TARGET WEBSITE by at least two members who contend to have access to children, one of which has posted images that the user contends are of sexual abuse the user has committed against children. That individual was identi?ed through other investigative means and 36 Case Document 82-1 Filed 09/01/16 Page 48 of 62 admitted to producing images of child pornography subsequent to his arrest_ In the event that a user shares information about child sexual abuse and/or the production of child pornography in a private message or private chat that is being monitored in real time, agents can, in conjunction with the deployment of the NIT and any other available evidence, immediately take action to locate and identify that user in an attempt to prevent ?n'ther abuse of that child. In that scenario, reviewing such private messages and private chats only after the execution of a search warrant would waste crucial time. 61. Moreover, in order for the NIT to have a chance to work, members need to continue to access the TARGET WEBSITE after the NIT is deployed. In order to ensure that users continue to access the TARGET WEBSITE, it is necessary that there be as minimal an interruption as possible in the Operation of the TARGET WEBSITE, so as not to create suspicion among the TARGET SUBJECTS that a law enforcement. action is taking place on the board. In my training and. experience and in reviewing messages posted on the TARGET WEBSITE, and other child pornography and exploitation websites operating on the Tor netWOrk, interruptions in service for more than a minimal time period is a tip?off to board users that law enforcement in?ltration may be going on and may result in users not accessing the board for a period of time. Law enforcement will review historical private messages and priVate chats for any identifying information shared by TARGET SUBJECTS, however, that review takes time. Review of the seized copy of TARGET WEBSITE has included _Analysis of that data is ongoing and efforts are being made to determine which, if any, of the identi?ed ?an be utilized to obtain a true identity for any users of TARGET WEBSITE. Other than -and CD 1, none of 37 Case Document 82-1 Filed 09/01/16 Page 49 of 62 the other administrators or users. have been identi?ed. Waiting for such a review to be complete before deploying a NIT and monitoring private messages and private chats on the TARGET WEBSITE in real time would deprive law enforcement of potentially crucial information at a critical phase in the investigation. NORMAL INVESTIGATIVE PROCEDURES 62. Based upon your training and experience, as well as the experience of other FBI agents and law enforcement of?cers with whom I have investigated this case, and based upon all of the facts set forth herein, it is your af?ant's belief that the seizure of the TARGET WEBSITE in conjunction with its continued operation, for a limited period of time, the deployment of a NIT to attempt to identify actual IP addresses used by the TARGET SUBJECTS, and the interception of electronic communications of the TARGET SUBJECTS occurring over the TARGET FACILITIES is the only available technique with a reasonable likelihood of securing the evidence necessary to prove that the TARGET SUBJECTS are engaging in the SUBJECT OFFENSES beyond a reasonable doubt. Due to the unique nature of the information sought, numerous investigative procedures that are usually employed in criminal investigations of this type have been tried and have failed, reasonably appear to be unlikely to succeed if they are tried, or are too dangerous to employ for the reasons discussed below. UNAVAILABILITY 0F ALTERNATIVE INVESTIGATIVE TECHNIQUES . 63. Your af?ant and other investigators in Criminal investigations of violations of Title 18, United States Code, Sections 2251 and 2252A, et seq, customarily use the following investigative techniques: physical surveillance; use of Grand Jury Subpoenas; interview of subjects in associates; search warrants; infiltration by undercover of?cers; and use of cooperating individuals. 38 Case Document 82-1 Filed 09/01/16 Page 50 of 62 64. Over the past three years, investigators have also explored various means and methods of investigating Tor "based websites and offenders using Tor. As set forth below these techniques are insuf?cient to accomplish the objectives of the investigation. Physigal Surveillance 65. Physical Surveillance is unavailable because the TARGET SUBJECTS, other than - are unidenti?ed and communicating in a way that provides for their anonymity. Grand 11m Subpoenas 66. Grand Jury subpoenas are unavailable because all of the TARGET SUBJECTS, other than - are unidenti?ed and communicating in a way that provides for their anonymity. Interview of Subiect or Associates 67. Interviewing TARGET SUBJECTS .or any associates is impossible because all of the TARGET SUBJECTS (but for _and are unidenti?ed and communicating in a way that provides for their anonymity. 