Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 1 of 99 IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MARYLAND IN THE MAHER OF THE SEARCH OF COMPUTERS THAT ACCESS "\\IEBSITES 1-23" ) ) Case No. \ =. - \'\ '-\ '"" '-='c: ) AHIDA VIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANT I, being first duly sworn, hereby depose and state: INTRODUCTION 1. I have been employed as a Special Agent ("SA") with thc Fedcral Bureau of hl\'estigation (FBI) since_ and I am currently assigned to the FI3I's Violent Crimes Against Childrcn Scction, Major Case Coordination Unit ("MCCU"). I currently investigatc federal violations concerning child pornography and thc sexual exploitation of children and havc gaincd cxperience through training in seminars, classes, and everyday work related to these typcs of investigations. I havc participated in the execution of numerous warrants involving the search and scizure of computers, computer equipment, software, and electronically stored infonnation, in conjunction \\ith criminal investigations pertaining to child pornography the sexual exploitation of children. I have receivcd training in the area of child pornography and child exploitation, and have had the opportunity to observe and review numerous examples of child pornography (as defincd in 18 U.S.C. ~ 2256) in all forms of media including computer media. I am an "investigative or law cnforcement officer" of the United States within the meaning of Section 2510(7) of Title 18, United States Code, and am empowered by law to conduct investigations of, and to make arrcsts for, offenses enumerated in Section 2516 of Title 18, United States Code. Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 2 of 99 2. I make this affidavit in support of an application for a search warrant to use a network investigative technique ("NIT") on users of Websites 1-23 as further described in this affidavit and its attachments.! 3. The statements contained in this affidavit are based in part on: information provided by FBI Special Agents; written reports about this and other investigations that I have received, directly or indirectly, from other law enforcement agents, including foreign law enforcement agencies as described below; information gathered from the service of administrative subpoenas; the results of physical and electronic surveillance conducted by federal agents; independent investigation and analysis by FBI agents/analysts and computer forensic professionals; my experience, training and background as a Special Agent with the FBI, and communication with computer forensic professionals assisting with the design and implementation of the NIT. This affidavit includes only those facts that I believe are necessary to establish probable cause and does not include all of the facts uncovered during the investigation. RELEVANT STATUTES 4. This investigation concerns alleged violations of: 18 U.S.C. a Child Exploitation Enterprise; 18 U.S.C. Advertise Child Pornography; Distributing/Conspiracy SS 2251(d)(I) 18 U.S.C. SS S 2252A(g), Engaging in and (e), Advertising and Conspiracy to 2252A(a)(2)(A) and (b)(l), to Receive and Distribute Child Pornography; Receiving and and 18 U.S.C. S 1 The actual names of Web sites 1-23 are known to law enforcement. The sites remains active and disclosure afthe names of the sites would potentially alert users to the fact that law enforcement action is being taken against the sites, potentially provoking users to notifY other users of law enforcement action, flee, andlor destroy evidence. Accordingly, for purposes of the confidentiality and integrity of the ongoing investigation involved in this matter, specific names and other identifYing factors have been replaced with generic terms. 2 • • (a.lf 3 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 3 of 99 2252A(a)(5)(B) and (b)(2), Knowing Access or Attempted Access With Intent to View Child Pornography. a. 18 U.S.C. ~ 2252A(g) prohibits a person from engagIng in a child exploitation enterprise. A person engages in a child exploitation enterprise if the person violates, inter alia, federal child pornography crimes listed in Title 18, Chapter I09A, as part of a series of felony violations constituting three or more separate incidents and involving more than one victim, and commits those offenses in concert with three or more other persons; b. 18 U.S.C. ~~ 225 I(d)(I) and (e) prohibits a person from knowingly making, printing or publishing, or causing to be made, printed or published, or conspiring to make, print or publish, any notice or advertisement seeking or offering: (A) to receive, exchange, buy, produce, display, distribute, or reproduce, any visual depiction, if the production of such visual depiction involves the use of a minor engaging in sexually explicit conduct and such visual depiction is of such conduct, or (B) participation in any act of sexually explicit conduct by or with any minor for the purpose of producing a visual depiction of such conduct; c. 18 U.S.C. ~~ 2252A(a)(2) and (b)(I) prohibits a person from knowingly receiving or distributing, or conspiring to receive or distribute, any child pornography or any material that contains child pornography, as defined in 18 U.S.c. ~ 2256(8), that has been mailed, or using any means or facility of interstate or foreign commerce shipped or transported in or affecting interstate or foreign commerce by any means, including by computer; 3 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 4 of 99 d. 18 U.S.C. SS 2252A(a)(5)(B) and (b)(2) prohibits a person from knowingly possessing or knowingly accessing with intent to view, or attempting to do so, any material that contains an image of child pornography, as defined in 18 U.S.C. S 2256(8), that has been mailed; or shipped or transported using any means or facility of interstate or foreign commerce or in or affecting interstate or foreign commerce by any means, including by computer, or that was produced using materials that have been mailed or shipped or transported in or affecting interstate or foreign commerce by any means, including by computer. DEFINITIONS OF TECHNICAL TERMS USED IN THIS AFFIDAVIT 5. The following definitions apply to this Affidavit: a. "Bulletin Board" means an Internet-based website that is either secured (accessible with a password) or unsecured, and provides members with the ability to view postings by other members and make postings themselves. Postings can contain text messages, still images, video images, or web addresses that direct other members to specific content the poster wishes. Bulletin boards are also referred to as "internet forums" or "message boards." A "post" or "posting" is a single message posted by a user. Users of a bulletin board may post messages in reply to a post. A message "thread" refers to a linked series of posts and reply messages. Message threads often contain a title, which is generally selected by the user who posted the first message of the thread. Bulletin boards often also provide the ability for members to communicate on a one-to-one basis through "private messages." Private messages are similar to e-mail messages that are sent 4 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 5 of 99 between two members of a bulletin board. They are accessible only by the user who sent/received such a message, or by the bulletin board administrator. b. "Child erotica," as used herein, means any material relating to minors that serves a sexual purpose for a given individual, including fantasy writings, letters, diaries, books, sexual aids, souvenirs, toys, costumes, drawings, and images or videos of minors that are not sexually explicit. c. "Child Pornography," as used herein, is defined in 18 U.S.C. S 2256 (any visual depiction of sexually explicit conduct where (a) the production of the visual depiction involved the use of a minor engaged in sexually explicit conduct, (b) the visual depiction is a digital image, computer image, or computergenerated image that is, or is indistinguishable from, that of a minor engaged in sexually explicit conduct, or (c) the visual depiction has been created, adapted, or modified to appear that an identifiable minor is engaged in sexually explicit conduct). d. "Computer," as used herein, is defined pursuant to 18 U.S.C. S I030(e)(I) as "an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device." e. "Computer Server" or "Server," as used herein, is a computer that is attached to a dedicated network and serves many users. A web server, for example, is a computer which hosts the data associated with a website. 5 That web server Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 6 of 99 receives requests from a user and delivers information from the server to the user's computer via the Internet. A DNS (domain name system) server, in essence, is a computer on the Internet that routes communications when a user types a domain name, such as www.cnn.com. into his or her web browser. Essentially, the domain name must be translated into an Internet Protocol (IP) address so the computer hosting the web site may be located, and the DNS server provides this function. f. "Computer hardware," as used herein, consists of all equipment which can receive, capture, .collect, analyze, create, display, convert, store, conceal, or transmit electronic, magnetic, or similar computer impulses or data Computer hardware includes any data-processing devices (including, but not limited to, central processing units, internal and peripheral storage devices such as fixed disks, external hard drives, floppy disk drives and diskettes, and other memory storage devices); peripheral input/output devices (including, but not limited to, keyboards, printers, video display monitors, and related communications devices such as cables and connections), as well as any devices, mechanisms, or parts that can be used to restrict access to computer hardware (including, but not limited to, physical keys and locks). g. "Computer software," as used herein, is digital information which can be interpreted by a computer and any of its related components to direct the way they work. Computer software is stored in electronic, magnetic, or other digital form. It commonly includes programs to run operating systems, applications, and 6 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 7 of 99 utilities. h. "Computer-related documentation," as used herein, consists of written, recorded, printed, or electronically stored material which explains or illustrates how to configure or use computer hardware, computer software, or other related items. i. "Computer passwords, pass-phrases and data security devices," as used herein, consist of information or items designed to restrict access to or hide computer software, documentation, or data. Data security devices may consist of hardware, software, or other programming code. A password or pass-phrase (a string of alpha-numeric characters) usually operates as a sort of digital key to "unlock" particular data security devices. Data security hardware may include encryption devices, chips, and circuit boards. Data security software of digital code may include programming code that creates "test" keys or "hot" keys, which perform certain pre-set security functions when touched. Data security software or code may also encrypt, compress, hide, or "booby-trap" protected data to make it inaccessible or unusable, as well as reverse the progress to restore it. J. "Hyperlink" refers to an item on a web page which, when selected, transfers the user directly to another location in a hypertext document or to some other web page. k. The Internet is a global network of computers and other electronic devices tbat communicate with each other. Due to the structure of the Internet, connections between devices on the Internet often cross state and international 7 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 8 of 99 borders, even when the devices communicating with each other are in the same state. I. "Internet Service Providers" (ISPs), as used herein, are commercial organizations that are in business to provide individuals and businesses access to the Internet. ISPs provide a range of functions for their customers including access to the Internet, web hosting, e-mail, remote storage, and co-location of computers and other communications equipment. ISPs can offer a range of options in providing access to the Internet including telephone based dial-up, broadband based access via digital subscriber line (DSL) or cable television, dedicated circuits, or satellite based subscription. ISPs typically charge a fee based upon the type of connection and volume of data, called bandwidth, which the connection supports. Many ISPs assign each subscriber an account name _ a user name or screen name, an .•e-mail address •••.an e-mail mailbox, and a personal password selected by the subscriber. By using a computer equipped with a modem, the subscriber can establish communication with an ISP over a telephone line, through a cable system or via satellite, and can access the Internet by using his or her account name and person'al password. m. "Internet Protocol address" or "IP address" refers to a unique number used by a computer to access the Internet. IP addresses can be dynamic, meaning that the Internet Service Provider (ISP) assigns a different unique number to a computer every time it accesses the Internet. lP addresses might also be static, if an ISP assigns a user's computer a particular IP address which is used each time the 8 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 9 of 99 computer accesses the Internet. IP addresses are also used by computer servers, including web 'servers, to communicate with other computers. n. "Minor" means any person under the age of eighteen years. See 18 U.S.C. Ii 2256(1). o. The terms "records," "documents," and "materials," as used herein, include all information recorded in any form, visual or aural, and by any means, whether in handmade form (including, but not limited to, writings, drawings, painting), photographic form (including, but not limited to, microfilm, microfiche, prints, slides, negatives, videotapes, motion pictures, photocopies), mechanical form (including, but not limited to, phonograph records, printing, typing) or electrical, electronic or magnetic form (including, but not limited to, tape recordings, cassettes, compact discs, electronic or magnetic storage devices such as floppy diskettes, hard disks, CD-ROMs, digital video disks (OVDs), Personal Digital Assistants (PDAs), Multi Media Cards (MMCs), memory sticks, optical disks, printer buffers, smart cards, memory calculators, electronic dialers, Bernoulli drives, or electronic notebooks, as well as digital data files and printouts or readouts from any magnetic, electrical or electronic storage device). p. "Sexually explicit conduct" means actual or simulated (a) sexual intercourse, including genital-genital, oral-genital, or oral-anal, whether between persons of the same or opposite sex; (b) bestiality; (c) masturbation; (d) sadistic or masochistic abuse; or (e) lascivious exhibition of the genitals or pubic area of any person. See 18 U.S.C. Ii 2256(2). 9 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 10 of 99 q. "Visual depictions" include undeveloped film and videotape, and data stored on computer disk or by electronic means, which is capable of conversion into a visual image. See 18 U.S.C. r. S 2256(5). "Website" consists of textual pages of information and associated graphic images. The textual information is stored in a specific format known as HyperText Mark-up Language (HTML) and is transmitted from web servers to various web clients via Hyper-Text Transport Protocol (HTTP). PROBABLE CAUSE The Tor Network 6. .The targets of the investigative technique described herein are the administrators and users of twenty-three (23) child pornography web sites who regularly send and receive illegal child pornography via websites that operate as "hidden services" located on the Tor network, described below and referred to herein as Websites 1-23. Websites 1-23 are all dedicated to the advertisement and distribution of child pornography, the discussion of matters pertinent to child sexual abuse, including methods and tactics offenders use to abuse children, as well as methods and tactics offenders use to avoid law enforcement detection while perpetrating online child sexual exploitation crimes such as those described in paragraph 4 of this affidavit. 7. Websites 1-23 operate on an anonymity network available to Internet users known as "The Onion Router" or 'Tor" network. Tor was originally designed, implemented, and deployed as a project of the U.S. Naval Research Laboratory for the primary purpose of protecting government communications. It is now available to the public at large. Information documenting what Tor is and how it works is provided on the publicly accessible Tor website at www.torproject.org. In order 10 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 11 of 99 to access the Tor network, a user must install Tor software either by downloading an add-on to the user's web browser or by downloading the free "Tor browser bundle" available at www.torproject.org.2 8. The Tor software protects users' privacy online by bouncing their communications around a distributed network of relay computers run by volunteers all around the world, thereby masking the user's actual IP address which could otherwise be used to identify a user. It prevents someone attempting to monitor an Internet connection from learning what sites a user visits, prevents the sites the user visits from learning the user's physical location, apd it lets the user access sites which could otherwise be blocked. Because of the way Tor routes communications through other computers, traditional IP identification techniques are not viable. When a user on the Tor network accesses a website, for example, the IP address of a Tor "exit node," rather than the user's actual IP address, shows up in the website's IP log. An exit node is the last computer through which a user's communications were routed. There is no practical way to trace the user's actual IP back through that Tor exit node IP. In that way, using the Tor network operates similarly to a proxy server. 9. Tor also makes it possible for users to hide their locations while offering various kinds of services, such as web publishing, forum/website hosting, or an instant messaging server. Within the Tor network itself, entire websites can be set up as "hidden services." "Hidden services" operate the same as regular public websites with one critical exception. The IP address for the web server is hidden and instead is replaced with a Tor-based web address, which is a series of algorithmgenerated characters, such as "asdlk8fs9dflku7f" followed by the suffix ".onion." A user can only 2 Users may aJso access the Tor network through so-called Ugateways" on the open Internet such as uonion.tou and "tor2web.org," however, use of those gateways does not provide users with the anonymizing benefits of the Tor network. II Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 12 of 99 reach these "hidden services" if the user is using the Tor client and operating in the Tor network. And unlike an open Internet website, is not possible to determine through public lookups the IP address of a computer hosting a Tor "hidden service." Neither law enforcement nor users can therefore determine the location of the computer that hosts the website through those public lookups. Finding and Accessing Websites 1-23 10. Because Websites 1-23 are Tor hidden services, they do not reside on the traditional or "open" Internet. A user may only access Websites )-23 through the Tor network. Even after connecting to the Tor network, however, a user must know the web address of one of the websites in order to access the site. Rather than a plain language address containing the name of the website such as www.cnn.com. a Tor web address is a series of algorithm-generated characters, such as "asdlk8fs9dflku7f' followed by the suffix ".onion." Moreover, Tor hidden services are not indexed like websites on the traditional Internet. Accordingly, unlike on the traditional Internet, a user may not simply perform a Google search for the name of one of the websites on Tor to obtain and click on a link to the site. A user might obtain the web address directly from communicating with other users of the board, or from Internet postings describing the sort of content is available on one of the website as well as the website's location. For example, there is a Tor "hidden service" page that is dedicated to pedophilia and child pornography. That "hidden service" contains a section with links to Tor hidden services that contain child pornography. Nearly all of Websites 1-23, with the exception of Web sites 8,15 and 20, are listed in that section. Accessing Websites 1-23 therefore requires numerous affirmative steps by the user, making it extremely unlikely that any user could simply stumble upon Websites 1-23 without understanding its purpose and content. Accordingly, there is probable cause to believe that, for the reasons described below, any user who successfully 12 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 13 of 99 accesses Websites 1-23 has knowingly accessed with intent to view child pornography, or attempted to do so. Identification and Seizure of the Computer Server Hosting Websites 1-23 11. Through investigation, the FBI identified a single computer server that hosts Websites 1-23 and dozens of other illegal Tor network child pornography websites at Users of Websites 1-23 and the other