1 Case Document 1 Filed 06/29/15 Page 1 of 16 A0 106'6Rev. Oli09) Application fora Search Warrant I .1 . I I UNITED STATES DISTRICT COU _If0rthe . Southern District of California JUN 23.9 2015 - In the Matter of the Search of (Brie?y describe the property to be searched or infertth the person. by Mamie and address) Samsung Smart TV, located at HSI. 185 West St. San Diego, CA CLERK. 5 ms?" SOUTHH armor COURT BY tJleFttoTOF Camotwm Case No. DEPUTY I Tedd-1985 APPLICATION FOR A SEARCH WARRANT I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under penalty of perjury that I have reason to believe that there is now concealed on the following person or property located in the Southern District of California (identij the person or describe property to be searched and give its iocation): Attachment A I The person or property to be searched, described above, is believed to conceal (idem:ij the person or describe the property to be seized): Attachment The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): [Bi evidence of a crime; (Bf contraband, fruits of crime, or other items illegally possessed; [If property designed for use, intended for use, or used in committing a crime; a person to be arrested or a person who is unlawfully restrained. The search is related to a violation of 18 U.S.C. 2252 and the application is based on these facts: Rf Continued on the attached sheet. El Delayed notice of days (give exact ending date if more the is requested under 18 U.S.C. 3103a, the basis of which is set forth on the a Appiicant?s Signature Anthony Rios, Special Agent, HSI Printed name and title Sworn to before me and signed in my presence. Date: (- ta Judge ?3 ignature City and state: San Diego, CA Hon. Mitchell D. Dembin, U.S. Magistrate Judge Printed name and title Case Document 1 Filed 06/29/15 Page 2 of 16 AFFIDAVIT IN SUPPORT OF APPLICATION FOR SEARCH WARRANT 1, Special Agent Anthony Rios, upon being duly sworn do hereby state that the following is true to my knowledge and belief: I. I am a Special Agent with Homeland Security Investigations (HSI) and have been so. employed since May 2007. Prior to employment with HSI, I earned a Bachelor of Arts degree in Political Science from the University of California, Irvine. I am currently assigned to the H81 San Diego Cyber Crimes Group and am a member of the San Diego Internet Crimes Against Children (ICAC) Task Force. I have experience and have received training in the areas of alien smuggling, human . trafficking, money laundering, narcotics interdiction and cybercrimes investigations. I also have experience in obtaining and executing arrest and search warrants. As part of my current duties, I investigate criminal violations relating to child exploitation and child pornography including violations pertaining to the illegal production, distribution, receipt, and possession of child pornography, in violation of Title 18 U.S.C. 2251 and 2252. Additionally I have had the opportunity to observe and review numerous examples of child pornography (as defined in 18 U.S.C. 2256) in various forms of media, including computer media, and I have participated in the execution of numerous search and arrest warrants. 2. This af?davit is offered in support of an application by the United States of America for a warrant to search and seize the items described in Attachment A for evidence in violations of Title 18, U.S.C. 2252, relating to material involving child pornography. 18 U.S.C. 2252 prohibits a person from knowingly possessing or accessing sexually explicit images (child pornography) with the 1 Case Document 1 Filed 06/29/15 Page 3 of 16 intent to view them as well as transporting, receiving, distributing, or possessing in interstate or foreign commerce, or by using any facility or means of interstate or foreign commerce, any visual depiction of minors engaging in sexually explicit conduct (child pornography). 3. I This af?davit is based upon information I have gained through training and experience, as well as upon information related to me by other individuals, including law enforcement officers. Since this af?davit is being submitted for the limited purpose of securing a search warrant, I have not included each and every fact known concerning this investigation but have set forth only the facts that I believe are necessary to establish probable cause to believe'that evidence relating to violations of Title 18, U.S.C. 2252, described in Attachment B, is located in the items described in Attachment A. 4. Based upon the following information, I believe there is probable cause to believe that currently located within the above?described items (Attachment A) there is evidence, fruits and instrumentalities of traf?cking, receipt, distribution, manufacture and/or possession of visual depictions, and other related materials, involving minors engaging in sexually explicit conduct (child pornography), in violation of Title 18 U.S.C. 2252, more particularly described in Attachment B. FACTS IN SUPPORT OF PROBABLE CAUSE 5 On or about December 14, 2009, Mikhail Feldman was sentenced in the Southern District of California (Case Number: after pleading guilty to violating 18 U.S.C. 2252(a)(4)(B), Possession of images of minors engaged in sexually explicit conduct. Feldman was sentenced to37 months Feldman?s residence to verify his compliance with the conditions of his supervised Case Document 1 Filed 06/29/15 Page 4 of 16 custOdy and a supervised release term of ?ve years, to begin upon his release from imprisonment. 