68. a member of TARGET WEBSITE previously referenced in this af?davit, who was arrested _was interviewed subsequent to his arrest. He did not provide any information that could be used by law enforcement to identify other users of TARGET WEBSITE. Search Warrants 69. Search warrants are being used actively in this investigation. For example, FBI expects to execute search warrants to deploy a NIT to attempt to identify the TARGET SUBJECTS. As noted herein, however, the execution of the search Warrant to seize a copy of the TARGET WEBSITE was insuf?cient to identify TARGET SUBJECT-S and interdict their illegal activity. While possession of the data will provide important evidence concerning the 39 Case Document 82-1 Filed 09/01/16 Page 51 of 62 criminal activity that has occurred on the server and the TARGET WEBSITE, the identities of the other administrators and users of the TARGET WEBSITE will remain unknown. Sometimes, non-Tor-based websites have IP address logs that can be used to locate and identify the board?s users. In such cases, a publicly available lookup would be performed to determine what ISP owned the targeth address, and a subpoena would be sent to that ISP to determine the user to which the IP address was assigned at a given date and time. However, in the case of the TARGET WEBSITE, logs of member activity, if any, will contain only the IP addresses of Tor ?exit nodes? utilized by board. users. Those IP address logs cannot be used to locate and identify TARGET SUBJECTS of the TARGET WEBSITE. In order to attempt to identify those users, the website needs to remain operating so that authorization may be obtained to employ a NIT on the site to identify true IP addresses of TARGET SUBJECTS. The execution of a search warrant to seize the TARGET WEBSITE alone would not provide such authority. 70. Agents could execute another search warrant at a later date to again review historical private messages and private chats by TARGET SUBJECTS. Reviewing only historical private messages, private chats, and postings, however, is not suf?cient for the reasons stated above. A search warrant will not provide real?time information about TARGET SUBJECTS or communications between and among the TARGET SUBJECTS about their unlawful activities. That real-time information can be paired with other identifying data from a NIT to allow agents to quickly locate and apprehend TARGET SUBJECTS before or as soon as possible after the TARGET WEBSITE ceases operating. When the TARGET WEBSITE ceases to operate, in my training and eXperience, there is likely to be speculation among TARGET SUBJECTS that a law enforcement action has been takenagainst the TARGET WEBSITE. That may cause TARGET SUBJECTS to flee or destroy evidence before they can be apprehended. The need for real-time information that can be quickly acted Upon is heightened in the event that TARGET SUBJECTS disclose information about ongoing sexual abuse of child victims. Solely reviewing historical private messages, private chats, or postings may prevent agents from 40 Case Document 82-1 Filed 09/01/16 Page 52 of 62 immediately acting upon evidence of ongoing abuse disclosed via private messages or private chats. 71. Search warrants for the physical premises of the TARGET SUBJECTS are unavailable because the other TARGET SUBJECTS are unidenti?ed and communicating in a way that provides for their anonymity. It is not presently known with any certainty where any of the remaining TARGET SUBJECTS reside, or where they receive, hide, transfer, and conceal the proceeds of their crime. Once other TARGET SUBJECTS have been identi?ed, the use of search warrants of physical premises may be a valuable too]. However, until that time, the use of search warrants of physical premises of the TARGET SUBJECTS is infeasible. I 72.. Agents have considered. seizing the TARGET WEBSITE and removing it from existence immediately and permanently. However, at this time, no TARGET SUBJECTS besides the administrator described above have been identi?ed. There are multiple TARGET SUBJECTS who claim that they are sexually abusing children and sharing images of that abuse with others. Removing the TARGET WEBSITE from existence immediately and permanently upon seizure would end the distribution and receipt of child pornography taking place on the TARGET WEBSITE, however, it would prevent law enforcement from attempting to locate and identify the TARGET SUBJECTS and their child victims, and attempting to rescue those child victims from ongoing abuse. Any attempt to identify TARGET SUBJECTS requires that the TARGET WEBSITE remain operating for some period of time. Accordingly, it is your af?ant's belief that the seizure of the TARGET WEBSITE in conjunction with its continued operation for a limited period of time, the deployment of a NIT to attempt to identify actual IP addresses used by the TARGET SUBJECTS, and the interception and collection of private messages and private chats sent/received by TARGET SUBJECTS is appr0priate in this case. Con?dential Informants, Cooperating Sources, and Undercover Agents 41 Case Document 82-1 Filed 09/01/16 Page 53 of 62 73. Undercover agents have been used in this investigationito access the TARGET WEBSITE and document the sites, their categories, and postings on the sites. Cooperating individuals are unavailable because the TARGET SUBJECTS are currently unidenti?ed and therefore not available to assist with law enforcement activities. The use of undercover agents, con?dential informants and cooperating sources in this investigation is unlikely to succeed, however, in terms of meeting the stated objectives of the investigation at this stage. In order to obtain personally identifying, data about a TARGET SUBJECT, an undercover agent or cooperating individual would have to engage in private messaging with that TARGET SUBJECT, develop a signi?cant and trusting relatiOnship with "the TARGET SUBJECT, and attempt to elicit personally identifying information from the TARGET SUBJECT. As noted above, postings on the TARGET WEBSITE caution its members against providing such information. In my training and experience, such information is much more likely to have been exchanged between existing TARGET SUBJECTS who have already developed such a relationship with each other and shared such information via private messages or private chats. 