websites hosted on that same computer server are engaged in the rampant and ongoing sexual exploitation of children, including the production and dissemination of child pornography, to include newly produced images of child pornography indicative of the ongoing sexual abuse of children. While possession of the data will provide important evidence concerning the criminal activity that has occurred on the server and Websites 1-23, the identities of the administrators and users of Websites 1-23 will remain tmknown. Sometimes, non-Tor-based websites have IP address logs that can.be used to locate and identify the board's users. In such cases, a publicly available lookup would be performed to determine what ISP owned the target IP address, and a subpoena would be sent to that ISP to determine the user to which the IP address was assigned at a given date and time. However, in the case of Websites 1-23, the logs of member activity will contain only the IP addresses of Tor "exit nodes" utilized by board users. Those IP address logs cannot be used to locate and identify the administrators and users of Websites 1-23. Accordingly, Websites 1-23 will remain operating at a government facility in ~e District of Maryland, for a limited period of time in order to locate and identify the administrators and users of Websites 1-23. Such a tactic is necessary in order to locate and apprehend offenders including users of Websites 1-23 who are 13 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 14 of 99 engaging in the continuing sexual abuse and exploitation of children, and to locate and rescue children from the imminent harm of ongoing abuse and exploitation. Description of Websites 1-23 and Their Content Website 1 12. On June 25, 2013, an FBI Special Agent operating in the District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden service at the URL ereinafter referred to as "Website 1"). Website 1 is a Tor network hidden service whose primary purpose is the production and dissemination of new child pornography between and among producers of child pornography-i.e., individuals who sexually abuse children, document that sexual abuse via photos or video, and share that documented sexual abuse with others. Website 1 requires users to both register and upload child pornography to the satisfaction of the site's administrators before they are allowed to access the child pornography on the site. 13. A review of the initial web page revealed it was a message board that contained the name of the site and the words "Private Sharing Community." Located below the title was the current date and time, along with the text "Welcome, Guest." A data-entry field with a corresponding button entitled "Login" and the text, "Please login or register. Login with usemame and password," was located below the "Welcome Guest" text. 14. Located below the login field were three tabs entitled "Home," "Login" and "Register." A review of the "Home" tab, which was the default tab, revealed the following forums and corresponding topics and posts, which were visible to any user who accessed the site: 14 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 15 of 99 Forum Topics Posts General Boards Welcome to [Website 1] I Read this before you register. Open Boards - Giving you our old stuff so you can have something new Open Girls Posts 0 0 Open Boys Posts 0 0 15. A review of the "Welcome to [Website I]" forum revealed one topic entitled "Welcome Q&A," which contained one post with the same title. This post was made on August 22, 20 II by a user who was listed as an administrator of the board. This post contained the following text: Welcome to [Website 1]1 Q: What is [Website I]? A: We are a forum for producers of pre-teen material Q: How do I become a member? A: fIrstly decide on your NEW nickname. We do NOT want people using nicks that they use elsewhere in the community, it will only stop you from participating properly here. Decide on something original. Random lettered nicks will not be accepted at all. After you have registered as a member on the board you must submit an application post for the Admins to approve. Until the Admins have approved your application you will not be able to see any content of the board. Q: What material can I use for application? A: Application posts must contain self-produced material of a PRETEEN (Before Puberty) Girl or Boy or it will not be accepted. Enjoy your time here, contribute and make it last..lurk and watch it slip away. The [Website I abbreviation] Admins. 16. Based on my training and experience, I believe that "self-produced material" refers to child pornography images or videos that the user has personally produced by videotaping or photographing a minor that is engaged in sexually explicit conduct. Also based on my training and experience, I believe that the reference to the term "community" in the above quoted post is to the community of individuals who sexually exploit children online through 15 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 16 of 99 websites such as Website I. 17. Registration on Website I is open to any user and requires only the creation of a usemarne and password. After registering an account via the "Registration" tab and logging into the site as a registered user, a review of the "Home" tab revealed two additional forums in the General Boards section, as follows: Forum Topics Posts General Boards Rules 3 3 Read this before doing anything else and stay updated! Application Posts 2 II Apply here for access to Member groups. Topics is only visible to topic starter and Admins. 18. A review of the "Rules" forum revealed it contained the following three topics: Getting a Membership Filehosts for your uploads & Banned Hosts READ! Rules 19. The first two topics were created by a user who was listed as an administrator of the site in September of2011 and the last topic was created by a second user who was also listed as an administrator of the site in August of 20 II. The "Getting a Membership" topic contained one post, made by one of the administrators, which contained the following text: OK, so you just signed up and now you wonder where all the nice stuff is? Memberships We have two types of membership. You apply for a membership in the "Application Board." Your application is only visible to you and the admins - not to other members. Applications will then be processed by the Adrnins who will approve or disapprove. Private Membership - For those with new, rare or private material Application posts must contain new or rare material of a PRETEEN (Before Puberty) Girl or Boy or it will not be accepted and you will have to resubmit. We do NOT accept normal family photo's of nude children or children playing on the 16 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 17 of 99 beach or elsewhere. The children must at least pose in a sexual way like spreading legs or showing pussy. Producer Membership - For those who are active with children. You must prove that you are the producer of the material- check the Application Board for the requirements for the proof material. Producers have access to all members boards. We look forward to your Application! The Admins. 20. Accordingly, access to child pornography on Website I is limited to those members who apply for and are accepted as private members or producer members. Those sections of the website are accordingly accessible only to members who successfully apply for and are granted those levels of membership. 21. A review of the "Application Posts" forum revealed the following two topics: Rules for Application - READ THIS BEFORE YOU APPLY! (2734 views) Example of an Application Post (5254 views) A review of the above two topics revealed instructions for how to submit an application and provided a description of an example. Among other things, these topics instructed users to submit at least a 25MB (megabyte) file with at least 25 images or two-minute video in good quality. Producers were further instructed to submit the following: I. The Proof Material must be at least 5 High Quality Pictures or 15 seconds of High Quality Video. 2. A large clear Sign (letter or A4 sized paper) with the text "(Your Nick) for [Website I)" must be visible in the ALL Proof Material. The Sign can be hold by the Child or placed on his / her Body. . 3. A Candle must be visible in ALL Proof Material. The Candle must be hold by the Child or inserted into his / her Mouth, Ass or Pussy (it does not have to be lit). 4. The Proof Material must show different positions / poses of the Child? all with the candle and sign visible. 5. The Proof Material must show must of the Childs Body. We do not accept close-ups images only. 6. The Proof Material can not be a part of the Entry Post. lbe proof is for the Admins only and the Entry Post for the other Producers. 17 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 18 of 99 We hope you understand that the strict requirements is for your own and the other Producers safety. No one likes the wrong people (scarnmers) to get into the Producers Boards. We look forward to your application. The Admin Team. 22. No further Website 1 content was accessible to the undercover law enforcement officer, who did not apply for private or producer membership because of the website's requirement, described above, that users post specific child pornography in order to gain those levels of membership. 23. After registering an account via the "Registration" tab and logging into the site as a registered user, an additional tab entitled "My Messages" was observed in the same area as the "Home" tab. Further, a hyperlink was observed near the bottom of the home page entitled "Personal Messages" and the text "You've got 0 messages .... Click here to view them." This "Personal Messages" function appeared to be a feature that allowed users to send each other private or "personal" messages. Website 2 24. Between June 25 and June 28, 2013, an FBI Special Agent operating in the District of MaI)'land connected to the Internet via the Tor Browser and accessed the Tor hidden service at the URL .onion (hereinafter referred to as "Website 2"). Website 2's format, commonly known as an image board, allows users to upload images to and download images from the website, whose primaI)' purpose is the advertisement and distribution of child pornography. The name of Website 2 includes a word that denotes an individual with a sexual interest in children. Though registration with a username and password is available, the site's full content may be accessed by unregistered users. Based on a review of the site, as well as my 18 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 19 of 99 training and experience, I believe that Website 2 is primarily dedicated to the advertisement and distribution of child pornography images and videos: 25. A review of the initial web page of Website 2 revealed the following five hyperlinks: News; FAQ; Rules; Safety; and Links. Located on the left side of the web page was a separate frame with "4pedo" as the title. The following hyperlinks were located in this section: [Website 2 name] Front Page [Show Directories] [Remove Frames] Female Girls Girl Videos NonNude & Models Girl Requests Jailbait Studio Girls Little Brown Fucking Machines Magazine and Vintage Male Boys Boy Vids NonNude & Models Boy Requests Male Jailbait Magazine & Vintage Fetish Boy & Girl Baby & Todds Boy Feet Girl Feet Scat & Pee Pantyhose & Undies Mise Random Help Discussion 3D & Cartoon Security 19 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 20 of 99 Fakes Stories Archives Girls Girl Requests Non-Nude & Models Little Brown Fuck Machines Studio Girls Boys Boy Requests 26. Based on my training and experience, I believe that the categories available on the site are consistent with an image board dedicated to child pornography. In particular, I believe that the term "todds" refers to toddler-aged children and the term 'jailbait" refers to sexualized minor children. That was confirmed by a review of images available on the website, as described below. 27. Accessing each of the hyperlinks in the section on the left side of the web page revealed web pages that contained the corresponding title at the top of the page. One or more images were typically included with this title and the majority appeared to contain child pornography (CP) or child erotica depicting prepubescent males and females. There did not appear to be any sections for adult pornography. 28. For example, several images in the "News" section appeared to contain child pornography (CP) and child erotica depicting prepubescent females. One of these images, which was posted in a section instructing users how to delete identifying information out of images in order to avoid detection by law enforcement or other authorities, depicted a prepubescent female with her mouth open holding what appeared to be an adult male's penis in her right hand. 29. Located below the title on each web page were six separate data-entry fields with 20 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 21 of 99 the corresponding titles: Name, Email, Subject, Message, File, and Password (for post and file deletion). A "Browse" button was located next to the File field. Located below the aforementioned fields were posts made by users. A review of these posts revealed that each post appeared to contain an image, text, or link to an external site; along with the username of the person who made the post ("anonymous" ifno user name was provided), the date and time of the post, text and subject line (if entered by the user), and any replies made by other users. 30. A review of images posted to the various categories revealed numerous images containing CP and child erotica depicting prepubescent males, females, toddlers, and infants. Examples of these images are as follows, beginning with the particular section where the image was observed: Baby & Todds: Located next to the title of this page were two images depicting toddler females. One of the images depicts the toddler's tongue pressed against an adult male's penis. The second image depicts what appears to be a toddler female holding an adult male's penis in each hand. Boys: Located at the top of the page was an image depicting a naked prepubescent male lying in a bathtub, exposing his genitalia. Girls: Located in the middle of the page as approximately the fifth post from the top was an image depicting a naked female toddler lying on her back with her legs spread apart and raised in the air, exposing her vagina and anus. Boy & Girl: Located near the bottom of the page as approximately the ninth post from the top was an image depicting a naked prepubescent male who appears to be penetrating a naked prepubescent female's vagina. Girl Requests: Located near the middle of the page as approximately the fourth post from the top was an image depicting a naked prepubescent female lying on her back with her legs spread apart and raised in the air, exposing her vagina and anus. 31. In total there appears to be hundreds or thousands of images of child pornography 21 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 22 of 99 and/or child erotica available on the Website 2. 32. No private message features were located on the web page and no registration was required to view any of the content. Accordingly, all areas of the website are accessible to any user of the site, whether registered or not. Website 3 33. On July 1,2013, an FBI Special Agent operating in the District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden service at the URL onion (hereinafter referred to as "Website 3"). Website 3 appeared to be a message board website whose primary purpose is the advertisement and distribution of child pornography. According to statistics posted on the site, Website 3 contained a total of214 posts, 197 total topics, and 2,996 total members. 34. On the main page of the site, located to the right of the site name was the current date and time, along with the text, "Welcome Guest. Please login or register," and two data-entry fields with a corresponding "Login" button. Located below the aforementioned items were the following five hyperlinks: Horne Help Search Calendar Login Register 35. Located below the above hyperlinks was one forum entitled "If your [sic] interested in joining the forums, and Private Soceity! [sic]" This forum contained 144 Posts and 142 Topics. A review of the "If your [sic] interested in joining the forums, and Private Soceity!" 22 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 23 of 99 forum revealed the majority of the topics and posts appeared to be from users requesting access. One post entitled "Registration Administrator How To" was made by a user who was listed as the on February 29, 2012. That post advised users of the password users could use to register for membership 36. on the site. Registration to the message board required a user to enter a usernarne, password, e-mail accoUnt and the aforementioned access password. After successfully registering and logging into the site, a section entitled "CP," which in my training and experience refers to child pornography, appeared that included the following forums and sub-forums, corresponding number of topics and posts in each: Forum General Introductions TORCP Links Artwork Interracial Fetish Girl Boy Girl x Boy Girl x Girl BoyxBoy 37. along with the Topics 3 40 Posts I I 8 43 3 5 o o 4 I I I 4 2 I I o o I I A review of the various topics within the above forums revealed each topic contained a title, the author, the number of replies, the number of views, and the last post. The last post section included the date and time of the post as well as the author. topic, the original post appeared at the top of the page, with any corresponding Upon accessing a replies to the original post included the post thread below it. Typical posts appeared to contain text, images, thumbnail-sized previews ofimages, compressed files (such as Roshal Archive files, commonly 23 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 24 of 99 referred to as ".rar" files, which are used to store and distribute multiple files within a single file), links to external sites, or replies to previous posts. 38. A review of the various topics within the "General" and "Introductions" forums revealed the majority contained general information in regards to the site, instructions for how to post, and welcome messages between users. A review of topics within the remaining forums revealed the majority contain~d rules for posting, as well as numerous images that appeared to depict child pornography (CP) and child erotica of prepubescent and males. Examples of these are as follows: On March 6, 2013, the user "_ posted a topic entitled "Bondage" in the forum "Fetish" that contained numerous images depicting CP and bondage of prepubescent females. One of these depicted a naked prepubescent female lying face down with her hands bound behind her back and her ankles bound with red rope or string. Her legs were spread apart, exposing her vagina. On January 27, 2013, the user'_ posted a topic entitled "some pee ..." in the forum "Fetish" that contained numerous images depicting CP of prepubescent females. One of these depicted a prepubescent female who was naked from the waist down and squatting with her legs spread apart, exposing her vagina. 39. A list of members, which was accessible after registering that approximately Approximately 40. for an account, revealed 19 users made at least two posts to one or more of the forums. three of these users made at least 20 posts. A private message feature also appeared to be available on the site, after registering, that allowed users to send each other private messages, referred to as "personal messages. " Website 4 41. Between June 26 and June 28, 2013, an FBI Special Agent operating in the 24 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 25 of 99 District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden service at the URL onion (hereinafter referred to as "Website 4"). Website 4 appeared to be a message board website whose primary purpose is the advertisement and distribution of child pornography video of minor boys. The name of the site contains both the word "boy" and a reference to video. Statistics posted on the site's home page indicated that the site had 5,428 members, 40,503 posts and 4,868 topics. 42. A review of the initial web page revealed that it contained the name of the site and an image depicting the partial face of what appeared to be a prepubescent or early pubescent male. Located below the title was the current date and time, a welcome message, various hyperlinks (including "Home," "Help," "Search," "Login," and "Register"), and the following text: . News: Want to chat with other pedo's and boy lovers? Come chat with us over at #Boys! Find out how to connect -HERE-. 43. Based on my training and experience, I believe that "pedo's" is a reference to pedophiles - i.e., persons with a sexual interest in prepubescent children. Accessing the "HERE-" hyperlink revealed a set of instructions for how to download Internet Relay Chat (lRC) software and configure an account. IRC software is computer software that allows users to engage in real-time chats over the internet, similar to an instant-messaging program. If a user chose to download and use such software, those communications would take place on a separate computer server than the computer server on which the website operated. #Boys would then be a particular location on the IRe software program, similar to a chat room, where multiple users could chat with each other. 