A091 (Rev. Hill) Criminal Complaint a. titer??- UNITED STATES DISTRICT COURT for the Western District of North Carolina hit. 29 Hill? United States ofAmeriea v. Case No. 3 :i?e?ij egrm oAvao LYNN BROWNING Defendant?s) CRIMINAL COMPLAINT I, the complainant in this case, state that the following is true to the best of my knowledge and belief. On or about the date(s) of Nov 13, 2014 to March 4, 2015 in the county of Caldwell in ?rm: District of North Carolina the defendant(s) violated: Code Section. O?ense Description 18 U.S.C. 2251(d)(1) and Conspiracy to advertise child pornography. This criminal complaint is based on these facts: See attached affidavit. [El Continued on the attached sheet. Complainant ?s Signais?; Karlene Clapp. Special Agent FBI Printed name and Sworn to before me and signed in my presence. dge signature Q. City and state; Charlotte, North Carolina David Keesier, U.S. Magistrate Judge Printed name amt title Case Document 3 Filed 07/29/15 Page 1 of 14 IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF NORTH CAROLINA IN THE MATTER OF THE COIVIPLAINT AND ARREST OF: DAVID LYNN BRO Case No. AFFIDAVIT OF KARLENE CLAPP IN SUPPORT OF A COMPLAINT AND ARREST OF DAVID LYNN BROWNING I, Karlene Clapp, being duly sworn, depose and state as follows: I am a Special Agent of the FBI, assigned to the Major Case Coordination Unit Violent Crimes Against Children Section, and I am one of the case agents assigned to this investigation. 1. I am a Special Agent with the Federal Bureau of Investigation, and have been since March 2009. I am currently assigned to MCCU, Violent Crimes Against Children Section as a member of the technical squad. In that assignment I investigate complex technical cases involving the online exploitation of children, and I am trained and authorized to investigate the offenses alleged herein. Before my current assignment, I spent 5 years assigned to a Cyber Squad in the Los Angeles Field Office. In that assignment, I was responsible for investigating computer and high-technology crimes. Prior to becoming an FBI agent, I completed the 21~weel< FBI Basic Agent Training Course in Quantico, Virginia, which included training from the FBI regarding computer BROWNING COMPLAWT DATED 3; Case Document 3 Filed 07/29/15 Page 2 of 14 technology, computer fraud, intellectual property crimes, and white collar crime. I have a Bachelor?s and Master?s degrees in computer science from Manchestor College and Ball State University, respectively. Prior to my work at the FBI, I was a system administrator and web developer for a private high school in Seattle, Washington, where I maintained its network operations including security, functionality, and monitoring as necessary, and also wrote computer code for several different systems. I am an ?investigative or law enforcement of?cer? of the United States within the meaning of Section 2510(7) of Title 18, United States Code, and am empowered by law to conduct investigations of, and to make arrests for, offenses enumerated in Section 2516 of Title 18, United States Code. . I am investigating David Browning for conspiracy to advertise child pornography. As will be shown below, there is probable cause to believe that David Browning with others known and unknown, has conSpired to advertise child pornography, in violation of 18 U.S.C. 2251(d)(1) and I submit this application and af?davit in support of a complaint and arrest of David Browning. The Statements contained in this affidavit are based in part on: my own investigation; information provided by Bl Special Agents; written reports about this and other investigations that have received, directly or indirectly, from other law enforcement agents, including foreign law enforcement agencies as described below; information gathered from the service of administrative subpoenas; the results of physical and electronic surveillance conducted by federal agents; independent investigation and analysis by FBI Agents; and my experience, training and background as a Special Agent with the FBI. 1 have not included each and every fact known to me concerning this DATED 7/29/15 2 Case Document 3 Filed 07/29/15 Page 3 of 14 investigation. I have set forth only the facts that I believe are necessary to establish probable cause to believe that David Browning has violated 18 U.S.C. 2251(d)(1) and STATUTORY AUTHORITY 5. This investigation concerns alleged violations of 18 U.S.C. 2251(d)(l) and which prohibit a person from knowingly conspiring to make, print or publish, or causing to be made, printed or published, any notice or advertisement seeking or offering: (A) to receive, exchange, buy, produce, display, distribute, or reproduce, any visual depiction, if the production of such visual depiction involves the use of a minor engaging in sexually explicit conduct and such visual depiction is of such. conduct, or (B) participation in any act of sexually explicit conduct by or with any minor for the purpose of producing a visual depiction of such conduct; relating to material involving the sexual exploitation of minors. DEFINITIONS 6. The following de?nitions apply to this Af?davit: a. ?Child Pornography,? as used herein, is de?ned in 18 U.S.C. 2256(8) as any visual depiction of sexually explicit conduct where the production of the visual depiction involved the use of a minor engaged in sexually explicit conduct, the visual depiction is a digital image, computer image, or computer-generated image that is, or is indistinguishable from, that of a minor engaged in sexually explicit