74. Moreover, using an ?administrator? account on the TARGET WEBSITE to attempt to elicit personally identi?able information from TARGET SUBJECTS is not feasible and would immediately be viewed by TARGET SUBJECTS as susPicious and indicative of law enforcement in?ltration of the board. That would likely lead unidenti?ed TARGET SUBJECTS to ?ee the board and/or destroy evidence of their unlawful activity. Pen Registers and Trap and Trace Devices 75. Pen registers and trap and trace type data have been utilized in this Case to verify that the IP Address hosting the TARGET WEBSITE is sending and receiving data on the Tor network. However, at this stage of the investigation, they are inadequate investigative 42. Case Document 82-1 Filed b9/01/16 Page 54 of 62 techniques. Pen registers do not enable law enforcement of?cers to obtain the content of communications, which is necessary in order to identify the TARGET SUBJECTS. Moreover, because of the way that Tor operates, a pen register and trap and trace device deployed on the TARGET WEBSITE would reveal only the Tor ?exit node? used by TARGET SUBJECTS to access the board, which cannot be used to locate and identify that user; Electronic Interception 76. There have been no prior electronic interceptions of communications occurring on the TARGET WEBSITE. MINIMIZATION 77. Only electronic communications private messages and private chats) will be intercepted. All intercepted communications of the TARGET SUBJECTS will be minimized in accordance with Chapter 119 of Title 18, United States Code. The computer server intercepting all communications and on which the TARGET FACILITIES are located will be in Newington, VA, in the Eastern District of Virginia during the period of interceptiOn. A cepy of intercepted communications will be sent to an FBI facility in -Maryland, where certain FBI personnel will be stationed while the TARGET WEBSITE remains operating. Each private message and private chat will be reviewed over a secure system, and based on the identities of the sender and recipient and the content of the private message or private chat, monitoring- personnel will determine as soon as practicable after interception whether the private mes-sage or private chat appears to be relevant to the investigation or otherwise criminal in nature. If the private message or private chat is not criminal in nature, the private message or private chat will be marked ?minimized? and not accessed by other members of the investigative team. If the private message or private chat appears to be privileged, it will be marked ?privileged? and 43 Case Document 82-1 Filed 09/01/16 Page 55 of 62 secured from access by other members of the investigative'team. If a private message or private chat appears to be relevant to the investigatiOn or otherwise criminal in nature, it will be marked ?non-minimized? and may be shared with the other agents and monitors involved in the investigation. If a private mes-sage or private chat is marked ?minimized? or ?privileged,? it will not be disseminated to members of the. investigative team. All intercepted private messages and private chats will be sealed with the court upon the expiration of the court?s order authorizing the interception. It is anticipated that the monitoring location will be staffed at all times, at which time intercepted communications will be monitored and read. The monitoring location will be kept secured with access limited to only authorized monitoring personnel and their supervising agents. 78. As of February 12, 2015, a search of the Electronic Surveillance (ELSUR) Automated Records Systems for DEA, ICE and the FBI Was cenducted and revealed no prior applications for Court authorization to intercept the wire, oral, or electronic communications involving the same Subjects, facilities, or premises speci?ed in this affidavit. 