6. On or about June 17, 2015, while Feldman was on supervised release forth above conviction, United States Probation Of?cers conducted a search of release. During the search of the residence located at 7866 Camino Aguila, San Diego, CA 92122, probation of?cers found Feldman in possession of an Model: Z431, Serial No: 322322171831, IMEI: 861831001717277, with internet access. A condition of Ffeldman?s supervised cellular telephone, release is not to use or possess devices which can communicate data via a modem or dedicated connection and may not have access to the Internet without prior approval from the court or the probation of?cer. 7. Probation of?cers also found several items of contraband and evidence of conduct violating the terms of Feldman?s supervised release. These items include a Samsung Smart Television (with internet access), Model: UN46F6350AF, Serial No: a Toshiba Satellite laptop, Model: 07lOlJ, Serial No: an HP Pavilion laptop, Model: DV9910US, Serial No: an LG cellular telephone, Model: Serial No: an Olympus digital camera, Model: 04000 Zoom, with a Sandisk SDSM 128MB card; and multiple non-commercial compact discs (CDs). United States Probation Of?cers took custody of the aforementioned. items. 8. Feldman told probation of?cers that he currently views adult and?child pornography on the Samsung Smart Television via the internet. The Samsung 3 Case Document 1 Filed 06/29/15 Page 5 of 16 Smart Television was located in the living room of the residence. Feldman also stated that he has been watching adult and child pornography since his release from federal custody. Feldman stated that he watches pornography on a weekly basis, usually late at night when his family members are sleeping. Feldman stated that he has accessed pornography using the search engine ?Googlef? on the . Samsung' Smart Television, and has an interest in boys and girls, ages 6-13. During the search, probation of?cers observed a filename or title referring to nudist children, in the web browser history of the Samsung Smart Television. 9. Probation offiCers stated that this is Feldman?s fourth failed attempt on supervised release as he has had three prior violations of supervised release. Feldman has not been permitted to have or use a computer, cell phone, or any device with internet access without prior approval of the probation of?cer. PROCEDURES EOR ELECTRON ICALLY STORED INFORMATION AS TO THE COMPUTER AND OTHER ELECTRONIC STORAGE DEVICES 10. With the approval of the Court in signing this warrant, agents executing this search warrant will employ the following procedures regarding computers and other electronic storage devices, including electronic storage media that may contain data subject to seizure pursuant to this warrant: Seizure and Retention of Instrumentalities a. Based upon the foregoing, there is probable cause to believe that any computers and other electronic storage devices encountered during this search are instrumentalities of the enumerated offenses because 4 Case Document 1 Filed 06/29/15 Page 6 of 16 . The offsite imaging and preliminary analysis of computers, other there is probable cause to believe" that they may contain contraband and ??uits of crime as provided under Rule Fed. R. Crim. P., or were used in committing crime as provided under Rule Fed. R. Crim. P. Consequently, the computers and any other electronic storage devices are subject to seizure, retention and possible forfeiture and destruction. computers, other electronic storage devices and media con?rmed onsite to contain contraband constitute fruits of crime or to have been used to commit a crime will not be returned but will be imaged. offsite and analyzed as provided beginning at subparagraph (0) below. The onsite con?rmation may be provided by an owner or user of the computer or storage device or, if feasible, may be obtained by conducting a limited onsite forensic examination to determine if the subject media contains any contraband or otherwise is an instrumentality. Computers and other electronic storage devices and media that are not con?rmed onsite as instrumentalities will be taken offsite for imaging and preliminary analysis in accordance with subparagraph below. electronic storage devices and media to con?rm their status as instrumentalities will be conducted within forty five (45) days of seizure. Seized items con?rmed to be instrumentalities will not be returned and will be further analyzed as provided below. If the preliminary analysis, by de?nition an incOmplete or partial analysis, does not con?rm that a seized item is an instrumentality, the original item will be returned to its owner, absent an extension of 5 Case Document 1 Filed 06/29/15 Page 7 of 16 time obtained from the owner or from the court. An image of the items will be retained and subjected to a complete forensic analysis, as provided below. 0. Computers and other electronic storage devices and media that are retained as instrumentalities will not be returned to its owner. The owner will be provided the name and address of a responsible of?cial to whom the owner may apply in writing for return of specific data not otherwise subject to seizure for which the owner has a speci?c need. The identified of?cial or other representative of the seizing agency will reply in writing. In the event that the owner?s request is granted, arrangements will be made for a copy of the requested data to be obtained by the owner. If the request is denied, the owner will be directed to Rule 41(g), Fed. R. Crim. P. Identi?cation and Extraction of Relevant Data d. A forensic image is an exact physical copy of the hard drive or other media. After obtaining a forensic image,'the data will be analyzed to identify and extract data subject to seizure pursuant to this warrant. Analysis of the data following the