25 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 26 of 99 44. Located below the aforementioned items were four sections containing the following forums, with the corresponding number of topics and posts in each: Sections Important Information README Tutorials Videos Non/Partial-Nude Boys Softcore Boys Hardcore Boys Requests Images Non/Partial-Nude Boys Naked + Hardcore Boys MJB Requests Other Chat Broken Links 45. Topics Posts 3 138 3 859 60 245 1006 977 499 2306 12562 3911 73 245 81 491 956 3696 958 2225 1508 41 12349 179 Based on my training and experience, I believe that the term MJB refers to "male jailbait," which is a reference to a sexualized minor child. Each of the above forums contained descriptions directly underneath the forum name. For example, the forum "Hardcore Boys" contained the description, "Hardcore Boys Only! Fucking, sucking & masturbating Boys!" Based on my training and experience, I believe that "hardcore" refers to sexual activity involving penetrative sexual acts such as vaginal, anal and oral sex. "Softcore" refers to nudity and sexual activity that does not include penetrative sexual acts. 46. A review of the various topics within the "READ ME" and "Tutorials" forums revealed, among other things, instructions for how to post, recommended sites to use to upload files to the website, recommended software programs or security features, and questions in regards to these items. 26 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 27 of 99 47. A review of the various forums and topics within the "Videos," "Images" and "Other" sections revealed, among other things, numerous image and/or video files that appeared to contain child pornography (CP), child erotica, or text indicative of an interest in CP. Each topic within these forums contained a title, the author, the number of replies, the number of views, and the last post. The last post section included the date and time of the post as well as the author. 48. Upon accessing a topic, the original post appeared at the top of the page, with any corresponding replies to the original post included in the post thread below it. Typical posts appeared to contain text, images, thumbnail previews of images, compressed files (such as ".rar" files), links to external sites, or replies to previous posts. Examples of these include: The user '_' posted a topic entitled "[boy + man] Scott llyo and man" to the Videos-Hardcore Boys forum that contained a link to an external site and multiple preview images. One of these images appeared to contain CP depicting two naked prepubescent or early pubescent males lying on a bed. The fmger of one of the males appeared to be penetrating the anus of the second male. Although the original date of this post was unknown, it remained available as of the date the site was accessed. The user '. replied to a topic entitled "" within the Images-Hardcore Naked + Boys forum that contained numerous images which appeared to depict CP of prepubescent males. One of these images depicting a naked prepubescent male standing with his penis exposed and penetrating the mouth of a second prepubescent male. 49. After successfully registering with a usemame and password, and logging into the site, no member lists, or additional forums or topics were observed. However, a private message feature was available, which allows users to send each other private messages (referred to as personal messages). A review of the site revealed several posts in which users requested to be contacted via private messages. An example of this is as follows: 27 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 28 of 99 In August of2012, two users made multiple posts to each other stating they had sent "PM's" to each other. Based on my training and experience, I believe that PM refers to "private messages." Website 5 50. On June 26,2013, an FBI Special Agent operating in the District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden seIVice at the URL oni04 (hereinafter referred to as "Website 5"). Website 5 appeared to be a message board website whose primary purpose is the advertisement and distribution of child pornography videos of minor boys. The name of Website 5 contained the word "boy" and a reference to video. According to statistics posted on the site, it contained a total of I 1,007 posts, 1,206 total topics, and 2,005 total members. 51. The initial web page of Website 5 contained the name of the site and the phrase "Where The [sic] Boys Are." A search field was located next to the title on the right side of the web page. Located below the title and search field on the right side of the web page were three hyperlinks entitled "FAQ," "Register" and "Login." 52. Located below the aforementioned items were four sections that contained various forums, along with the corresponding number of topics and posts, as follows: Forum INFORMATION Announcements Chat Stories Tutorials Links IMAGES NonNude Softcore Topics Posts 7 203 5 32 27 8 1582 28 180 13I 58 85 649 858 28 \..>C.- 1!t/{1 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 29 of 99 Hardcore Male Jail-Bait Boy-Girl Toddlers Fetish 3D, CGL, & Fakes Requests VIDEO NonNude Softcore Hardcore Male Jail-Bait Boy-Girl Fetish Webcams Requests RECENT TOPICS 64 998 56 711 II 59 16 6 14 101 32 174 717 20 205 280 2031 411 19 113 22 9 5 40 220 78 71 33 924 920 Replies 232 AnonCapper Webcam MegaPost 8 Speed up TOR downloads? I Poppers HI MY FRIENDS ..I BACK WITH MY REAL NAME 5 43 Older Tonik 53. Located at the bottom of the web page were two additional "LOGIN" and "STATISTICS". corresponding text, Usemame Views 57984 1021 832 1502 5695 sections entitled The "LOGIN" section revealed two data-entry fields with the and Password. The "STATISTICS" section revealed the board contained a total of 11,007 posts, 1,206 total topics, and 2005 total members. various topics within the "INFORMATION" A review of the section revealed, among other things, instructions for how to post, along with discussions in regards to software programs, other sites, technological questions, issues with the site, and links to other sites. Many of the posts contained text indicative of an interest in child pornography (CP). An example of this is as follows: On June 1,2013, the user'~ posted a topic entitled "Best ever ~ Vote!" in the "Chat" forum. The post contained the text, "So what is the best vid ever? Cristian the Ilyo Colombian taking it up the ass with a hard on; Blowing a Tweve 29 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 30 of 99 year old (and the other similar video; or the Showerboys series? Any others that you can't stop watching?" 54. A review of the various topics within the "IMAGES" and "VIDEO" sections revealed the forums within these sections contained numerous pages of topics. Each topic contained a title, the author, the number of replies, the number of views, and the last post. The last post section included the date and time of the post as well as the author. Upon accessing a topic, the original post appeared at the top of the page, with any corresponding replies to the original post included the post thread below it. Typical posts appeared to contain text, images, thumbnail previews of images, compressed files (such as ".rar" files), links to external sites, or replies to previous posts. 55. A review of topics within these sections revealed numerous posts containing images depicting CP and child erotica of prepubescent males, females, toddlers, and infants; including those depicting anal, vaginal, or oral penetration, Examples of these are as follows: On June 21, 2013, the user ". 'posted a topic entitled "ill MY FRIENDS ..! BACK WITH MY REAL NAME" in the IMAGES - Toddlers forum that contained numerous images depicting CP of a male toddler. One of these depicted a male toddler who is naked from the waist down with his legs spread apart, exposing his genitalia. What appears to be an adult male's penis is visible in the image positioned in between the toddler's legs. On June 7, 2013, the user "_' posted a topic entitled "_' in the Video Hardcore forum that contained multiple images 'that appeared to be still-shots of a video. These images depicted CP of an early pubescent male and a prepubescent male. One of the images depicts the penis of the early pubescent's penis penetrating the mouth of the prepubescent male. On June 8, 2013, the user "_' posted a topic entitled "Boys wearing cum" in the Images - Hardcore forum that that contained multiple images depicting CP of early pubescent and prepubescent males. One of these images depicted a naked early pubescent or prepubescent male lying on his back with his legs spread apart, exposing his genitalia and anus, 30 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 31 of 99 56. After successfully registering for an account with a username and password, and logging into the site, no member lists or additional forums or topics were observed. However, a private message feature was available after registering, allowing users to send private messages to each other. Multiple posts were observed in which members discussed the private message capability on the site. Website 6 57. On July I, 2013, an FBI Special Agent operating in the District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden service at the URL onion (hereinafter referred to as "Website 6"). Website 6 appeared to be a video sharing website whose primary purpose was the advertisement and distribution of webcam videos of minors engaging in sexually explicit conduct. 58. On the main page of Website 6 were links to other child pornography-related websites, including the sites referred to in this affidavit as Websites 2, 16, and 22, as well as another Tor network child pornography website that archives child pornography videos for download. Another link on the main page of Website 6 pertains to a "wiki" website that is dedicated to pedophilia and the sexual exploitation of children and which contains links to dozens of child pornography websites on the Tor network. 59. Also located on the main web page was a login section that contained two data- entry fields and the corresponding text "Username" and "Password," various text and a section entitled "Random Video Roll. Click on a cam below for a more detailed preview above." Included in this section was what appeared to be a preview image for a video, a description of the 31 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 32 of 99 video, the title, the user who posted it, the number of views, the date it was posted, and tags used to search for the video. 60. Located directly below this section was another section entitled "25 Latest Videos," which contained what appeared to be preview images for videos. All of the preview images appeared to contain CP, child erotica, or clothed images of early pubescent or prepubescent males. Placing the mouse pointer over these videos resulted in that particular video being included in the "Random Video Roll" section, described above. 61. A hyperlink entitled "CLICK HERE TO VIEW ALL VIDEOS" was also included in this section. A total of 675 videos were listed as being available. Accessing this hyperlink revealed a web page with numerous preview images for videos, along with descriptions of the videos, the titles, the users who posted them, the number of views, the date they were posted, and tags used to search for the videos. At the bottom of the page were hyperlinks to 28 additional pages that appeared to contain similar content. 62. Located above the videos was a search feature, which allowed users to search for videos by title, description, keywords, or the usemame that uploaded them. According to this section, approximately 26 users had uploaded videos to the site. Nine of these users uploaded at least 15 videos. 63. A review of uploaded videos to this site revealed numerous preview images which appeared to contain CP and child erotica depicting early pubescent or prepubescent males, as well as text indicative of an interest in CPo Examples of these are as follows: On June 26, 2013, the user ,,_, posted a video entitled "_' along with two preview imag~these preview images contained 12 stillshots of what appeared to be the video. These images contained CP and child 32 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 33 of 99 erotica depicting three early pubescent or prepubescent males. One of these depicted one of the naked males bent over with his buttocks facing the camera and his hands placed on either side, exposing his anus and genitalia 'f' On April 17,2013, the user posted a video entitled' " along with three preview images. One of these preview images contained 16 still-shots of what appeared to be the video. These images contained CP and child erotica depicting an early pubescent male, including one in which the naked male is sitting on the floor with his legs spread apart, exposing his penis, which he is holding with his left hand. 64. After successfully registering for an account with a usemame, password, and optional e-mail address (which was not required to be legitimate), and logging into the site as a "Regular" member, no additional information or content was observed. However, upon registering for an account, a user may select the "Uploader" option, which required approval from a site moderator. According to this section, users must describe the content they want to upload and provide samples or contact information prior to being approved. 65. Also accessible on the main page was a link to a web page that appeared to be a previous version of Website 6. Numerous images that appeared to be preview still-shot images of videos containing CP or child erotica were observed on that page. 66. A private message feature was also available on Website 6, which allowed users to send private messages to each other. A review of the Message Inbox of the user profile section revealed the following text: "Notice! Be sure never to give out any personal or identifying information on any onion or Tor site! Ever!" Accessing the ''NEW PM' hyperlink in this area revealed a web page with a data-entry field and a drop-down box that appeared to include all registered members to the site. Only one member's usemame could be selected per private message. 33 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 34 of 99 Website 7 67. Between June 26 and June 28, 2013, an FBI Special Agent operating in the District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden service at URL .onion/users! (hereinafter referred to as "Website 7"). The site appeared to be a message board whose primary purpose was the advertisement and distribution of child pornography. According to statistics posted on the site, it contained 2,284 total posts, 472 total topics, 856 total images, and 345 total members. 68. On the main page of the site located below the title was the current date and time, a section entitled "Information" that contained one forum, and two other sections that appeared to contain information on users and statistics. The majority of the site appeared to have been written in the Danish language. The one available forum, Nyt fra [Website 7], contained 12 topics and 32 posts. The majority of these posts were in Danish. However, one post was entitled "To all English users" and it contained the following text: This forum is not for English speaking users. If you write in English your user and all your posts will deleted on sight. So if you're Swedish, Norwegian, or Danish, please write in your native language, we will understand. And don't try to use google translate [sic]. It does a poor job and we can tell. The Admin tearn. 69. .The above post was made by a user who was listed as an Administrator with an avatar - i.e., a user-selected image that is associated with a usemarne - depicting a prepubescent female holding what appears to be an adult male's penis. 70. After successfully registering with a usemarne, password, and e-mail account, and logging into the site, an additional 11 forums appeared on the board index page. These forums (the majority were in Danish), with corresponding topics and posts, were as follows: 34 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 35 of 99 Forum Topics Feedback og teknisk hjaelp 15 Piger 200 Drenge 16 Sider/Links 16 Historier 34 Sikkerhed 9 Dode Posts 4 66 Generel Diskussion Praesenter dig selv 45 At Vaere Paedofil 3 4 Offtopic 71. Google Translate is an internet-based Posts 43 1136 89 52 85 43 22 408 152 31 16 program that allows a user to obtain an instant translation of terms from one language to another. are not submitted as an authoritative offoreign References to Google Translate below translation, but merely as an approximation language terms on Website 7. An internet-based of the meaning translation using Google Translate shows those topics translate as follows: Forum Feedback and technical means Girls Boys Pages / Links Stories Safety Dead Posts General Discussion Introduce yourself Being a pedophile Offtopic 72. A review of the various topics within the "Piger and Drenge" (which Google Translate translates to "girls and boys") forums revealed they each contained four sub-forums, entitled "Non nude," "Softcore," "Hardcore" using Google Translate of Foresporgsler and "Foresporgsler." is "queries." 35 An internet-based translation Each topic within these forums and sub- Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 36 of 99 forums contained a title, the author, the number of replies, the number of views, and the last post. The last post section included the date and time of the post as well as the author. 73. Upon accessing a topic, the original post appeared at the top of the page, with any corresponding replies to the original post included in the post thread below it. Typical posts appeared to contain text, images, thumbnail previews of images or videos, compressed files (such as " .rar" files), links to external sites, or replies to previous posts. 74. A review of topics within the "Piger and Drenge" forums and sub-forums revealed numerous posts containing images depicting child pornography (CP) and child erotica of early pubescent females, prepubescent females, prepubescent males, toddlers, and infants. These images included those depicting anal, vaginal, or oral penetration. Examples of these are as follows: On February 3, 2013, the user .~' posted a topic entitled "Knubbiga flickor" to Piger-Hardcore that contained numerous images depicting CP of prepubescent females. One of these images depicted a naked prepubescent female lying on her back with her legs spread apart, exposing her vagina and anus. What appeared to be the torso of a naked adult male was positioned in between her legs and his penis was penetrating her anus. On January 27, 2012, the user ._' posted a topic entitled "Liten gut! blir pult" to Drenge-Hardcore that contained numerous images depicting CP of a male toddler or infant. One of these depicted the naked toddler or infant lying on his back with his legs spread apart, exposing his penis and anus. What appeared to be an adult male's penis was penetrating his anus. 75. A review of the remaining forums revealed they appeared to contain discussions, stories, instructions for posting, and requests. Several terms that appeared to indicate an interest in CP were observed in many of these forums. 76. A list of members, which was accessible after registering for an account, revealed 36 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 37 of 99 that approximately 147 users made at least two posts to one or more of the forums. Approximately 28 of these users made at least 15 posts. Approximately 17 users were ranked as "Contributor." The site identified by usemame an administrator and a second user identified as a site founder. 77. A private message feature also appeared to be available on the site, which allowed users to send each other private messages. A review of the member list revealed what appeared to be a private message button located next to the rankings. The private message feature appeared on the site as "Private beskeder." Google Translate translates "beskeder" to "messages" or "posts." An attempt to search for this term revealed at least one reference to it made in.a post on June 20,2012, in which a user appeared to request a private message be sent. Website 8 78. On July 1,2013, an FBI Special Agent operating in the District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden service at URL .onion (hereinafter referred to as "Website 8"). Website 8 appeared to be a Hungarian-language message board whose primary purpose was the advertisement and distribution of child pornography. A review of the statistics section revealed the board contained a total of 898 posts, 200 topics and 766 users. 79. On the main page' of the site located to the right of the title was the current date and time, along two data-entry fields that appeared to be login fields and various text. Below the title seven tabs and what also appeared to be two data-entry fields associated with logins. However, all of the text on the site appeared to be Hungarian. 