79. IT IS REQUESTED that this Af?davit, the attached Application, the resulting Order, and all reports submitted pursuant to the Order, b7aled until further order of the court. Calicpe Basia/special Federal Bureau of Investigation Subscribed a sworn before me on this 0 ay ofF ru y, 2.015. . ITED . .5 . TRICT JUDGE EASTE rm: VIRGINIA . Anthony J. Trenga United States Dis Judge 44 Case Document 82-1 Filed 09/01/16 Page 56 of 62 FILED IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF VIRGINIA ALEXANDRIA DIVISION 1mg FEB THE MATTER OF THE APPLICATION OF THE UNITED STATES OF AMERICA i CAs . - em COMMUNICATIONS ORDER AUTHORIZING INTERCEPTION OF ELECTRONIC COMMUNICATIONS Application under oath having been made before me by Assistant United States Attorney for the Eastern District of Virginia Whitney Dougherty Russell and Department of Justice Child Exploitation and Obscenity Section Trial Attorney Michael Grant (hereinafter ?the prosecutors?l; who are investigative. or law enforcement of?cers of the United States within the. meaning of Section 2510(7) of Title 18, United States Code, for an order purSuant to Section 2518 of Title 18, United States Code, authorizing the interception of electronic communications, and full consideration having been given to the matters set forth therein, the Court ?nds: - a. there is probable cause to believe that _and other unidenti?ed administrators and users of the child pornography website upf45jv3bziuctml.onion have committed, are committing, and will continue to commit federal felony offenses as provided for by Section 2516(3) of Title 18, United States Code, that is: '18 U.S.C. 2252A(g), Engaging in a Child Exploitation Enterprise; 18 U.S.C. 2251(d)(1) and Advertising and ConSpiracy to Advertise Child Pornography; 18 U.S.C. and Receipt and Distribution of, and Conspiracy to Receive and Distribute Child Pornography; 18 U.S.C. and 1 Case Document 82-1 Filed 09/01/16 Page 57 of 62 and Knowing Possession of, Access or Attempted Access With Intent to View Child Pornography b. there is probable cause that the TARGET SUBJECTS, during the period of interception authorized by this Order, will use the private message function FACILITY and private chat function FACILITY of the TARGET WEBSITE in furtherance of the offenses described above; c. there is probable 'cause to believe that the interception of electronic communications authorized by the Order will reveal: the nattire, extent and methods of operation of the TARGET unlawful activities; (2) the identity of the TARGET SUBJECTS. and their victims, accomplices, aiders and labettors, co-conspirators and participants in their illegal activities, or information that may be useful-in establishing the identity of their victims, accomplices, aiders and abettors, co-conspirators and participants in their illegal activities; (3) the advertising, receipt, and distribution of child pornography related to those activities; (4) the existence and locations of records relating to those activities; and (5) the location and identity of computers used to further the TARGET OFFENSES. In addition, these electronic communications are expected to constitute admissible evidence of the commission of the above-described offenses. It is expected that monitoring of TARGET FACILITY I and TARGET FACILITY 2 (together referred to as the will provide valuable evidence against the TARGET SUBJECTS involved in illegal activities that cannot reasonably be obtained by other means; and d. it has been established that normal investigative procedures have been tried and have failed, reasonably appear unlikely to succeed if tried, or are too dangerous to employ. WHEREFORE, IT IS HEREBY ORDERED pursuant to Section 2518 of Title 18, United 2 Case Document 82-1 Filed 09/01/16 Page 58 of 62 States Code, that the FBI and/or individuals employed by or operating under a contract with the government and acting under the supervision of the FBI, are authorized to intercept electronic communications of the TARGET SUBJECTS occurring over the TARGET FACILITIES, until such electronic communications are intercepted that fully reveal: (I) the nature, extent and methods of Operation of the TARGET unlawful activities; (2) the identity of the TARGET SUBJECTS and their victims, accomplices, aiders and abettors, co-consPirators and participants in their illegal activities, or information that may be useful in establishing the identity of their victims, accomplices, aiders and abettors, co-conspirators and participants in their illegal activities; (3) the advertising, receipt, and distribution of child pornography related to those activities; (4) the existence and locations of records relating. to those activities; and (5) the location and identity of computers used to further the target offenses; and (6) admissible evidence of the commission of the above-described offenses - or for a period of thirty (30) days, to be measured from the earlier of the day on which the investigative or law enforcement of?cer first begins to conduct an interception under the Order or 10 days after the Order is entered, whichever is earlier from the date of this authorization. IT IS FURTHER ORDERED that, pursuant to Section 2518 of Title 18, United States Code, special agents with the FBI, and other ?investigative and. law enforcement of?cers,? as de?ned in Section 2510(7) of Title 18, United States Code, to be assisted, if necessary, by authorized translators, are authorized to intercept and. to record electronic communications of the TARGET SUBJECTS over the TARGET FACILITIES, and that this Order shall be executed as soon as practicable. IT IS FURTHER ORDERED that all monitdring of electronic communications shall 3 Case Document 82-1 Filed 09/01/16 Page 59 of 62 be conducted in accordance with Chapter 119 of Title 18, United States Code. That is, the computer server intercepting all communications and on which the TARGET FACILITIES are located will be in Newington, VA, in the