creation of the forensic image can be a highly technical process requiring specific expertise, equipment and software. There are literally thousands of different hardware items and software programs, and different versions of the same program, that may be commercially purchased, installed and custom? con? ured on a user?s com uter stem. Com uters are easil Case Document 1 Filed 06/29/15 Page 8 of 16 customized by their users. Even apparently identical computers in an of?ce environment may be signi?cantly different with respect to con?guration, including permissions and access rights, passwords, data storage and seCurity. It is not unusual for a computer forensic examiner to have to obtain specialized hardware or software, and train with it, in order to view and analyze imaged data. e. Analyzing the contents of a computer or other electronic storage device, even without signi?cant technical issues, may be very challenging. Searching by keywords, for example, often yields many thousands of hits, each of which must be reviewed in its context by the examiner to determine whether the data is within the scope of the warrant. Merely ?nding a relevant hit does not end the review. process. The computer may have stored information about the data at issue: who created it; when and how it was created or downloaded or copied; when it was last accessed; when it was last modi?ed; when it was last printed; and, when it was deleted. Sometimes it is possible to recover an entire document that never was saved to the hard drive if the document was printed. Moreover, certain ?le formats do not lend themselves to keyword searches. Keywords search text. Many common electronic mail, database and spreadsheet applications do not store data as searchable text. The data is saved in a proprietary non?text format. Documents printed by the computer, even if the document never was saved to the hard drive, are recoverable by forensic programs but not discoverable by keyword searches because the printed document is stored by the computer as a graphic image 7 Case Document 1 Filed 06/29/15 Page 9 of 16 and not as text. Similarly, faxes sent to the computer are stored as graphic images and not as text. In addition, a particular relevant piece of data does not exist in a vacuum. To determine who created, modi?ed, copied, downloaded, transferred, communicated about, deleted or printed the data requires a search of other events that occurred on the computer in the time periods surrounding activity regarding the relevant data. Information about which user had logged in, whether users share passwords, whether the computer was connected to other computers or networks, and whether the user accessed or used other programs or services in the time period surrounding events with the relevant data can help determine who was sitting at the keyboard. f. It is often dif?cult or impossible to determine the identity of the person using the computer when incriminating data has been created, modified, accessed, deleted, printed, copied, uploaded or downloaded solely by reviewing the incriminating data. Computers generate substantial information about data and about users which generally is not visible to users. Computer?generated data, including registry information, computer logs, user pro?les and passwords, web- browsing history, cookies and application and operating system metadata, often provides evidence of who was using the computer at a relevant time. In addition, evidence such as electronic mail, chat sessions, photographs and videos, calendars and address books stored on the computer may identify the user at a particular, relevant time. The manner in which the user has structured and named ?les, run or 8 Case Document 1 Filed 06/29/15 Page 10 of 16 accessed particular applications, and created or accessed other, non- incriminating ?les or documents, may serve to identify a particular user. For example, if an incriminating document is found on the computer but attribution is an issue, other documents or files created around that same time may provide circumstantial evidence of the identity of the user that created the incriminating document. g. Analyzing data has become increasingly time-consuming as the - volume of data stored on a typical computer system and available storage devices has become mind?boggling. For example, a single megabyte of storage space is roughly equivalent of 500 double? spaced pages of text. A single gigabyte of storage space, or 1,000 megabytes, is roughly equivalent of 500,000 double-spaced pages of text. Computer hard drives are now being sold for personal computers capable of storing up to 2 terabytes (2,000 gigabytes) of" data. And, this data may be stored in a variety of formats or (several new cemmercially available operating systems provide for automatic of data upon shutdown of the computer). The sheer volume of data also has extended the time that it takes to analyze data. Running keyword searches takes longer and results in more hits that must be individually examined for relevance. And, once reviewed, relevant data leads to new keywords and new avenues for identifying data subject to seizure pursuant to the warrant. 