80. A review of the last of the aforementioned seven tabs revealed what appeared to 37 'llo Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 38 of 99 be a registration page. After successfully registering with a usemamc, password, and e-mail account; and then logging into the site, the following forums (and what appeared to be corresponding topics and posts) were observed: Fontos inforrmici6k Frissitesek, fejlesztesek Olvasd ell!!! Diskurzus Diskurzus T6rtenetek Lanyok - Kepek Maszti Duci Onil Amil Kcmenypom6 Orvosi Pisi Soft Fetisek Keresek Non Nude Lanyok - Vide6k Maszti Duci Oml Amil Kemenypom6 Orvosi Pisi Fetisek Keresek Non Nude FiUk - Kepek Maszti Oral Kemeny porn6 Orvosi Pisi Soft Fetisek 93 Uzenet 14 ilzenet 17 tema 8 tema 290 ilzcnet 14 ilzenet 30 tema 5 tema 22 ilzenet 1 ilzcnet 8 ilzenct 16 ilzcnet 66 ilzcnet ilzenet 6 ilzenet 112 ilzenet 12 ilzenet 54 Uzenet 6 Uzenet 3 tema I tema 3 tema 4 tema 14 tema tema I tema 50 teIria 4 tema 8 tema 2 tema 45 ilzenet 1 ilzenet 4 ilzenet 2 ilzenet 15 ilzenet 12 ilzenet 6 ilzenet 5 ilzenet 32 ilzenet 3 ilzenet 14 tema 1 tema 2 tema 2 tema 3 tema 2 tema I tema I tema 6 tema 1 tema o ilzenet o tema 4 ilzenet 9 tizenet ilzenet ilzenet 3 ilzenet ilzenet 2 tema 1 tema tema tema 1 tema tema o o o o 38 o o o o Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 39 of 99 Keresek Non Nude FiUk - Vide6k Maszti Oral Kemenyporn6 Orvosi Pisi Soft Fetisek Keresek Non Nude 81. "Google Translate" o iizenet o iiZenet o tema o tema 9 iiZenet iiZenet iiZenet iiZenet ilzenet i1zenet ilzenet 7 ilzenet ilzenet 4 tema tema tema tema tema tema tema I tema tema o o o o o o o o o o o o o o is an internet-based program that allows a user to obtain an instant translation of terms from one language to another. are not submitted as an authoritative offoreign References to Google Translate below translation, but merely as an approximation language terms on Website 8. An internet-based translation using Google Translate shows that ilzenet translates to "message" or "post" "tern a" to ''thread,'' categories above translate as follows: lmportantrrrrormation Upgrades and improvements Read it! Discourse Discourse Stories Girls - Pictures Masturbation Fat Blowjob Anal Hardcore Medical Peeing Soft Fetishes Requests Non Nude 39 of the meaning and the rest of the Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 40 of 99 Girls - Video Masturbation Fat Blo\\job Ass Hardcore medical Peeing Fetishes theme Post subject Requests Non Nude Boys - Pictures Masturbation Blo\\job Hardcore Medical Peeing Soft Fetishes Requests Non Nude Boys - Video Masturbation Oral Hardcore Medical Peeing Soft Fetishes Requests Non Nude 82. Located directly above the aforementioned forums appeared to be a chat window or log that displayed recent messages posted by users. A data-entry field was included in this section for posting messages. It appeared messages posted in this section were visible to all registered users. 83. A review of the first four forums revealed the majority of the topics and posts 40 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 41 of 99 appeared to be mostly text in the Hungarian language. Each topic contained a title, the author, the number of replies, the number of views, and the last post. The last post section included the date and time of the post as well as the author. 84. Upon accessing a topic, the original post appeared at the top of the page, with any corresponding replies to the original post included the post thread below it. Typical posts appeared to contain text, images, thumbnail previews of images, compressed files (such as ".rar" files), links to external sites, or replies to previous posts. 85. A review of topics within the remaining forums revealed a similar structure. However, numerous posts in these forums appeared to contain child pornography erotica depicting prepubescent (CP) and child females, males, toddlers, and infants; including those depicting anal, vaginal, or oral penetration. Examples of these are as follows: On January 1,2013, the user '_ posted a topic entitled "vegyes" in the forum "FiUk-Kepek - Kemeny porno" forum that contained numerous images depicting CP of toddlers and infants. One of these depicted an infant who was naked from the waist down and lying on his back with his legs raised in the air, exposing his penis and anus. On January 12,2013, the user '_' posted a topic entitled "Re: 1-2 eves kisllinyok" in the forum "L\nyok-Kepek - Keresek" forum that contained multiple images depicting CP of infants. One of these depicted an infant who appeared to be naked and lying on his back with his legs raised in the air, exposing his penis and anus. A green and yellow object with the appearance of a syringe was penetrating the infant's anus. 86. A list of members, which was accessible after registering for an account, revealed that approximately 47 users made at least one post to one or more of the forums. 14 of these users made at least 10 posts. Two administrators usemame. were identified on the site by Four users were identified as "VIP" members of the site. 41 Approximately Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 42 of 99 87. A private message feature also appeared to be available on the site, after registering, that allowed users to send each other private messages. Website 9 88. On July 1,2013, an FBI Special Agent operating in the District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden service at the URL onion (hereinafter referred to as "Website 9"). Website 9 appeared to be a bulletin board whose primary purpose is the advertisement and distribution of child pornography. Statistics posted on the site revealed the board contained a total of 6, 152 posts, 1,274 total topics, and 25,831 total members. 89. The initial web page of the site contained the name of the site and advertised videos available for purchase and preview. Located on either side of the site name was an image that appeared to depict a naked prepubescent female with her legs spread apart, exposing her vagina. Located below the title were four hyperlinks entitled "BOARD INDEX," "FAQ," "REGISTER," and "LOGIN"; along with a search feature that allowed users to search for text. Located below the aforementioned items was a section entitled "INDEX PAGE," which contained one forum entitled "Rules." On the right side of this section were three additional sections entitled "MAIN MENU," "USER MENU" and "LOGIN FORM." Located below the forum were two additional sections entitled "WHO IS ONLINE" and "STATISTICS." 90. A review of the "Rules" forum revealed it contained two posts entitled "Access to the site" and "Welcome," both of which were posted by the site Administrator. These posts contained a welcome message and contact information for the administrator including a tormail email account containing the name of the site. 42 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 43 of 99 9 I. Registration to the site required a user to enter a username, password, and e-mail account. After successfully registering and logging into the site, a section entitled "CP" appeared that included the following forums, along with the corresponding number of topics and posts in each: Forum FREE - Rules - Dialogue and discussion - Video - Photos PRIVAT - New materials 92. Topics Posts 1 146 606 471 1 832 2792 2349 50 177 A review of the various topics within the above forums revealed each topic contained a title, the author, the number of replies, the number of views, and the last post. The last post section included the date and time of the post as well as the author. Upon accessing a topic, the original post appeared at the top of the page, with any corresponding replies to the original post included the post thread below it. Typical posts appeared to contain text, images, thumbnail previews of images, compressed files (such as ".rar" files), links to external sites, or replies to previous posts. 93. A review of the various topics within the "Rules" and "Dialogue and discussion" forums revealed that the majority contained general information in regards to the site, instructions for how to post, welcome messages between users, and discussions indicative of an interest in child pornography (CP). Three additional sub-forums were also observed in the "Dialogue and discussion" forum that appeared to contain similar material. 94. A review of topics within the "Photos" and "Videos" revealed the majority 43 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 44 of 99 appeared to contain CP and child erotica depicting prepubescent males and females, or text indicative of an interest in CP. Examples of these are as follows: On June 16,2013, a user posted a topic entitled "For VIP - Asian Mom, son and Dad" in the forum "Video" that contained a link to download a compressed ".7z" file and a preview image. A review of the preview image revealed it contained 16 still-shot images of a video file. The majority of these images depicted two naked adults with a naked prepubescent male. One of the images depicted the prepubescent male sitting next to the adults with his legs spread apart, exposing his genitalia. The left hand of one of the adults appears to be holding the prepubescent male's penis. On April 25, 2013, a user posted a topic entitled "2" in the forum "Video" that contaizied links to download files and multiple preview images. A review of one of the preview images revealed it contained 18 still-shot images of a video file. The majority of these images appeared to contain CP depicting a naked female toddler. One of these images depicted the female toddler sitting with her legs spread apart, exposing her vagina. What appears to be a black marker is penetrating her vagina. 95. A list of members, which was accessible after registering for an account, revealed that approximately 117 users made at least 10 posts to one or more of the forums. Approximately 24 of these users made at least 30 posts. Two users were listed as the Administrators. 96. An attempt to access the ''New materials" forum revealed the following text: "You do not have the required permissions to read topics with this forum." A VIP area of the site appeared to be available to some but not all members of the site, which law enforcement was not able to access at the time of the review of the site. 97. A private message feature was also available on the site, after registering, that allowed users to send each other private messages, referred to as "personal messages." A review of one administrator's user profile revealed a contact section that contained a hyperlink entitled 44 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 45 of 99 "Send private message." Numerous private message requests between users were observed on the site. An example of this is as follows: On September 12, 2012, one of the administrators replied to the topic entitled "Pic for PRIVATE", that contained the text (among other text): "send your own video or other own on-topic material in a private message to (username of other administrator] to become VIP." Based on my training and experience, I believe that the phrase "on-topic material" refers to child pornography. Website 10 98. Between June 25 and June 27, 2013, an FBI Special Agent operating in the District ofMaryJand connected to the Internet via the Tor Browser and accessed the Tor hidden service at the URL onion (hereinafter referred to as "Website 10"). Website I0 appeared to be a message board whose primary purpose was the advertisement and distribution of child pornography and the discussion of matters pertinent to incest and pedophilia. The name of the site contains a reference to incest. The initial site web page contained the name of the site and an image depicting an adult male and female with a prepubescent female. The title in the image included the text, "Explaining sex to your little girl." According to statistics posted on the site, it contained 29,330 total posts, 3,800 topics and 10,397 members. 99. Below the image on the main page of Website 10 was a hyperlink to the site's discussion board as well as a "Links" section and "Contact" section. Among other things, the "Links" section contained a link to the site referred to as Website 14 in this affidavit, a Tor network hidden service dedicated to promoting pedophilia and allowing users with a sexual interest in children to network and communicate, and a link to "(Pedo) Torchat Directory." 45 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 46 of 99 Torchat is an online chat program available through the Tor network. 100. Accessing the hyperlink to the site's discussion board revealed a message board web page with the name of the site and the same image as described on the initial web page. The following forums and sub-forums were observed, along with the corresponding number of topics and posts in each: Forum Site Info & News -Welcome & Some -Site News -Do You Have a Question, Problem or Suggestion? Staying Out of Trouble ~Software That Can Keep You Safe -Safety Questions & Advice -Safe Habits & Practices -Legal Corner Family Fun -FF Talk & Advice -FF Pics -FF Vids -FF Stories Forbidden Fruit -Pies -Vids -Stories & Other -Requests Member's Rooms -Comments -DjarumTs Room The Backyard -News -Travel -Around the Picnic Table 101. Topics Posts 17 74 17 336 51 80 27 4 270 366 189 26 204 172 4 41 1544 2723 23 232 1074 79 87 390 9798 718 429 1778 16 2 133 250 60 29 197 436 206 1324 A review of the various topics within the Site Info & News forums revealed, among other things, that a valid e-mail address was not required to register an account. However, a user would gain access to additional forums and topics by registering an account. 46 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 47 of 99 102. A review of the various topics within the other forums revealed, among other things, numerous image and/or video files that appeared to contain child pornography (CP) or child erotica. The "Forbidden Fruit, Pics Forum" contained 13 pages of topics. Each topic contained a title, the author, the number of replies, the number of views, and the last post. The last post section included the date and time of the post as well as the author. Upon accessing a topic, the original post appeared at the top of the page, with any corresponding replies to the original post included the post thread below it. Typical posts appeared to contain text, images, ihumbnail previews of images, compressed files (such as ".rar" files), links to external sites, or" replies to previous posts. I 03. The Pics forum also contained 10 additional sub-forums, some of which were titled "Boy Only Pics," "Girl Only Pics," "Bondage," "Preschool," and "Preteen." These forums all contained over 700 topics and over 5,000 posts. Further, each of these forums contained descriptions below the title; examples of which are as follows: Boys Only Pics: Post pics of just boys here. HC, SC, nude, whatever is OK. Preschool: This area is for pics of ages 0-5. Preteen: This area is for pics of ages 6-I2. 104. A review of topics within the aforementioned forums and sub.forums revealed numerous posts containing images depicting child pornography (CP), bestiality, bondage, and child erotica of prepubescent females, males, and toddlers; including those depicting anal, vaginal, or oral penetration. 105. The "Other Family Fun "andForbidden Fruit Forums" contained similar topics, posts, threads, and files as were observed in the aforementioned Forbidden Fruit, Pics Forum. Further, numerous images that appeared to contain CP, child erotica, or text indicative of child 47 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 48 of 99 erotica were observed in these forums. The majority of the image and video files appeared to be contained in posts within the Pies, Vids, and Requests forums. 106. Upon registering for an account, the following additional forums and sub-forums appeared on the main web page: Forum Topics Member's Rooms -Vampiric's Room 11 -DirtyOldMan's Rooms 17 -heffher's Room 12 -PTCollector's Room 6 -Pheenom's Room 13 -Annonymou5's Room 12 -Vlad_ Impaler's Room 7 -shatterhand's Room 4 Looking 4 Hook Ups? -Torchat requests 34 -couples-groups-families 4 same 2 -couples-groups-families 4 singles I -singles 4 couples-groups-families 47 -mature 4 young 14 -young 4 mature 21 -$cash$ 4 some company 6 -everything else 18 107. Posts 39 129 30 31 42 39 109 29 94 2 I 83 45 65 17 58 A review of topics within these forums revealed they appeared to contain CP, child erotica, or text indicative ofan interest in CPo 108. A list of members was also accessible after registering for an account. A review of this list revealed that approximately 239 users made at least 15 posts to one or more of the forums. Approximately 42 of these users made at least 100 posts. A site administrator, site monitor, and two site moderators were identified on the site by usemame. 109. A private message feature was also available on the site that allowed users to send each other private messages. A review of the site revealed several posts in which users requested 48 \.;>c. ~I{'J Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 49 of 99 to be contacted via private messages. An example of this is as follows: On August 18, 2012, in response to a CP image depicting an infant, a user posted, among other things, :'...please post more or message me for private trade." Website 11 110. On June 26, 2013, an FBI Special Agent operating in the District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden service at URL onio~ (hereinafter referred to as "Website II "). Website II appeared to be a bulletin board whose primary purpose was the advertisement and distribution of child pornography. Statistics posted on the site revealed the board contained a total of 1,754 posts, 281 total topics, and 2,165 total members. Ill. The initial web page ofthe site contained the name of the site and three hyperlinks entitled "FAQ," "Register" and "Login." Located below the aforementioned items were three sections that contained various forums, along with the corresponding number of topics and posts, as follows: Forum GENERAL THE RULES-Read me Discussion Feedback MEDIA Females Males Co-Ed FETISH Girls peeing Girls medical 112. Topics Posts 62 12 231 36 142 19 28 1099 54 203 15 3 100 30 A review of the various topics within the "GENERAL" section revealed, among other things, instructions for how to post, along with discussions in regards to software programs, 49 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 50 of 99 other sites, and issues with the site. Many of the posts contained text indicative of an interest in child pornography (CP). An example of this is as follows: On April IS, 2013, the user '_ posted a topic entitled "Child prostitution" in the "Discussions" forum. The post contained the text (among other text), "Anyone know where I can find child prostitutes?" 113. A review of the various topics within the "MEDIA" and "FETISH" sections revealed the forums within these sections contained numerous pages of topics. Each topic contained a title, the author, the number of replies, the number of views, and the last post. The last post section included the date and time of the post as well as the author. Upon accessing a topic, the original post appeared at the top of the page, with any corresponding replies to the original post included the post thread below it. Typical posts appeared to contain text, images, thumbnail previews of images, compressed files (such as ".rar" files), links to external sites, or replies to previous posts. 114. A review of topics within these sections revealed numerous posts containing images depicting CP and child erotica of prepubescent males, females, toddlers, and infants; including those depicting anal, vaginal, or oral penetration. Examples of these are as follows: On January 29,2012, the user ".' posted a topic entitled "babyfeet," which contained numerous images depicting CP of an infant. One of these depicted an adult male holding an infant's leg in the air and his penis is pressed against the bottom of the infant's foot. On April 16,2012, the user '_' posted a topic entitled "Random Co-ed" in the MEDIA - Co-Ed forum that contained multiple images depicting CP of a prepubescent female. One of these depicted the prepubescent female, who appeared to be naked from the waist down, lying on her back with her legs spread apart and one raised in the air, exposing her vagina. An adult male is positioned in between her legs and his penis is penetrating her vagina On March 17,2013, the user "_' posted a topic entitled "Some more pee" in 50 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 51 of 99 the Fetish - Girls peeing forum that contained multiple images depicting CP of a prepubescent female. One of these images depicted a naked prepubescent female lying on her back with her legs spread apart and raised in the air, exposing her vagina and anus. A clear liquid substance with the appearance and consistency of urine is visible in the image. 115. After successfully registering for an account with a username and password, and logging into the site, no additional forums or topics were observed. However, a list of members was accessible and a review of this list revealed that approximately 23 users made at least five posts to one or more of the forums. Approximately eight of these users made at least 15 posts. 116. The site appeared to have a private messaging feature; however, when this feature was accessed, the following message was displayed: We are sorry, but you are not authorized to use this feature. You many have just registered here and may need to participate more to be able to use this feature. No further information in regards to private messages was observed. Website 12 117. Between June 25 and June 27, 2013, an FBI Special Agent operating in the District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden service at URL onion (hereinafter referred to as "Website 12"). Website 12 appeared to be a video sharing website whose primary purpose was the advertisement and distribution of webcam videos of minors engaging in sexually explicit conduct. According to statistics posted on the site, as of June 27,2013, the site had 1,869 members, 12,689 posts and 2,825 threads. Access to child pornography posted on Website 12 was available only to users who posted child pornography to the satisfaction of the site administrator. 