Eastern District of Virginia during the period of interception. A copy of intercepted communications will be sent to. a facility in- MD, where certain FBI personnel will be stationed while the TARGET WEBSITES remain Ioperating. Each private message will be reviewed over a secure system, and based on the identities of the sender and recipient and the content of the private message or private chat, monitoring personnel will determine as soon as practicable after interception whether the private message or private chat appears to be relevant to the investigation or otherwise criminal in nature. If the private message or private chat is not criminal in nature, the private message or private chat will be marked "minimized" and not accessed by other members of the investigative team. If the private. message or private chat appears to be privileged, it will be marked "privileged" and secured from acCess by other members of the investigative team. If a private message or private chat appears to be relevant to the investigation or otherwise criminal in nature, it will be marked "non-minimized" and may be shared with the other agents and monitors involved in' the investigation. If a private message or private chat is marked "minimized" or "privileged," it will not be disseminated to members of the investigative team. All intercepted private messages and private chat will be sealed with the Court upon the expiration of the court?s order authorizing the interception. It is anticipated that the monitoring location will be staffed at all times, at which time intercepted communications will be monitored and read.? The monitoring location will be kept secured with access limited to only authorized monitoring personnel and their supervising agents. IT IS FURTHER ORDERED that the FBI, and any other law enforcement agency, is 4 Case Document 82-1 Filed 09/01/16 Page 60 of 62 permitted to intercept any electronic communications sent from, received by or occurring over the TARGET FACILITIES, including without limitation to any activity of any nature occurring within ACILITIES, private messages and private chats sent from or received by the TARGET FACILITIES, draft private messages and private chats, and deleted private messages and private chats; IT IS FURTHER ORDERED THAT the prosecutors or any other Special Assistant United States Attorney or Department of Justice Trial Attorney familiar with the facts of this case, shall cause to be provided to the Court a report on or about the ?fteenth and thirtieth day following the date of the Order or the date interception begins, whichever is later, showing the progress that has been made toward achievement of the authorized objectives and the need for continued interception, although if the Order is renewed for a further period of interception, the application for renewal may serve as the report on or about the thirtieth day. If any of the above?ordered reports should become due on a weekend or holiday, such report shall become due on the next business day thereafter. IT IS FURTHER ORDERED that this Order, as well as the supperting Application, Af?davit (along with its attachments), proposed Orders, and all interim reports ?led with the Court, be sealed until further order of this Court, except that copies of the Order, in full or redacted form, may be served on the FBI as necessary to effectuate the Court?s Order. Moreover, the United States may disclose the existence of the interception Order and the contents. of pertinent intercepted communications, pursuant to Title 18, United States Code, Sections 2517(2) and (3), as appropriate for the purposes of providing relevant facts to a Court in support of any complaint, arrest warrant, and search or seizure warrant. In addition, the United States may disclose facts, pursuant to Title 18, United States Code, Sections 5 Case Document 82-1 Filed 09/01/16 Page 61 of 62 2517(2) and (3), to' provide relevant testimony at any preliminary hearings, detention hearings, grand jury proceedings and other proceedings pertaining to the TARGET SUBJECTS and others as yet unknown. The United States may also disclose facts to foreign investigative or law enforcement of?cers, pursuant to Title 18, United States Code, Section 2517(7), as necessary to the proper performance of the official duties of the offer making or receiving such disclosure?, and that foreign investigative or law enforcement of?cers may use or disclose such facts or derivative evidence to the extent such use or disclosure is to the proper performance of their of?cial duties. .IT IS FURTHER ORDERED that no inventory or return of the results of the foregoing interception need be made, other than the above required reports, before 90 days from the date of the expiration of the Order, or any extension of the Order, or at such time as the Court in its discretion may require; and IT IS FURTHER ORDERED that, upon an ex parte showing of good cause to a judge of competent jurisdiction, the service of the above inventory or return may be postponed for a further reasonable period of time. DATED: February 20, 2015 Anthony J. Trenaa nastiness a J. TRENGA UNITED STATES DISTRICT JUDGE Presented by: AUSA Whitney Dougherty Russel] Trial Attorney Michael Grant Case Document 82-1 Filed 09/01/16 Page 62 of 62