conduct, or the visual depiction has been created, adapted, or modi?ed to appear that an identi?able minor is engaged in sexually explicit conduct. ?7/29/15 3 Case Document 3 Filed 07/29/15 Page 4 of 14 b. ?Minor? means any person under the age of eighteen years. See 18 U.S.C. 2256(1). c. ?Sexually explicit conduct? means actual or simulated sexual intercourse, including genitalagenital, oral?genital, or oral-anal, whether between persons of the same or opposite sex; bestiality; masturbation; sadistic or masochistic abuse; or lascivious exhibition of the genitals or pubic area of any person. See 18 U.S.C. 2256(2). d. ?Visual depictions? include undeveloped film and videotape, and data stored on computer disk or by electronic means, which is capable of conversion into a visual image. See 18 U.S.C. 2256(5). e. ?Website? consists of textual pages of information and associated graphic images. The textual information is stored in a speci?c format known as Hyper?Text Mark-up Language and is transmitted from web servers to various web clients via Hyper-Text Transport Protocol f. ?Bulletin Board? means an Internet-based website that is either secured (accessible with. a password) or unsecured, and provides members with the ability to view postings by other members and make postings themselves. Postings can contain text messages, still images, video images, or web addresses that direct other members to speci?c content the poster wishes. Bulletin boards are also referred to as ?internet forums? or ?message boards.? A ?post? or ?posting? is a single message posted by a user. Users of a bulletin board may post messages in reply to a post. A message ?thread,? often labeled a ?topic,? refers to a linked series of posts and reply messages. Message threads or topics often contain a title, which is generally selected by the user who posted the ?rst message of the thread. Bulletin boards often also provide the 5i Case Document 3 Filed 07/29/15 Page 5 of 14 ability for members to communicate on a one-to-one basis through ?private messages.? Private messages are similar to e-mail messages that are sent between two members of a bulletin board. They are accessible only by the user who sent/received such a message, or by the Website Administrator. g. ?Internet Service Providers? as used herein, are commercial organizations that are in business to provide individuals and businesses access to the Internet. ISPs provide a range of functions for their customers including access to the Internet, web hosting, e-mail, remote storage, and co-location of computers and other communications equipment. ISPs can offer a range of options in providing access to the Internet including telephone based dial-up, broadband based access via digital subscriber line or cable television, dedicated circuits, or satellite based subscription. ISPs typically charge a fee based upon the type of connection and volume of data, called bandwidth, which the connection supports. Many ISPs assign each subscriber an account name - a user name or screen name, an "e-mail address,? an e?mail mailbox, and a personal password selected by the subscriber. By using a computer equipped with a modem, the subscriber can establish communication with an Internet Service Provider over a telephone line, through a cable system or via satellite, and can access the Internet by using his or her account name and personal password. h. ?Internet Protocol address? or address? refers to a unique number used by a computer to access the Internet. IP addresses can be ?dynamic,? meaning that the ISP assigns a different unique number to a computer every time it accesses the Internet. IP addresses might also be ?static,? if an ISP assigns a user?s computer a particular 1P ?/253f15 53 Case Document 3 Filed 07/29/15 Page 6 of 14 address which is used each time the computer accesses the Internet. IP addresses are also used by computer servers, including web servers, to communicate with other computers. PROBABLE CAUSE 7. There is probable cause to believe that David Browning is a member of an online community of individuals who regularly advertise, send and receive child pornography via a Website, which is described below and referred to herein as ?Website There is probable cause to believe that David?Lynn Browning is one of the moderators of ?Website and that he conspired with others known and unknown to advertise child pornography on ?Website in violation of 18 U.S.C. 2251(d)(l) and 8. ?Website was a child pornography bulletin board and website dedicated to the advertisement and distribution of child pornography, and discussion of matters pertinent to the sexual abuse of children, including the safety and security of individuals who seek to sexually exploit children online. From on or about August 2014 until on or about February 20, 2015, ?Website was physically hosted on servers in Lenoir, North Carolina, in the Western District of North Carolina. As such, all of the posting activity on the site, including its administration and the advertisement and distribution of child pornography, occurred in the Western District of North Carolina. After successfully registering and logging into the site, a user can assess any number of sections, forums, and sub-forums that contain and/ or provide links to toddler, prepubescent, and pubescent 1 The actual name of ?Website is known to law enforcement. Disclosure of the name of the site would potentially alert its members to the fact that law enforcement action is being taken against the site and its users, potentially provoking members to notify other members of law enforcement action, flee, and/or destroy evidence. Accordingly, for purposes of the con?dentiality and. integrity of the ongoing investigation involved in this matter, speci?c names and other identifying factors have been replaced with generic terms and the website will be identi?ed as ?Website BROWMNG DATED ?ii/2W1?? 