118. The initial web page contained name of the site and an image depicting what 51 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 52 of 99 appeared to be the face of an early pubescent or prepubescent female. Located below the title was the current date and time, along with three hyperlinks entitled "Search," "Help." "Member List" and The text "Hello There, Guest!" and the hyperlinks "Login" and "Register" were also located under the title. The "Member List" and "Search" links were not accessible. 119. Located below the aforementioned and "Information." corresponding Each of these sections contained a single forum, along with the topics and posts: Forum Topics Your first Post 0 Rilles and help 4 120. 21,2011, links were two sections entitled "New Users" Posts I 4 A review of the "Your First Post" forum revealed one post that was made on May which, among other things, this post contained the following text: You get access after your first post! - This is a board for Cams (webcam caps, youtube vids, etc) only. Don't try to get access with other stuff! - This is an english speaking board. - Your first post must be an underage girllboy (13 or younger) and must contain nudity. - Your first file(s) must be at least 20mb in size. - You need to use RAR or 7z archives with passwords. Don't forget to encrypt filenames. - Your password must contain your usemame and the name of the board ([Website 12]). - Please create for every girl a seperate thread. - Use hosters you don't need JavaScript (like http://tishare.comf). - Use imagehosters you don't need JavaScript (like http://fastpic.ruI). - Use a good title for a new thread. 121. A review of the "Rules" forum revealed it contained four topics and four posts. All four posts were made by one user who was listed as an Administrator depicting a partially naked prepubescent with an avatar female. The first post, entitled "How to get access to 52 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 53 of 99 the trusted and VIP arca?" was made on April 19, 2013, and contained the following text: How to get access to the trusted and VIP area? -I still have to work on the board and the next weeks there could be still some changes! Trusted Member For non-cappers/YouTubers - You must have been active for one year. After one year, please send me (Indica) aPM. - You should not post bullshit only. - Your warning level should be not too high. For capperslY ouTubers - Sometimes you will be invited. 1don't have more information at this time. Sorry. - You should mark your posts with your own caps and YouTube videos. - Your warning level should be not too high. V.J.P. Member For non-capperslY ouTubers - You are not able to join the V.J.P. usergroup. For capperslY ouTubers - You will be invited by the V.J.P. Members. 122. Based on my training and experience, 1believe that "capping" is a term that refers to capturing and recording live streaming video. "Cappers" are persons who engage in such behavior. Capturing and recording live streaming video of minors engaging in sexually explicit conduct is a common way that offenders produce child pornography for consumption and distribution. 123. A review of the remaining three posts revealed they contained instructions for how to post, what to do if access to certain areas is tenninated, and which file-hosting sites or programs to use. 124. A private message feature also appeared to be available for members, as it was referenced in two of the posts made by the administrator, one of which was described above. The second post referring to a "PM" was in the post entitled "List with some 53 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 54 of 99 filehosters/imagehosters/tools to create previews." At the end of this post, the administrator posted the following text: "Send me a PM if you have more information for this help. Thanks!" 125. After successfully registering to the site with a username and password and then logging into the site, no further information was available or accessible. The law enforcement officer was not able to view the section so the site accessible to users after their first post, or the VIP areas, due to the requirement of the posting of child pornography. Website 13 126. Between June 25 and June 27, 2013, an FBI Special Agent operating in the District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden service at URL onion (hereinafter referred to as "Website 13"). A review of the initial site web page revealed that it contained the title of the site and image depicting what appeared to be partially naked early pubescent female. The following text was located below the title: "Join our movement! We are building the new world paradise! Make friends on the first social network dedicated to u 18 erotica. . .. Share your knowledge on u18 erotica with others on our WIKl. Discuss with others on our Forum." Based on my training and experience, I believe that the term "u 18" refers to children under the age ofl8. 127. Three hyperlinks for a social network, wiki and forum directed users to other sections of the web page. The WIKl hyperlink directed users to a web page that contained a description of the site and appeared to only contain text. The Forum and social network hyperlinks directed users to a message board web page that contained the same title as the Website 13. Statistics posted on Website 13 revealed that the site contained 11,174 posts, 5,876 54 \?c.. ~1(1 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 55 of 99 topics and 32,874 members. 128. Information." A review of the main forum web page revealed one forum entitled "Tourist This forum contained one topic entitled "About Us" and one post with the same title. This post was made by an administrator on September 13, 2009 and instructed users to register. 129. Registration e-mail account minimum to the message board required a user to enter a usemame, password, and maximum preferred ages, personality, preferred races, date the users began to like u 18 erotica, and favorite topics. After successfully registering and logging into the site, the following forums and sub-forums were observed, along with the corresponding number of topics and posts in each: Forum [Website 13] Erotica Education Religion Travel & Sightseeing, Cities & Nature Politics Health, Wellness, Fitness, Beauty 130. Topics 95 5608 72 Posts 381 10335 282 2 2 4 3 2 2 1 1 A review of the various topics within the "Erotica" forum revealed it contained 141 web pages of topics. Each topic contained a title, the author, the number of replies, the number of views, and the last post. The last post section included the date and time of the post as well as the author. Upon accessing a topic, the original post appeared at the top of the page, with any corresponding replies to the original post included the post thread below it. Typical posts appeared to contain text, images, thumbnail previews of images, compressed 55 files (such as ".rar" Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 56 of 99 files), links to external sites, or replies to previous posts. 131. A review of topics within the "Erotica" revealed numerous posts containing images depicting CP, bestiality, bondage, and child erotica of early pubescent females, prepubescent females, and toddlers; including those depicting anal, vaginal, or oral penetration. Examples of these are as follows: On February 19,2013, the user "_' posted a topic entitled "Re: 6Yo Giselita Special," which contained numerous images depicting CP of a prepubescent female. One of these depicted the prepubescent female lying on her back on a mattress and holding what appeared to be an adult male's penis in her left hand. On May 6, 2013, the user '.' posted a topic entitled "My first post", which contained three images depicting CP of prepubescent females. One of these depicted a naked prepubescent female sitting in a chair with her legs spread apart and bent at her knees, exposing her vagina and anus. 132. A review of the remaining six forums revealed numerous topics, posts, and threads that contained various instructions, links to external sites, requests for information, technical details, and text indicative of an interest in CPo 133. A list of members, which was accessible after registering for an account, revealed that approximately Approximately "VIP." 160 users made at least 15 posts to one or more of the forums. 37 of these users made at least 50 posts. Approximately One site administrator 17 users were ranked as was identified by username, who had made a total of 891 posts, 698 of which were to the "Erotica" forum. 134. A private message feature was also available on the site that allowed users to send each other private messages. A review of the site revealed several posts in which users requested to be contacted via private messages. Examples of this are as follows: 56 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 57 of 99 On July 10, 2010, the administrator posted, "If you are a producer oful8 erotica please contact the admin directly via private message. You can become a resident instantly and for lifetime." On December 29,2012, the administrator posted, "If anybody can provide information but does not want to post, please contact me via private message." Website 14 135. Between July I and July 2, 2013, an FBI Special Agent operating in the District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden service at the U~.onion (hereinafter referred to as "Website 14"). Website 14 appeared to be a bulletin board dedicated to the promotion and discussion of pedophilia and the sexual abuse of children. The site name contained a reference to pedophilia. Statistics posted on the site indicate it has 1,497 members, 67,992 posts and 4,340 topics. 136. The initial site web page revealed it was a message board web page that contained the title of the site and five hyperlinks entitled "HOME," "SEARCH," "CHAT," "LOGIN," and "REGISTER." Located below the aforementioned items were three sections that contained the following forums, along with the corresponding topics and posts: Forum Topics Posts THE COMMUNITY CENTRE - THE NOTICE BOARD 109 1412 - INTRODUCTIONS 1053 10339 - MYSTIQUE'S MONTHLY REVIEW II 586 - THE PSC COMMUNITY AWARDS I 10 DISCUSSION, PERSONAL EXPERIENCE, AND ADVICE - PEDO CHAT 766 13090 - PERSONAL SUPPORT 141 2690 - CHILD LOVE SUPPORT 181 3602 - PEDO LITERATURE 85 1792 - CONSERVATIVE PAEDOPHILIA 25 654 - OFF TOPIC 243 4350 SECURITY, GUIDES, AND INFORMATION 57 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 58 of 99 - PAEDOPHILIA SECURITY AND COMPUTER HELP - GUIDES 27 - LINKS 316 4234040 502 3795 Located at the bottom of the web page was an additional section that contained information on recent posts, users online, and forum statistics. That section listed the top sections of and threadslpostings on Website 14 as follows: TOP 10 BOARDS Pedo Chat Introductions Off Topic Paedophilia Security (abbr) Links Child Love Support Personal Support Pedo Literature The Notice Board Prostitution and Sex Tourism 13,108 10,345 4,352 4,052 3,810 3,608 2,701 1,800 1,415 769 TOP 10 TOPICS BY REPLIES Need help with 11 year old... Kira - an interesting .... What. board narne mean? What Pedo turn on? That... .. Paedophile Sweet lil Cathy (8yo) Pedos ...Prison Experiences Time to begin my journey ... Mystique's Monthly Review ... Garners? 334 280 213 198 192 175 155 151 144 142 TOP 10 TOPICS BY VIEWS CP Links v2.0 Hottest video you've seen. Need help with 11 year old... Pedos ....Prison Experiences Pedo Sites Pedo women thread. 8 Years Old Mexico 73,773 58,232 34,606 23,025 21,722 21,227 19,238 17,040 58 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 59 of 99 Kira - an interesting .... Cuba Pedo Paradise 137. 16,813 167,91 A review of the various forums revealed that each topic appeared to contain title, the author, the number of replies, the number of views, and the last post. The last post section included the date and time of the post as well as the author. Upon accessing a topic, the original post appeared at the top of the page, with any corresponding replies to the original post included the post thread below it. Typical posts appeared to contain text, links to external sites, or replies to previous posts. 138. A further review revealed that a large number of posts appeared to contain text indicative of an interest in child pornography (CP) and child erotica. Examples of these are as follows [spelling and grammar as in original]: On February 8, 20 I2, a user posted a topic entitled "PEDOS IN PRISON - YOUR JAILIPRISON EXPERIENCES" in the "Pedo Chat" forum. As identified above, this post had over 23,000 views and ISS replies. Among other text, this post contained the following text: "On the previous PSC, we had an entire thread dedicated to paedophiles that had been caught in the past and that had served hard time for their actions. They talked about what it was like for them, the prison structure, how they were treated, what they lost, how they rebuilt their lives after serving their time and much more. I would like to rebuild this thread, so if you have been to jailor prison for CP related matters, please post detailed accounts of your experiences if you feel that you can share them." On May 10,2012, a user posted a topic entitled "NEED HELP WITH I I YEAR OLD GIRL WHO SEEMS INTERESTED BUT CAUTIOUS" in the "Child Love Support" forum. This post contained described the user's desire to "get a littler more out of our relationship, just some touching or licking" from his friend's 11 year old daughter. The post sought advice on how to "test the waters." As identified above, this post had over 34,000 views and 334 replies. On May 28, 2013, a user posted a topic entitled "HELP WITH 3YO COUSIN" in the "Child Love Support" forum. This post contained the following partial text, 59 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 60 of 99 among others: "So I'm starting on my child love with a young cousin, who is 3." This post had approximately 465 views and numerous replies. On June 17,2013, a user posted a topic entitled "[TRUE] MY GIRLS AND LIT JUST STARTED LAST NIGHT" in the "Pedo Literature" forum. This post had approximately 3,159 views and five pages of replies. Among other things, this post contained the following text: "Like I said I've been happily married for 9 years now. We have 2 beautiful daughters ages 8 and 6. My oldest is developing a bit faster than I thought she would. In the last few months she's changed from a chubby little girl to starting to lose baby fat and developing little bumps on her chest. I've looked at little girls my entire life and had never acted on any even if! have had the opportunity. Now that my daughter (we'll call her Ashley) is showing signs of starting to mature, I've had the urge to feel and touch. I hadn't given in to it until last night." On May 31, 2013, a user posted the topic "USE DRUG ADDICT STREETWALKERS TO FIND WILLING LITTLE GIRLS?" in the "Prostitution and Sex Tourism" sub-forum of the "Guides" forum. This post had approximately 536 views and numerous replies. Among other things, this post contained the following text: "When chatting on Torchat I got a tip from a fellow pedo that he uses to search for drug addict streetwalkers or mothers in the citys to get into contact with little girls. Has anybody experience with this or any tipps?" On March 17,2013, a user posted the topic "WHY, WHY, WHY, DO I GET TURNED ON BY HURTCORE?" in the "Personal Support" forum. This post had approximately 1,117 views and numerous replies. Among other things, this post contained the following text: "I totally support having a loving and consensual relationship with a child. It's the reason I am a member of these forums. Most of the time, I fantasize about happy and giggling little girls. Actually, I fantasize about having a loving wife who likes to join in pleasuring a little girl with me. I don't have any moral objections to things like this. However, I was feeling a bit frisky on OPV A and was looking at some toddler/really young stuff. I downloaded a compilation video that I didn't realize contained a lot of forced/crying content. I am really fucking ashamed that it really, really aroused me. I've sense delved into worse things that Babyj and I feel so ashamed every time I do it." 60 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 61 of 99 On December 20, 2012, a user posted a topic entitled "MY NIECE/GODDAUGHTER" in the "Child Love Support" forum. This post had approximately 6,049 views and three pages of replies. This post contained the following text: "I need some advice, mostly on how to proceed or if to proceed at all, my niece, "Anna" is 4 and lately she has developed what my wife calls a crush on her uncle. Well let me elaborate, shes so cute, bangs and big beautiful eyes, I'm totally in love with her, the issue I have is whether to proceed after what happened about two months ago. We were having a party at my house and after everyone left it was only Anna and her parents, and me an the wife. Well she asked to go up to my room to look for a movie, and even though I dont have kids movies I am in love with her and let her get away with murder shes my :angel so up we went. To make a long story short we ended up making out, the "normal" me said stop, but the real me felt so good I (being the responsible adult) didn't. I was so afraid she was going to run downstairs and tell everyone, but she didn't. Now, I know she did not tell because after we went back downstairs we sat on the couch and she snuggled up to me and told me "uncle" is OUR secret. ANd she is 4!!! She has such sweet lips!! made for kissing and sucking (either me on her lips or her lips one "little me" ;)) And I have seen her a couple of more times, and we snuck a few kisses but nothing like that first time ...Please Help a fellow pedo??" On March 16, 2013, a user posted a topic entitled "CP LINKS V2.0" in the "Links" forum. As identified above, this post was most-viewed post on the site with 73,773 total views. It contained links to more than 60 Tor network websites, most of which are dedicated to child pornography, including Websites 1-7,9-20, and 22 in this affidavit. 139. Upon registering for the site with a username, password, and age preference, and logging into the site, a user was allowed to post in the "Introductions" forum. Users were then required to post background details about themselves before being approved for full membership. Upon being approved for full membership, users were then able to post in the other forums. No additional forums or topics were observed after registering. 140. A review of the "Registration Agreement" revealed that seven users were part of the Management Team. 61 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 62 of 99 141. A private message feature was also available on the site that allowed users to send each other private messages, referred to as "personal messages." A review of the "Registration Agreement" revealed the following text (among others): Private Messages We have a PM system here, which our members are welcome to use to communicate in private with each-other once you have made 25 or more posts on the public board. You may use PM's to develop friendships, and talk about more personal or intimate things that you might not want to post openly in public on the main boards. Please respect our PM system, imd do not abuse it's privileges by using it to solicit trading, or to spam, disrespect, abuse or otherwise annoy any of our members. Should you find that you receive any PersonalJPrivate Messages you are unhappy with, please report such abuses by sending a PM of your own to any of our Staff Team, and we will deal with your issues. Website 15 142. Between June 26 and June 28, 2013, an FBI Special Agent operating in the District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden service at the ~onion (hereinafter referred to as "Website 15"). The site appeared to be a closed-access bulletin board whose primary purpose was the advertisement and distribution of child pornography. According to statistics posted on the site, the site contained a total of3,218 posts, 1,009 topics, 268 total images, and 215 total members. 143. The initial web page revealed a web page that contained an image of an onion in the upper-left corner of the page. The text "Looking for the forum CLICK ME! Come in We're OPEN" was in front of the onion image. The background wallpaper of the page contained approximately 117 computer-animated images. All the images depicted what I recognized, based on my training and experience, to be the "ChildLover logo"; an image which depicts a butterfly with pink and purple wings that is a symbol used by pedophiles to indicate a non-gender 62 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 63 of 99 preferential sexual interest in children. 144. The wings contained a reference to the site's name. Accessing the "CLICK ME" hyperlink revealed a message board web page with the name of Website 15. Located directly to the left of the title were six images which appeared to depict child pornography (CP) and child erotica of prepubescent males and females. Examples of these images are as follows: The first image on the left appeared to depict a naked prepubescent male whose hands are pressed against his torso. The prepubescent male's genitalia is visible in the image. The fifth image from the left appeared to depict a prepubescent female who is naked from the waist down. Her legs are spread apart and one is raised in the air, exposing her vagina. There were no images depicting adults. 