6 Case Document 3 Filed 07/29/15 Page 7 of 14 10. child pornography that depict boys and girls, and which include depictions of sexual intercourse. Users also may exchange private messages with each other. A review of the various topics within these forums revealed that each topic contains a title, the author, the number of replies, the number of views, and the last post. The ?last post? section includes the date and time of the post as well as the author. Upon accessing a topic, the original post appears at the top of the page, with any corresponding replies to the original post included in the post thread below it. Typical posts appear to contain text, images, thumbnail-sized previews of images, compressed ?les, links to external sites, or replies to previous posts. Moderator?1 on ?Website ?Website had one primary administrator (hereinafter ?Administrator-1?) and two additional administrators (hereinafter ?Administrator?2? and "Administrator?3") chosen by Administrator-1. Administrators of Bulletin Board Websites essentially run the site by: handling the technical needs of the site, hosting the site, developing and enforcing the rules of the site, admitting new members, and deleting existing members, among other tasks. In addition to a team of administrators, ?Website had a team ofusers who served as moderators. Moderators of ?Website were chosen by the administrators of ?Website ?Website moderators had responsibilities which included deleting content deemed to be off-topic or inappropriate, moving content to the appropriate forum if it was posted in the wrong location, and banning users for Violating the rules of ?Website Moderator?1 was a. Global Moderator of ?Website indicating that he had moderation powers on all forums contained within ?Website ssewnrne camaraisr earns mails Case Document 3 Filed 07/29/15 Page 8 of 14 11. As of the time when ?Website was taken of?ine on or about March 4, 2015, 13. Moderator-1 had made over 1,000 posts on ?Website sent over 140 private messages on ?Website and received over 180 private messages on ?Website According to data seized from the server hosting "Website between November 13, 2014 and March 4, 2015, Moderator-1 spent over 700 hours logged in to ?Website Moderator-1 was most active in the ?General Discussion?, ?Girls and ?Administration? forums of ?Website with over 400, 160, and 130 posts respectively in each forum. Moderator-1 was heavily involved in the day to day operations of ?Website Examples of postings made by Moderator?1 on ?Website that demonstrate Moderator? 1 performing the duties of a moderator follow: On March 3, 2015, Moderator-1 replied to a thread entitled, Tessie?s Introduction Video? and stated, edited the title to include ?Toddler those that don?t care for kids that young will simply ignore the thread now.? . According to data seized from the server hosting "Website on February 27, 2015, Moderator-1 moved a thread entitled, ?8yo girl caught showing pussy/ass? from the forum ?Girls to the section ?Webcams Girls?. On February 26, 2015, Moderator-1 moved a thread entitled, ?Sexy Kid? from the forum ?Girls to the section ?Webcams Girls?. . On February 24, 2015, Moderator-1 created a thread entitled, ?Javascript. ENABLE in the forum ?General Discussion?. In the thread, Moderator-1 provided information to users of ?Website that would help users of?Website avoid detection by law enforcement. Moderator~1 stated, 8 Case Document 3 Filed 07/29/15 Page 9 of 14 "It's amazing how many times I have to deal with a post that has been reported by a member that has a link requiring javascript. And above how many people have tahnked the GP for the that they have actually emabled script to see people?? Based on my training and experience, I know that this post is a reference to previous attempts by law enforcement to identify users of "the network? utilizing javascript. I believe Moderator?l is providing this information in an effort to encourage "Website users to disable javascript in their web browsers. e. On February 21, 2015, Moderatonl replied to a thread entitled, ?kids getting fucked? which was created by ?Website user ?darkmoonl?. User ?darkmoonl? stated that he was ?looking for vids of very young girls getting ?icked in there pussy?s, ages 1-10 preferred?. In his reply to the thread, Moderator-l provided the name of a series of images that are known to your af?ant as ones that depict a prepubescent female, hereinafter who appears to be under the age of 10 being vaginally penetrated by an adult male?s penis and ejaculated on. The information provided by Moderator~l would have allowed ?darkrnoonl? or any other user of ?Website to search the content of?Website and find images and videos of f. On February 3, 2015, ?Administrator 2? created a thread in the forum ?Administration? entitled, ?Logo Contest?. Moderator-l replied to the thread several times between February 3, 2015 and March 2, 2015. An image posted by Moderator?l was eventually selected by the administration team of ?Website to be the new logo for ?Website The logo is the one seawater-3 Darth: ?:7/29/133 9 Case Document 3 Filed 07/29/15 Page 10 of 14 previously described in this af?davit that depicts a prepubescent female posing in a suggestive manner. g. On February 12, 2015, Moderator-l replied to a thread entitled, ?File Host?, and stated, ?Whenever 1 archive a ?le, I set a password AND check the box to the ?le. . 