145. Located below the title was the following text: Welcome to [Website IS]! This board is now open for new members once again, however, it is now by ...INVITE ONLY! Therefore, if you wish to join the best linle board in Torland, you will need to be recommended by someone who is already a member. This measure has been introduced for two main reasons - one for the purposes of security - and two, to stop people simply leeching the material here! Should you wish to join us, all you have to do is sign up in the usual way, and then get the registered member to PM one of the admin team and state that they recommend you. Admin will then activate your account and PM the recommending member back to inform them this has been done. You should bear in mind however, that ALL NEW MEMBERS are required to post within 14 DAYS OF ACCOUNT ACTIVATION. By post we mean, a picture set, or a video. You will then be elevated from ''Newly Registered" to "Registered" member status. We regularly DELETE NON-POSTING members, and you should also bear in mind that if you FAIL to post within the alloned 14 DAY period from activation, then BOTH YOU AND THE PERSON WHO RECOMMENDED YOU will have their accounts deleted from the board. Therefore, please only join if you are prepared to become an active poster, and ONLY recommend people that you are certain will actually post to the board - 63 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 64 of 99 your continued account depends on it! As you post, and at the discretion of admin, your status will change and as it does so, greater access and privileges are afforded to, such as the mini-chat, access to the galleries where you can create a personal album, and our hidden sections such as "AREA 51" and coming soon, "AREA 52" (access to "Area 52" will be strictly by invite!) Unlike many other boards, we do NOT demand that you post new material before you're even allowed in. We believe that ALL material is probably new to somebody, and it ISN'T the amount you post - it's the quality! We also have a reputation of being the friendliest board as well ... there are no strangers here - only friends we haven't yet met! !fyou do NOT know someone who is a member here, you may still request access and any admin may grant it to you. However, if this is the case, you will have 48 HOURS to make a post, and if you don't, your account will be cancelled! So come on in, become an active member and make new friends ... and please adhere to the rules (there's a link to them on EVERY page so there's no excuse!) This forum does not tolerate hurtcore in ANY form. Posting of such material will be considred a breach of the rules and wi1llead to account deletion! 146. Located below the above text was one forum entitled, "ARE YOU A GUEST? THEN CLICK HERE FOR MORE INFO!" Accessing the "ARE YOU A GUEST? THEN CLICK HERE FOR MORE INFO!" forum revealed the following topics: Topic NEW MEMBER OF THE ADMIN TEAM! ATTN NEWLY REGISTERED MEMBERS! Board Maintance REGARDING EMAILS - PLEASE READ! PERSONAL PICTURES OF "YOURSELF" Board tweaks, h02's and other board updates IF THIS IS YOUR FIRST VISIT - READ THIS IMPORTANT INFO!! 147. A review of the "ATTN NEWLY REGISTERED MEMBERS!" topic revealed one post made by the site administrator who joined on May 27, 2012 and had made 564 posts, including 79 images. This post contained the following text: If your account has been activated recently, then this information applies to you! Firstly, apologies for any delay in activating your account due to adrnin availability . 64 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 65 of 99 You should be aware by now (it's plastered all over the place!) that a requirement of registration here is that you post within 30 DAYS of activation or we delete your account. by "posting" we mean a picture set or video etc. If your account name is BLACK then this applies to you. The more you post, at the admin's descretion, your colour will gradually change, signifying more board priviledges such as access to mini chat, gallery albums, and our hidden section, AREA 51! Once your colour has changed to anything but black, your account is safe! We do this to make the board fair for everyone and to stop people coming here to simply download material on the board. Please note that anyone who has a BLACK name will have their account reviewed on 15TH JUNE 2013 If you have not posted by that date, your account will be deleted. YOU HAVE BEEN WARNED! If you upload RAR or ZIP collections etc to an outside server, please use ajap one such as ayame (see the links page) and NOT one which makes you jump through hoops with silly captcha's etc and gets deleted within 24hours! Should you upload anything and it does get deleted by the server for any reason (ayame tend NEVER to delete stuffi), then please ensure you re-up it to avoid broken links! Also when uploading sets etc, please ensure you post a preview pic so that people know what it is - helpful tutorials are available in "How do I do that?" Please be friendly - we all try to be - and if you have any issues, please PM any member of the admin team and above all... enjoy yourself! ;) 148. A review of the "IF THIS IS YOUR FIRST VISIT - READ THIS IMPORTANT INFO!!" topic revealed one post made by the administrator on May 27, 2013, and contained the following text [spelling and grammar as in original): Firstly welcome to [Website 15]! You may be thinking this place looks a bit blank - it has been deliberately set up that way to stop idiots and dickheads. If you wish to sign up, then you need to be recommended by someone who is a "REGISTERED MEMBER" or above, and you will be expected to post within FOURTEEN DAYS. If you do not post within that period to confirm your membership, then BOTH YOU & THE PERSON WHO RECOMMENDED YOU will be deleted from the board ... YOU HAVE BEEN WARNED!! You need to register with a VALID email address. You can sign up for TORMAIL here: http:! onion! :-bd Your username should be non offensive and should be a "proper" name. Random 65 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 66 of 99 combinations of letters and/or numbers will NOT be allowed! Registrations consisting of these will be deleted and will NOT be activated! This nonnally take LESS THAN 24 HOURS and quite often much less, but please be patient as administrator's are only human and may be attending to other things. You will not be notified, life's too short, ;) so check back after a while to sec if your login works. If for some reason after 48 hours you cannot log in, please send an email with your username to: gtornlail.org or~tormail.org and it will be looked into asap but please wait the 48 hours before doing so! Once registered, you will be classed as a "newly registered member". This means that your posts at first will be subject to moderator approval. This is no slur on you personally, and applies to all members when they register. You will find however, that if you post regularly, this will soon disappear and posts you make will appear instantly you make them. It is our intention for this board to be the best and the most friendliest. What J mean by that is that people actually contribute and do not simply lurk. Lurkers will not be tolarated and all non-posters will be reguarly pruned. As the board evolves and the more active you become, you will find yourself rewarded by access to forums and consequently files which are NOT accessible by those who simply lurk and leech. Once you have registered, please take a moment to look at the rules. (there is a link to them at the top of EVERY page). 1have made them as minimal as possible. however, if everyone adheres to them, then this will be a great place to be. 149. A review of the remaining topics revealed they contained information on changes to the board, details on other boards, and an announcement for a new member oCthe Admin Team. 150. A private message featurc also appeared to bc availablc on the sitc, as referenced abovc in the welcome mcssagc to new uscrs. 151. No furthcr contcnt was accessible on the wcb page due to the rcquircmcnt that new users be rccommended for mcmbcrship by an existing mcmbcr. Bascd on my training and experience, I belicvc that such a requiremcnt, in conjunction with requircmcnts that users periodically upload child pornography to the site. is a common method by users and 66 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 67 of 99 administrators of child pornography websites to limit or prevent law enforcement infiltration of the site. Website 16 152. On July 1,2013, an FBI Special Agent operating in the District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden service at URL onion (hereinafter referred to as "Website 16"). Website 16 appeared to be a video sharing website whose primary purpose was the advertisement and distribution of web cam videos of minors engaging in sexually explicit conduct. 153. The initial web page contained the name of the site and multiple images containing what appeared to be child pornography (CP) and child erotica depicting early pubescent or prepubescent males. Also on the initial web page were numerous links to other child pornography websites, including Websites 2, 4-6, and 22. 154. Located below the image was a section entitled "Featured Cams" that contained three sets of images that appeared to be still-shots of video files. Each still-shot contained 16 images depicting prepubescent or early pubescent males. Located below the aforementioned images was a section that contained the following text: Thanks for 413,133 site hits and 1370 comments on 138 cams! If you like my cams then please leave a comment below the download links, it'll keep me motivated to upload even more :). 155. Located below this text were multiple video files. Each file contained the date and time it was posted, the title of the file, the number of comments made by other users, the number of times the file had been viewed, an image containing still-shots of the video, and a hyperlink entitled "Download & Comment." At the bottom of the web page was an additional 67 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 68 of 99 hyperlink to access previously uploaded videos. 156. Located on the right side of the web page was another section that included the text: "[Website 16] I make feeeet cams ...like boys and girls, ages 0-15. Chat with me on IRC if you like (Guide in the links section below)." 157. A review of the images containing still-shots of the videos uploaded to this site revealed they appeared to contain CP and child erotica depicting early prepubescent and prepubescent males and females. Examples of these are as follows: On June 4, 2013, a user posted a video entitled" " and an image containing 12 still-shot images of the video. These still-shot images depicted what appeared to be a naked early pubescent or early pubescent male, including close-ups of his genitalia. On May 30, 2013, a user posted a video entitled" •••••••••••• ' and an image containing 12 still-shot images of the video. These still-shot images depicted what appeared to be a naked early pubescent or early pubescent male, including close-ups of his genitalia. 158. All videos and images on the site appeared to have been uploaded by one user who appeared to be the administrator of the site. 159. No chat or private message features were located on the web page and no registration was required. All sections of the site were accessible to any user of the site. Website 17 160. Between June 26 and June 28, 2013, an FBI Special Agent operating in the District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden .onio~(hereinafter referred to as "Website 17"). Website 17 appeared to be a bulletin board whose primary purpose was the advertisement and distribution of child pornography. Statistics posted on the site revealed the board contained a 68 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 69 of 99 total of5,678 posts, 1,729 total topics, and 24,670 total members. 161. The initial web page was a message board web page with three hyperlinks entitled "Register," "Login," and "Search," along with a Login section with two data-entty fields and the corresponding text, Usemame and Password. Located below the aforementioned items was one forum entitled "README." A review of the "README" forum revealed it contained three posts, all of which were made by site administrator on January 20, 2010. The "RULES" post contained the following text: -Don't post boys, gay porn! -Don't post girls 16+! This is not a mature site! -don't post 3D, 10licon, comics, drawings, etc... only real stuff! Thank you! The "ABOUT THE VIP AREA" post contained the following text: Best posts here! The best posters gain access to the VIP. We have a Private Area too. Only for producers. PM me if you are interested. New stuff here! torchat: The REGISTRATION" post contained the following text: You don't have to give a valid e-mail account. It works without that. After the registration, you are the member of the Registered Users group. To stay active member: -post pictures, videos or archives at least 2 Mb in the first 24 hour. - min I post/month 162. Registration to the message board required a user to enter a usemame, password, and e-mail account. After successfully registering and logging into the site, the following forums and sub-forums were observed, along with the corresponding number of topics and posts in each: Forum Posts Discussions Competition VIP Topics 1476 80 Posts 4628 250 19 2 not accessible 69 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 70 of 99 Forum 163. not accessible A review of the various topics within the "Posts" forum revealed it contained 60 pages of topics. Each topic contained a title, the author, the number of replies, the number of views, and the last post. The last post section included the date and time of the post as well as the author. Upon accessing a topic, the original post appeared at the top of the page, with any corresponding replies to the original post included the post thread below it. Typical posts appeared to contain text, images, thumbnail previews ofirnages, compressed files (such as ".rar" files), links to external sites, or replies to previous posts. 164. A review oftopics within the "Posts" revealed numerous posts containing images depicting CP and child erotica of early pubescent females, prepubescent females and toddlers; including those. depicting anal, vaginal, or oral penetration. Examples of these are as follows: On June 22, 2013, the user ,_, posted a topic entitled" 5yo", which contained numerous images depicting CP of a prepubescent female. One of these depicted the prepubescent female squatting with her legs bent and spread apart, exposing her vagina and anus. On June 7, 2013, the user '_' posted a topic entitled "Re: 3 sisters", which contained numerous images depicting CP of prepubescent females. One of these depicted a prepubescent female with her mouth open and what appeared to be an adult male's penis penetrating her mouth. 165. A review of the remaining two forums revealed numerous topics, posts, and threads that contained text indicative of an interest in CP, images which appeared to depict CP and child erotica of prepubescent females, and requests for site monitors. 166. A list of members, which was accessible after registering for an account, revealed that approximately 114 users made at least 10 posts to one or more of the forums. Approximately 26 of these users made at least 30 posts. 70 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 71 of 99 167. A private message feature was also available on the site that allowed users to send each other private messages. A review of the site revealed several posts in which users requested to be contacted via private messages (including the aforementioned post made by "admin"). An example of this is as follows: On August 25, 20 II, in response to CP images posted by another user, the a user posted, "message me to trade private x". Websites 18 and 19 168. Between June 25 and June 28, 2013, an FBI Special Agent operating in the District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden service at URL onion (hereinafter referred to as "Website 18"). Website 18 appeared to be a bulletin board whose primary purpose was the advertisement and distribution of child pornography. Statistics posted on Website 18 revealed the board contained a total of 70,648 posts, 14,900 total topics, and 945 total members. Website 18 also appeared to be connected to another Tor hidden service hereinafter referred to as Website 19, as described below. 169. The initial web page of Website 18 contained the title of the site and a computer- animated image depicting two prepubescent children. Located below the title was the current date and time, along with two hyper links entitled "FAQ" and "Login." Located below the aforementioned items was one section that contained the following forums, along with the corresponding number of topics and posts: -Forum READ BEFORE YOU REGISTER If your login does not work Cookies are now needed to access this board 71 Topics o o o Posts o o o Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 72 of 99 [Website 18 abbreviation] OPEN BOARD - Now Open for Registrations redirects: 241193 [Website 18 abbreviation] Tutorials 17 23 170. A review of the first three forums revealed they did not contain any content. A review of the "[Website 18 abbreviation] Tutorials" forum revealed it contained, among other things, instructions for how to post, how to upload files, how to generate preview images, and how to encrypt data. 171. Accessing the "[Website 18 abbreviation] OPEN BOARD - Now Open for Registrations" link directed the user to a new URL, onio~ hereinafter referred to as Website 19. Website 19 appeared to be a bulletin board whose primary purpose was the advertisement and distribution of child pornography. It shared the same name as Website 18 but for the designation "Open Board." Statistics posted on Website 19 revealed the board contained a total of 8,408 posts, 3,165 total topics, and 5,201 total members. The initial web page of Website 19 contained the title "[Website 18] Open Board" and a computer-animated image depicting a prepubescent child. Located below the title was the current date and time, along with three hyperlinks entitled "FAQ," "Register," and "Login." 172. Located below the aforementioned items on Website 19 were four sections that contained the following forums, along with the corresponding number of topics and posts: Forum GENERAL INFO RULES Guest Discussion Board [Website 18 abbreviation] Tutorials GIRLS Girls - Hardcore Pics Girls - Hardcore Vids Girls - NonNude PicsNids 72 Topics Posts 3 86 3 212 19 28 114 1554 6 363 4145 10 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 73 of 99 Girls - Softcore PicsNids 57 Girls - Webcams 441 BOYS Boys - NonNude PicsNids 0 Boys - Softcore PicsNids 6 Boys - Hardcore Pies . 18 Boys - Hardcore Vids 673 Boys - Webcams 179 FORUM If your login does not work 0 Cookies are now needed to access board 0 [Website 18] Main Board Total redirects: 173. 126 1162 0 19 60 1785 487 0 0 4664 A review of topics within the "GENERAL INFO" section revealed, among other things, instructions for how to post, along with discussions in regards to software programs, other sites, technological questions, issues with the site, and links to other sites. Many of the posts contained text indicative of an interest in child pornography (CP). 174. Two of the topics within the "RULES" forum were posted by a user who was listed as the Site Admin. The topic "[Website 18 abbreviation] Rules and Information - Please Read" contained one post, which included the following text (among other' text): If you write PMs to admins/mods, please always write to all admins (in one pm in "to" field, not cc or bee.), this way you'll get a faster reply/reaction, one admin will reply and put other admins in bee. The rest of the posting listed the name of one site administrator, seven co-administrators, and two global moderators. 175. The topic "Activity Rules" also contained one post, which included the following text: Why do you have to contribute? Now that you are a member of [Website 18], you should be aware that [Website 18 abbreviation] is neither a public board nor a private one. The best definition is moderated board. When you move to a new neighborhood, you have to get along with the residents and their rules, but that doesn't mean you're living in a private 73 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 74 of 99 zone. Simply put, the residents have an unspoken contract between them which helps to facilitate a peaceful and profitable life together. This is the case here at [Website 18].ln order to attain the highest benefit and security for our members, we have specific activity rules for each membership level that must be followed in order to keep our community active and vibrant. What does count as a contribution and what does not? COUNT as contribution: Set(s) of pictures and/or videos displaying child/teen (pubescent) modeling, child/teen (pubescent) nudity, softcore or hardcore erotica. Nudism/naturism. Webcarn captures. Working backdoors and passwords of on-topic sites (if they don't require JavaScript or Flash). Helping the community with tutorials, re-uploads and filling requests of all of the above. NOT COUNT as contribution: Late teen nudity/erotica/porn (Jailbait who passed puberty and look like adults: :f: 14 years old for girls and :f: 15 years old for boys). Adult nudity/erotica/porn. This includes fake jailbait porn (young looking women that act like teenagers but are obviously 18+) Comics, drawings, lolicon. 3D porn. Artistic performances. This includes: stories, songs, wallpapers and photoshopped photographies (fakes). Links to other on-topic sites (imageboards, torsites, etc.). News. Feedback. It surely makes this place much better and encourages members to post more material, but users can't simply stay as members by thanking everyone without uploading something themselves. Rules Main rules: All members are required to contribute at least once every 30 days. Each member's 30-day contribution period restarts on the day of their last valid contribution. To qualify for a VIP upgrade, the total of all your contributions must be at least 4 GB and you must have been a member for at least one month. If you are demoted from VIP to Full member or from Full member to New Reg due to inactivity, the total of your contributions will be reset to 0 and you will have to wait at least a month before you can request VIP status again. To qualify for a SVIP upgrade, you must have been a member for at least 6 months. Depending on the history and circumstances of the member, the admin staff may choose to be more flexible when applying these rules. 74 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 75 of 99 If you are going to be away from the board long enough to keep you from fulfilling your contribution requirement (illness, real life problems, etc.), please notify all administrators via Private Message. You will not be demoted during this time unless you continue to log in regularly. New Regs.: New Regs must submit an application post and have it approved by admin staff in order to become a Full Member and gain access to the [Website 18 abbreviation] Member Board. If the New Reg does not submit an application post for approval within 20 days of registering, their account will be deleted. Full Members: All Full Members are required to contribute at least once every 30 days. The first 30-day contribution period begins on the day of promotion to Full Member. If a Full Member fails to make a contribution during their allotted contribution period, their account will be demoted to New Reg without prior warning and they will be required to submit a new application post on the [Website 18 abbreviation] Open Board in order to regain full access. VIP Members: All VIP Members are required to contribute at least once every 30 days, in any section of the board. If a VIP Member fails to make a contribution during their allotted contribution period, they will receive a warning via Private Message requesting a new contribution be made within the next 7 days. If the VIP Member fails to make a contribution during that 7-day period, they will be demoted to Full Member. Note: VIP Members who have not made at least one contribution since becoming a VIP Member will not be given this extra 7-day period to contribute and will be demoted to Full Member without prior warning. Those VIP Members who receive warnings for two consecutive contribution periods and then fail to make a contribution during the third consecutive contribution period will be demoted to Full Member without prior warning. SVIP Members: All SVIP Members are required to contribute at least once every 30 days, in any section of the board. If a SVIP Member fails to make a contribution during their allotted contribution period, they will receive a warning via Private Message requesting a new contribution be made within the next 7 days. If the SVIP Member fails to make a contribution during that 7-day period, the admin staff will evaluate the member's history and current status to decide whether or not the member should be demoted to VIP Member. Those SVIP Members who receive warnings for two consecutive contribution periods and then fail to make a contribution during the third consecutive contribution period may be demoted to VIP Member without prior warning. 75 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 76 of 99 176. A review of the' various topics within the "GIRLS" and "BOYS" sections revealed the forums within these sections contained numerous pages of topics. Each topic contained a title, the author, the number of replies, the number of views, and the last post. The last post section included the date and time of the post as well as the author. Upon accessing a topic, the original post appeared at the top of the page, with any corresponding replies to the original post included the post thread below it. Typical posts appeared to contain text, images, thumbnail previews of images, compressed files (such as ".rar"), links to external sites, or replies to previous posts. 177. A review of topics within these sections revealed numerous posts containing images depicting CP and child erotica of prepubescent males, females, and toddlers; including those depicting anal, vaginal, or oral penetration. Examples of these are as follows: On June 24, 2013, a user posted a topic entitled "APP in the Girls-Hardcore Pies forum that contained numerous images depicting CP of a female toddler. One of these depicted a naked prepubescent female toddler sitting on the floor with her legs spread apart and bent at the knees, exposing her vagina. -_in On April 13, 2013, a user posted a topic entitled "APPLICATION the Boys - Hardcore Pies forum that contained multiple images depicting CP of prepubescent males. One of these images depicted what appeared to be a naked prepubescent male who was being anally penetrated by what appeared to be an adult male or post-pubescent male's penis. 178. After successfully registering for an account with a usemame and password, and logging into the site, no member lists or additional forums or topics were observed. 179. A private message feature was available after registering, allowing users to send private messages to each other. Multiple posts were observed in which members discussed the private message capability. An example of this was referenced above in the aforementioned post 76 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 77 of 99 by the administrator. Website 20 180. On June 25, 2013, an FBI Special Agent operating in the District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden service at the URL onion (hereinafter referred to as "Website 20"). Website 20 is of a format commonly known as an image board, which allows users to upload images to and download images from the website, whose primary purpose is the advertisement and distribution of child pornography. According to statistics posted on the site, the site contained 3,317 registered members, 5,354 images that were uploaded, and 40 galleries uploaded with 2,362 images. 181. The initial web page contained the following eight hyperlinks at the top of the web page: Home Gallery Directory Login Register Service FAQ TOS The center of the web page contained the text "Add Files" and ten separate fields, each with corresponding "Browse" and "Add" buttons. Below these fields were two checkboxes providing options to resize the uploaded image(s) or "make the images Private?" 182. Located below the aforementioned text, at the bottom of the web page, were the following four additional hyperlinks: New Popular 77 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 78 of 99 Top Rated Random A review of the eight hyperlinks at the top of the web page revealed the following: Link Description Home Gallery Directory Home page of the site Identical to home page. Contained links to 18 image galleries, four of which had posts. These four were entitled "Beauty-Fashion," "EducationalDocumentary," "Family-Kids" and "Others". These galleries appeared to contain child pornography (CP) and child erotica images depicting prepubescent females. Login to web page utilizing a user name and password. Registration to the web pagc utilizing a user name, password, and e-mail account. After entering this information, an FBI agent then logged into the site using the previous link. Selected technical details of web page. Frequently Asked Questions Terms of Service Login Register Service FAQ TOS A review of the four hyperlinks at the bottom of the web page revealed the following: Link New Popular Top Rated Random Description Contained 174 pages of uploaded images, with approximately 30 images on each page. A review of selected pages revealed images that appeared to depict CP and child erotica of prepubescent and early pubescent females. Contained 174 pages of uploaded images, with approximately 30 images on each page. A review of selected pages revealed images that appeared to depict CP and child erotica of prepubescent and early pubescent females. Contained 174 pages of uploaded images, with approximately 30 images on each page. A review of selected pages revealed images that appeared to depict CP and child erotica of prepubescent and . early pubescent females. Contained one page of uploaded images with 30 images on the page. These images appeared to contain CP and child erotica depicting prepubescent or early pubescent females. Each of the above images appeared to contain the date and time of uploading, as well as the total 78 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 79 of 99 nwnber of views. 183. No chat features were located on the web page and no registration was required. No private messaging appeared to be available. Website 21 184. On July 2, 2013, an FBI Special Agent operating in the District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden service at the URL onion (hereinafter referred to as "Website 21"). Website 21 appeared to be a bulletin board whose primary purpose was the advertisement and distribution of child pornography. Statistics posted on the site revealed the site had 7,712 members, 22,230 posts, and 2, I92 topics. 185. The first web page showed a standard bulletin board format with the following sections visible before creating or accessing an account: Posts Topics General Site Information, Questions & Suggestions Introductions Off-Topic Discussion General Discussion Hurtcore Beastiality Links, Guides & Security 649 3048 549 2464 2350 408 198 73 443 70 212 143 43 20 Foreign Languages German Dutch Russian Spanish French 1274 349 374 734 115 33 186. 44 19 55 7 The section titled "Recent Posts" showed the seven (7) most recent posts 79 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 80 of 99 occurring on 07/02/2013 from approximately 05:16:30 pm to 06:04:34 pm, with the current date time at the top of the page showing as 07/02/2013, 06:41: 19 pm. 187. Accessing the General/Site Information, Questions & Suggestions section showed two (2) topics fixed at the top of the other topics: Forum Rules & Information - started by a user who was listed as a coadministrator, 03/05/2013. Information provided in this post concerned general forum rules such as privacy, conduct toward other site members, definitions and requirements for various member ranks, and identification of seven members by usemarne who were co-administrators or moderators. 188. It was not possible to access member profiles without an account. Contact information was provided at the bottom of the post. Guidance entailed contacting the listed staff or utilization of a particular tormail.org email in conjunction with a PGP encryption key. Based on my training and experience, I believe that a PGP encryption key may be used to passwordprotect the contents of an email so that the contents are available only to the intended sender and recipient. 189. The second fixed topic concerned the re-Iocation of posts/topics by site staff and some suggestions on how to locate the post/topic if are-direct was not left by the staff member relocating the post/topic. The thread was started on 03/24/2013. 190. Under General Discussion, a list of topics included: "As I like to kill a girl or boy?" which concerned different ways individuals would like to kill a young boy or girl, and "[h]ow deep can you get your dick in your preteen girl?" which concerned penetration by adult males of pre-pubescent females either vaginally orally. 191. Under Hurtcore, was the following topic/post: _- Video. - post started on 06/27/2013 with links to two separate Tor 80 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 81 of 99 network website locations on a separate website. Accessing the first link showed a proof sheet, that is, a series of still images created from a video, which shows an adult female forcing an infant female to perform oral sex on her and exposing the infant's genital area in a lewd and lascivious fashion. Review of the downloaded video confirmed the content matched images in the proof sheet. The topic itself is four (4) web pages in length. Numerous posters posted messages on that topic while utilizing avatars that contained child exploitation material. Under Beastiality was the following topic/post: ~ucks dog - post started on 04/20/2013. The initial post provided a link to a non-Tor internet site and a password. The link was unable to be downloaded at the time of the undercover session. A second link was provided on 06/14/2013 by another user. Accessing the second link revealed a proof sheet from a video depicting a pre-pubescent female forced to perform oral sex on a male dog. 192. An account was created by an FBI Special Agent and utilized to access the website. After logging into the site, sending and receiving of private messages became available, as well as creating/replying to topics/posts. Additionally, the following sections and areas became visible: Spotlight Attention New Members! - 1602 redirects Discussion Practical Child Education Sex Tourism & Prostitution - 294 posts 189 posts 22 topics 23 topics Media Literature Videos Boy VideosGirl Videos Adult Videos - 371 posts 1412 posts 808 posts 525 posts 31 posts 89 topics 177 topics 80 topics 78 topics 9 topics Boy ImagesMale Babies & ToddlersMale Jailbait Male AdultGirl Images Female Babies & Toddlers - 2735 posts 530 posts 103 posts 38 posts 3303 posts 718 posts 237 topics 53 topics 13 topics 7 topics 236 topics 60 topics 81 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 82 of 99 Female Jailbait Female Adult Mixed Gender & Misc. Images - 323 posts 100 posts 214 posts 24 topics 9 topics 13 topics Under Videos was the following topic/post: vcam_skype - l5yo~cks his 9yo girl neighbor. This thread was started on 06/12/2013 and pro=:l"':'thumbnail proof sheet ofa video depicting what appeared to be an underage male engaged in sexual intercourse with a prepubescent female. A second link to the video on another Tor network website provided by another user. The proof sheet provided in the second link appeared to be similar to the original and depicted what appeared to be an underage male and female potentially engaged in sexual intercourse. The video itself was not accessible from either the original post or the subsequent link provided by the other user. Under VideoslBoy Videos was the following topic/post: Nice little boy BJ. The thread was started on 06/29/2013 and provided two thumbnail images depicting a male child forced to perform oral sex on anadult male. A link to another Tor network website was provided in the posting. That link was accessed and the posting was confirmed to contain a video with a male child forced to perform oral sex on an adult male. Under Videos/Girl Videos was the .following topic/post: DD by.art 3. This thread was started on 07/0112013 and provided a link to a proof sheet and video. A review of the im~e proof sheet were identical to video previously reviewed as __ which contained footage of an adult female forcing an infant female to perform oral sex and display her genital area in a lewd and lascivious manner. Under Boy Images was the following topic/post: cum covered! This thread was started on 04/06/2013 and provided numerous thumbnail sized images depicting pre-pubescent males with white fluid in their mouth, anus, scrotum and lower back; genitals and anal region displayed in a lewd and lascivious manner; and forced to perform oral sex on another male. At the time of review, the topic contained six (6) pages of replies and additional posts. Under Boy Images/Male Babies & Toddlers was the following topic/post: Bondage babies and toddler! This thread was started on OS/28/2013 and provided 82 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 83 of 99 a thumbnail image of a clothed female child with her hands and feet tied and duct tape over her mouth and the comment "You can do so much with them, if they are tied up!" New to me, his is so cute, waiting to be destroyed. This thread was started on 06/20/2013 and provided four (4) thumbnails of a pre-pubescent male partially clothed. Comments by users indicated various sexual acts they would like to perform on the child. Under Boy ImageslMaie Jailbait was the following topic/post: Coffee coloured boy having fun with a pervert. This thread was started on 04/03/2013 and provided 14 thumbnail images of a minor male forced to perform oral sex on and anally penetrated by an adult male. Under Girl Images was the following topic/post: rape and torcher babyssssss. This thread was started on 06/20/2013 and provided numerous thumbnail images of infants/toddlers bound, anally/vaginally penetrated with objects/male penis, and lewd and lascivious display of genitals. This topic contained nine (9) pages of replies and additional posts at the time it was reviewed. Under Girl ImageslFemaie Babies & Toddlers was the following topic/post: This thread was started on 06/30/2013 and provided a thumbnail image linking to a proof sheet depicting an infant female vertically suspended by her ankles with duct tape over her mouth. A nude adult female can be seen in the images touching the infant female's genitals and displaying them in a lewd and lascivious manner. Under Girl ImageslFemale Jailbait was the following topic/post: Niplles begging to be abused. This thread was started on 05/04/2013 and provided a thumbnail and link to larger image of an identified underage female with her genitals displayed in a lewd and lascivious fashion and an object inserted into her vagina. A second user provided a second thumbnail and link to larger image of the same underage female bound by her ankles and wrists while her genitals are displayed in a lewd and lascivious manner. Under Mixed Gender & Misc. Images was the following topic/post: dark skinned toddy. This thread was started on 05/04/2013 and provided 83 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 84 of 99 thumbnails and links to larger images of underage males engaged in oral sex with adult males. Additional replies and posts by other board members/guests provided additional thumbnails and links to larger images. Website 22 193. In July of2013, an FBI Special Agent operating in the District of Maryland connected to the Internet via thc Tor Browser and accessed the Tor hidden service at the URL onion (hereinafter referred to as "Website 22"). Website 22 is a Tor hidden service with the primary purpose to be the advertisement and distribution of files containing child exploitation material. As of 07/12/2013, the site reports that there are almost 1.4 million files that have been uploaded and are accessible by individuals who visit the hidden service. It is not required to register with the site to either post/view content or participate in forum discussions. However, for the forum section of the site, a registered account allows an individual to send and receive private messages between users. There are no pre-requisites are requirements to create an account. 194. The home page of the hidden service itself displays thumbnails of either images or videos that have recently been uploaded, along with files that individuals have marked as being a favorite. One file displayed, identified by file number_jpg, depicts a pre-pubescent male with his genital area displayed as the focal point of the image. Another file, identified by file number_.jpg, depicts a male infant/toddler performing oral sex on an older pre-pubescent male. This file appears to be a series of still shots taken from a video. At the top-right of the home page are links to areas identified as "Girls," "All," and "Boys" along with age ranges from o to 18+ with an additional selection of "n/a" that can be utilized in conjunction with a search box to fmd files associated with a particular word/age/sex. The results of this type of search are 84 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 85 of 99 provided in a thumbnail format and based on either words "tagged" onto an image or words located in set-names associated with certain groups of related files. Selecting images or sets then allows the user to download/view individual files with an option to download all files associated with a particular result. 195. Individuals visiting the site can upload files either singularly or in groups, either as individual files or part of an archive file. Once uploaded, these files can be viewed and/or downloaded by anyone accessing the hidden service. 196. The site's forum section, which includes 16 language specific areas, did not itself appear to contain any child exploitation material, but did provide an area for discussion on various topics such as computer security, "Morality of Pedophilia," "Website Ideas, Improvements & Bugs" among others. There are 16 language specific areas in the forum as well. Website 23 197. In July of2013, an FBI Special Agent operating in the District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden service at the URL onion (hereinafter referred to as "Website 23"). Website 23 is a Tor hidden service, primarily in the Russian language, with the primary function to be the advertisement, distribution and production of files containing child exploitation material. As of July IS, 2013, the site reports that there are over 14,000 posts, 612 topics, and over 16,000 members. Other information visible on the initial page includes recently registered members, current number of site visitors accessing the site, and most users ever online (44 users on 01/13/2012). 