14. In addition to posts regarding the administration of ?Website many site posts by 15. Moderator-l contained child pornography. For example, on January 20, 2015, Moderator-1 created a thread entitled ?YonNow Brooke Brand New Clip (File Links Updated),? in the forum ?Webcams Girls?. The thread contained, among other things, a hyperlink to a set of 16 images that appeared to depict two prepubescent females. By clicking on the link and downloading the images, an FBI Agent observed that three of the images are focused on the exposed, nude genitals and anus of one of the prepubescent females who can be seen using her ?ngers to spread her genitals open. in two of the images. The image set has a caption indicating that it was generated from a video which was approximately 19 minutes and 56 seconds in duration. The thread created by Moderator?1 contained what purported to be a link to the full video. It was not available when FBI Agents attempted to download it. The image set was recovered and is being maintained as evidence. The image set was hosted on an external website. I Identification of David Browning as Moderator?1 on ?Website In November 2014, a website that operated within f?the Network", referred to herein as "Website was seized by a foreign law enforcement agency (FLA) acting independently and according to its own national laws. The purpose of "Website 2? was the advertisement and diSSemination of child pornography. On March 13, 2015, an FBI BATED ?/29f133 10 Case Document 3 Filed 07/29/15 Page 11 of 14 l6. 17. Agent acting in an undercover capacity accessed "Website 2" and made the following observations: Upon accessing "Website an undercover FBI Agent logged into the site using an undercover account and password. After successfully logging into the site, the undercover Agent observed a chat window, which listed users currently in the chat room on the left side of the page and recent messages posted by these users to the right of their usernames. Members of the site were listed at the top of the page. Member and user names were highlighted in various colors. A user existed on "Website who was a moderator of "Website In April 2015, the FLA provided to the FBI communications from "Website 2" that indicated that the moderator from ?Website 2? was the same individual as Moderator-l on ?Website For example, in a private communication between the moderator of "Website "2 and another user of "Website the moderator stated in reference to ?Website ?You do know that I?m there as Moderator-1, right?? During the course of its investigation, FLA obtained an IP Address for the moderator of ?Website FLA advised the FBI that in December 20l4, acting independently and according to its own national laws, FLA provided Moderator-l with a hyperlink to a streaming video. The hyperlink was advertised as a preview of a child pornography website with streaming video. When a user clicked on that hyperlink, the user was advised that the user was attempting to open a video file from an external website. If the user chose to open the file, a video file containing images of child pornography began to play, and the FLA captured and recorded the IP address of the user accessing the file. FLA configured the video ?le to open an Internet connection outside of the Network software, thereby allowing FLA to capture the user?s actual IP address, as well as a COMFLAENT DATED 11 Case Document 3 Filed 07/29/15 Page 12 of 14 18. 19. 20. 21. session identi?er to tie the IP address to the activity of a particular user account. The IP Address identi?ed by the FLA, 184.60.235.37 on December 2, 2014 at 02:26 UT C, was owned by TDS Telecom. TDS Telecom responded to a subpoena and identi?ed as subscribers, Martha Browning Davidson and Seldon Davidson, 922 Saw Branch Road, Wooten, KY 41776 with billing address Post Office Box 214, Wooton, KY 41776. This account was initiated on 10/ 16/2014. 15, a federal search warrant issued by United States Magistrate Judge Hanley A. Ingram was executed at 922 Saw Branch Road, Wooten, KY 41776. During I the execution 'of the search warrant, FBI Special Agents interviewed David Browning. Before the interview, Browning was read his statutory warning and he acknowledged that he understood his rights. During the interview, Browning indicated to agents that he resided at 922 Saw Branch Road, Wooton, KY 41776. Browning further indicated that he was Moderator?l on Website A. Based on the information provided in the preceding paragraphs, your afliant believes that David Browning was Moderator-1 on Website A, and that be moderated Website A from his residence in Wooton, KY. CONCLUSION Based on the aforementioned factual information, your af?ant respectfully submits that there is probable cause to believe that David Browning did conSpire to advertise child pornography with others known and unknown on Website A in violation of 18 U.S.C. 2251(d)(1) and CUMPLAENT DATED 12 Case Document 3 Filed 07/29/15 Page 13 of 14 22. Your af?ant, therefore, respectfully requests that the attached warrant be issued authorizing the arrest of David Browning. ?ne Cp Special Agent Federal Bureau of Investigation Sworn and subscribed before me this 29th day of July, 2015. AGISTRATE JUDGE aaowmne Cometaim - :3 Case Document 3 Filed 07/29/15 Page 14 of 14