198. The main home page of Website 23 depicts the name of the site in the English language and, below the name of the website, the word "preteen" in English. Next to the site 85 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 86 of 99 name is a headshot photo of what appears to be a pre-pubescent or near-pubescent female. 199. All links on the initial page are written in Russian. Links visible were translated via Google Translate to FAQ, registration, and entrance (interpreted as Log-In). Accessing the FAQ link opened a page with numerous entries in the Russian language. No content or other information related to members or postings is visible until an individual creates and registers a user account with the bulletin board. During the registration process, a user provides a username, password and e-mail address. Additionally, a Russian-based e-mail account was visible which was associated with a link for "Board Administrator." Once registered, a private message feature became available, although one could not see a list of members. In addition, after registering and logging onto the bulletin board the following topics became visible: Rules 4 topics 13 posts Hi II topics 2,303 posts 200. Accessing the "Rules" section revealed a topic posting titled "[h]ow to post," which was started on 08/14/2011 by the board administrator, which contained information related to posting images/videos on the site. Information in the post covered locations to host the file and/or a preview of the file, password format (passwords were required to contain a user's nickname and the website name), instructions to change the name of the files to something "offiopic," and that any posts not conforming to these rules would be deleted. Based upon my training and experience, I believe that changing filenames to something "off topic" means altering filenames so that it is not obvious the file contains child pornography or erotica. 201. Also within the "Rules" section was a posting titled "[!Jor registration and see posts," started on 08/14/2011 by the board administrator. Information contained in the post 86 I Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 87 of 99 related to registration, changing settings in profile to match language preferences, posting a greeting in the "Hi" forum and including upload/preview of files. 202. Also within the "Rules" section was a posting titled "HOW to get VIP," started on 08/29/20 II by the board administrator. That posting contained detailed instructions on how to become a VIP member based on access to "exclusive material." Members with "exclusive material" were instructed to contact the administrator via "PM," which based upon my training . and experience I understand to mean private message, for additional details and instructions about how to "transition to VIP." Five (5) additional posts by the board administrator showed examples of child exploitation material depicting underage or pre-pubescent females. Each image contained a reference to the website name written on either a sign held by/adjacent to the underage female or written on her body. Additionally, some images contained what appeared to be usemames of users who are currently listed as members of this particular bulletin board. 203. Also within the "Rules" section was a posting titled "[h]ow to download from cash-file," started on 08/14/2011 by the board Administrator. That posting appeared to relate to utilizing a third party hosting site - i.e., a website other than Website 23 where child exploitation material could be stored for download by board users. As of 07/15/2013, neither the primary URL nor the secondary site listed in subsequent posts appeared to be active or accessible. 204. Accessing the "Hi" section showed the most recent post in the "For greetings" thread occurred on 07/15/2013 by a registered member. Some, though not all, of the avatars observed in this thread associated with postings by site members appeared to be child exploitation material. THE NETWORK INVESTIGATIVE 205. TECHNIQUE Based on my training and experience as a Special Agent, as well as the experience of 87 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 88 of 99 other law enforcement officers and computer forensic professionals involved in this investigation, and based upon all of the facts set forth herein, to my knowledge a network investigative technique such as the one applied for herein is the only presently available investigative technique with a reasonable likelihood of securing the evidence necessary to prove beyond a reasonable doubt the actual location and identity of those administrators and users of Websites 1-23 described in Attachment A who are engaging in the federal offenses enumerated in paragraph 4. Due to the unique nature of the Tor network and the method by which the network protects the anonymity of its users by routing communications through multiple other computers or "nodes," as described herein, other investigative procedures that are usually employed in criminal investigations of this type have been tried and have failed or reasonably appear to be unlikely to succeed if they are tried. 206. Based on my training, experience, and the investigation described above, I have concluded that using a network investigative technique may help FBI agents locate the users of the child pornography Websites 1-23. Accordingly, I request authority to use the NIT, which will be deployed on Websites 1-23 while Websites 1-23 operate in the District of Maryland, to investigate: (1) any user or administrator who logs into any of Websites 1-23 by entering a usernarne and password; (2) any user who accesses any section of any of Web sites 1-23 where child pornography may be accessed; and (3) any user who uploads a file to any of Web sites 1-23. 207. In the normal course of operation, websites send content to visitors. A user's computer downloads that content and uses it to display web pages on the user's computer. Under the NIT authorized by this warrant, the website, which will be located in ~e District of Maryland, would augment that content with some additional computer instructions. When a computer successfully downloads those instructions from the website located in the District of 88 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 89 of 99 Maryland, the instructions are designed to cause the "activating" computer to deliver certain information to a computer controlled by or known to the government. That information is described with particularity on the warrant (in Attachment B of this affidavit), and the warrant authorizes obtaining no other information. The NIT will not deny the user ofthe "activating" computer access to any data or functionality of that computer. 208. The NIT will reveal to the government environmental variables and certain registry- type information that may assist in identifYing the computer, its location, and the user of the computer, as to which there is probable cause to believe they are evidence of violations of the statutes cited in paragraph 4. In particular, the NIT will reveal to the government no information other than the following items, which are also described in Attachment B: • The "activating" computer's ~ctual IP address, and the date and time that the NIT determines what that IP address is; • A unique identifier (e.g., a series of numbers, letters, and/or special characters) to distinguish the data from that of other "activating" computers. That unique identifier ",ill be sent with and collected by the NIT; • The type of operating system running on the computer, including type (e.g., Windows), version (e.g., Windows 7), and architecture (e.g., x 86); • Information about whether the NIT has already been delivered to the "activating" computer; • The "activating" computer's Host Name. A Host Name is a name that is assigned to a device connected to a computer network that is used to identifY 89 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 90 of 99 the device in various forms of electronic communication, such as communications over the Internet; • The "activating" computer's Media Access Control ("MAC") address. The equipment that connects a computer to a network is commonly referred to as a network adapter. Most network adapters have a MAC address assigned by the manufacturer of the adapter that is designed to be a unique identifYing number. A unique MAC address allows for proper routing of communications on a network. Because the MAC address does not change and is intended to be unique, a MAC address can allow law enforcement to identifY whether communications sent or received at different times are associated with the same adapter. 209. Each of these categories of information described in Attachment B may constitute evidence of the crimes under investigation, including information that may help to identifY the "activating" computer and its user. The actual IP address of a computer that accesses Websites 1-23 can be associated with an Internet service provider ("ISP") and a particular ISP customer. The unique identifier and information about whether the NIT has already been delivered to an "activating" computer will distinguish the data from that of other "activating" computers. The type of operating system running on the computer, the computer's Host Name, and the computer's MAC address can help to distinguish the user's computer from other computers located at a user's premises. 210. During the up to thirty day period that the NIT is deployed on Websites 1-23 which will be located in the District of Maryland, each time that any user or administrator logs into any of 90 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 91 of 99 Websites 1-23 by entering a usemame and password, or accesses any sections of any of Web sites 123 where child pornography may be accessed, or uploads a file to any of Websites 1-23, the NIT authorized by this warrant will attempt to cause the user's computer to send the above-described information to a computer controlled by or known to the government that is also located in the District of Maryland. 2 I I. In the normal course of the operation of a web site, a user sends "request data" to the web site in order to access that site. While Websites 1-23 operate at a government facility, such request data associated with a user's actions on Websites 1-23 wiII be collected. That data collection is not a fimction of the NIT. Such request data can be paired with data collected by the NIT, however, in order to attempt to identify a particular user and to determine that particular user's actions on Websites 1-23. REQUEST FQR DELAYED NOTICE 212. Rule 41(£)(3) allows for the delay of any notice required by the rule if authorized by statute. 18 U.S.C. S 3 103a(b) (I) and (3) allows for any notice to be delayed if "the Court finds reasonable grounds to believe that providing immediate notification of the execution of the warrant may have an adverse result (as defined in 18 U.S.C. S 2705) ... ," or where the warrant "provides for the giving of such notice within a reasonable period not to exceed 30 days after the date of its execution, or on a later date certain if the facts of the case j ustify a longer period of delay." Because there are legitimate law enforcement interests that justify the unannounced use of a NIT, I ask this Court to authorize the proposed use of the NIT without the prior announcement of its use. Announcing the use of the NIT could cause the users or administrators of Websites I-23 to undertake 91 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 92 of 99 other measures to conceal their identity, or abandon the use of Web sites 1-23 completely, thereby defeating the purpose of the search. 213. The government submits that notice of the use of the NIT, as otherwise required by Federal Rule of Criminal Procedure 41(t), would risk destruction of, or tampering with, evidence, such as files stored on the computers of individuals accessing Websites 1-23. It would, therefore, seriously jeopardize the success of the investigation into this conspiracy and impede efforts to learn the identity of the individuals that participate in this conspiracy, and colleet evidence of, and property used in committing, the crimes (an adverse result under 18 U.S.C. 93103a(b)(l) and 18 U.S.C. 9 2705). 214. Furthermore, the investigation has not yet identified an appropriate person to whom such notice can be given. Thus, the government requests authorization, under 18 U.S.C. 93103a, to delay any notice otherwise required by Federal Rule of Criminal Procedure 41(t), until 30 days after any individual accessing Websites 1-23 has been identified to a sufficient degree as to provide notice, unless the Court finds good cause for further delayed disclosure. 215. The government further submits that, to the extent that use of the NIT can be characterized as a seizure of an electronic communication or electronic information under 18U.S.C. 9 3103a(b)(2), such a seizure is reasonably necessary, because without this seizure, there would be no other way, to my knowledge, to view the information and to use it to further the investigation. Furthermore, the NIT does not deny the users or administrators access to Websites 1-23 or the possession or use of the information delivered to the computer controlled by or known to the government, nor does the NIT permanently alter any software or programs on the user's computer. 92 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 93 of 99 TIMING OF SEIZUREIREVIEW OF INFORMATION 216. Rule 41 (e )(2) requires that the warrant command FBI "to execute the warrant within a specified period of time no longer than fourteen days" and to "execute the warrant during the daytime, unless the judge for good cause expressly authorizes execution at another time." After the server hosting Websites government 1-23 is seized, it will remain in law enforcement requests authority to employ the NIT onto Websites fourteen days of the Court's authorization. custody. Accordingly, the 1-23 at any time of day, within The NIT will be used on Websites 1-23 fornot more than 30-days from the date of the issuance of the warrant. 217. For the reasons above and further, because users of Web sites 1-23 communicate on the board at various hours of the day, including outside the time period between 6:00 a.m. and 10:00 p.m., and because the timing of the user's communication on the board is solely determined by when the user chooses to access the board, rather than by law enforcement, I request authority for the NIT to be employed at any time a user's computer accesses Web sites 1-23, even if that occurs outside the hours of 6:00 a.m. and 10:00 p.m. Further, I seek permission to review information transmitted to a computer controlled by or known to the government, as a result of the NIT, at whatever time of day or night the information 218. is received. The government does not currently know the exact configuration that may be used to access Websites systems, may require the government to activate properly. send communications Accordingly, 1-23. Variations in configuration, to send more than one communication of the computers e.g., different operating in order to get the NIT I request that this Court authorize the government to continue to to the activating computers for up to 30 days after this warrant is authorized. 93 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 94 of 99 219. The Government may, if necessary, seek further authorization from the Court to employ the NIT on Web sites 1-23 beyond the 30-day period authorized by this warrant. SEARCH AUTHORIZATION REOUESTS 220. Accordingly, it is respectfully requested that this Court issue a search warrant authorizing the following: a. the NIT may cause an activating computer - wherever located - to send to a computer controlled by or known to the government, network level messages containing information that may assist in identifYing the computer, its location, other information about the computer and the user of the computer, as described above and in Attachment B; b. the use of multiple communications, without prior announcement, within 30 days from the date this Court issues the requested warrant; c. that the government may receive and read, at any time of day or night, within 30 days from the date the Court authorizes of use of the NIT, the information that the NIT causes to be sent to .the computer controlled by or known to the government; d. that, pursuant to 18 U.S.C. ~ 3103a(b)(3), to satisfY the notification requirement of Rule 41 (1)(3) of the Federal Rules of Criminal Procedure, the government may delay providing a copy of the search warrant and the receipt for any property taken for thirty (30) days after a user of an "activating" computer that accessed Websites 1-23 has been identified to a sufficient degree as to provide notice, unless notification is further delayed by court order. 94 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 95 of 99 REOUEST FOR SEALING OF APPLICA TION/AFFIDA VIT 221. I further request that this application and the related documents be filed under seal. This information to be obtained is relevant to an ongoing investigation. Premature disclosures of this application and related materials may jeopardize the success of the above-described investigation. Further, this affidavit describes a law enforcement technique in sufficient detail that disclosure of this technique could assist others in thwarting its use in the future. Accordingly, I request that the affidavit remain under seal until further order of the Court.) CONCLUSION 222. Based on the information identified above, information provided to me, and my experience and training, I have probable cause to believe there exists evidence, fruits, and instrumentalities of criminal activity related to the sexual exploitation of children on computers that access Websites 1-23, in violation of 18 U.S.C. 992251 and 2252A. 223. Based on the information described above, there is probable cause to believe that the information described in Attachment B constitutes evidence and instrumentalities of these crimes. 224. Based on the information described above, there is probable cause to believe that employing a NIT on Websites 1-23, to collect information described in Attachment B, will result in the FBI obtaining the evidence and instrumentalities of the child exploitation crimes described above. The United States considers this technique to be covered by law enforcement privilege. Should the Court wish to issue any written opinion regarding any aspect of this reques~ the United States requests notice and an opportunity to be heard with respect to the issue of law enforcement privilege. 3 95 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 96 of 99 Sworn to Wlder the pains and penalties of perjury. Special Agent Sworn to and subscribed before me this '""l.'1. ':2 day ofJuly, 2013 96 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 97 of 99 ATTACHMENT A-PAGE 1 OF2 Locations to be Searched This warrant authorizes the use of a network investigative technique ("NIT') to be deployed on the computer server described below, obtaining information described in Attachment B from the activating computers described below. The computer server is the server operating the Tor network child pornography websites referred to herein as Websites 1-23, as identified by their respective Tor URLs in the following chart, which will be located at a government facility in the District of Maryland. The activating computers are those of: (I) any user or administrator who logs into any of Websites 1-23 by entering a username and password; (2) any user who accesses any section of any of Websites 1-23 where child pornography may be accessed; and (3) any user who uploads a file to any of Web sites 1-23. The government will not employ this network investigative technique after 30 days after this warrant is authorized, without further authorization. 97 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 98 of 99 ATTACHMENT A-PAGE2 Locations to be Searched Website # 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 98 OF2 Case 8:13-mj-01744-WGC Document 24 Filed 10/31/16 Page 99 of 99 ATTACHMENT Information B to be Seized From any "activating" computer described in Attachment A: I. the "activating" computer's actual IP address, and the date and time that the NIT detennines what that IP address is; 2. a unique identifier (e.g., a series of numbers, letters, and/or special characters) to distinguish data from that of other "activating" computers, that will be sent with and collected by the NIT; 3. the type of operating system running on the computer, including type (e.g., Windows), version (e.g., Windows 7), and architecture (e.g., x 86); 4. information about whether the NIT has already been delivered to the "activating" computer; 5. the "activating" computer's Host Name; 6., the "activating" computer's media access control ("MAC") address; that is evidence of violations of 18 U.S.C. U.S.C. SS 2251(d)(I) S 2252A(g), Engaging in a Child Exploitation Enterprise; 18 and or (e), Advertising and Conspiracy to Advertise Child Pornography; 18 U.S.C. SS 2252A(a)(2)(A) and (b)(1), Receipt and Distribution of, and Conspiracy to Receive and Distribute Child Pornography; and/or 18 U.S.C. S 2252A(a)(5)(B) and (b)(2), Knowing Access or Attempted Access With Intent to View Child Pornography. 99