11. Case Document 1 Filed 06/29/15 Page 11 of 16 h. Based on the foregoing, identifying and extracting data subject to data will complete the analysis Within one-hundred twenty (120) days Based upon my experience and training, and the experience and training of other agents with whom I have communicated, electronically stored data can be permanently deleted or modi?ed by users possessing basic computer skills. In this case, no genuine risk of destruction of evidence exists as the property to be searched is already in the custody of law enforcement personnel. seizure pursuant to this warrant may require a range of data analysis techniques, including the use .of hashing tools to identify evidence subject to seizure pursuant to this warrant, and to exclude certain data . from analysis, such as a known operating system and application ?les. The identi?cation and extraction process may take weeks or months. The personnel conducting the identi?cation and extraction of from the date of seizure pursuant to this warrant, absent further application to this court. All forensic analysis of the imaged data Will employ search protocols directed exclusively to the identi?cation and extraction of data within the scope of this warrant. GENUINE RISKS 0F DESTRUCTION OF DATA 10 Case Document 1 Filed 06/29/15 Page 12 of 16 PRIOR ATTEMPTS TO OBTAIN DATA 12. The United States has not attempted to obtain this data by other means except where otherwise described above. REQUEST FOR SEALING 13. It is further respectfully requested that this Court issue an Order sealing, with disclosure permitted to defendant?s counsel pursuant to an early disclosure agreement or Rule 16, Fed. R. Crim. P. or until further order of this court, all papers submitted in support of this Application, including the Application, Af?davit, Attachments and Search Warrant, and the requisite inventory notice. Sealing is necessary because the items and information to be seized are relevant to an ongoing investigation and premature disclosure of the contents of this af?davit and related documents may have a negative impact on this continuing investigation and may jeopardize its effectiveness. 11 Case Documentl Filed 06/29/15 Page 13 of 16 CONCLUSION 14. Based on the aforementioned factual 'informatiOn, I respectfully submit that there is probable cause to believe that evidence, fruits, and instrumentalities of" such criminal offenses may be located on items described in Attachment A, ili Violation of 18 U.S.C. 2252. I, therefore, respectfully request that the attached warrant be issued authorizing the search and seizure of the items listed in Attachment B. Anthony Rios, Special Agent, HSI Subscribed and sworn to before me this a day of June, 2015. Ho?h. Mitchell D. Dembin United States Magistrate Judge 12 Case Document 1 Filed 06/29/15 Page 14 of 16 ATTACHMENT A ITEM TO BE SEARCHED One Samsuhg Smart TV Model No: UN46F6350AF Serial No: Z6PR3CVDA03513D This item is currently secured at the Homeland Security Investigations, San Diego of?ce, located at 185 W. Street, Suite 600, San Diego, CA 92101. Case Document 1 Filed 06/29/15 Page 15 of 16 ATTACHMENT ITEMS TO BE SEIZED Authorization is sought to search for and seize evidence that relates to the. violation of Title 18, United States Code, Section 2252. This authorization includes the search of physical documents and includes electronic data to include deleted data, remnant data and slack space. The seizure and search of computers and computer media will be conducted in accordance with the ?Procedures For Electronically Stored Information? provided in the af?davit submitted in support of this warrant. Items to be seized include the fellowing: a. All documents, including all temporary and permanent electronic ?les and records, (including, but not limited to, JPG, GIF, TIF, AVI, WAV and MPEG files) which contain, attach, or describe child pornography or visual depictions of minors engaged in sexually explicit conduct, as de?ned in 18 U.S.C. 2256. I b. User?attribution data to include data re?ecting who used or controlled the computer/ electronic storage device at or around the time that data re?ecting criminal activity within the scope of this warrant was created, accessed, deleted, modi?ed, copied, downloaded, uploaded or printed. User?attribution data includes registry information, computer logs, user pro?les and passwords, web-browsing. history, cookies, electronic mail stored on the computer or device, electronic address books, calendars, instant messaging logs, electronically-stored photographs and video, ?le structure and user-created documents, including metadata. Case Document 1 Filed 06/29/15 Page 16 of 16 thaw?which sari ep1 written materials dealing with child pornography, sexual abuse of children, incest, child prostitution, diaries and/or fantasy writings about the sexual exploitation of children. d. Any record or document that shows the offer to transmit or receive any depictions of a minor engaged in sexually explicit conduct, as defined in Title 18, United States Code, Section 2256. I e. Electronically stored communications or messages re?ecting computer on?line chat sessions or e-mail messages with any persons regarding the possession, receipt, distribution, and/or reproduction of child pornography, as defined in Title 18, United States Code, Section 2256. f. For any computer hard drive or other electronic media found to contain information otherwise called for by this warrant: (1) Evidence of software that would allow others to control the COMPUTER, such as viruses, Trojan horses, and other forms of malicious software; (2) Evidence of the lack of such malicious software; (3) Evidence of the attachment to the COMPUTER of other storage devices, disks, CD-ROMS, or similar containers for electronic evidence; and g. Information relating to the install date of the computer(s) operating system, presence of ?le-sharing programs (including install date, whether the program was set up for sharing, etc. or other programs for distribution of electronic ?les including for child pornography or visual depictions of minors engaged in sexually explicit conduct, as defined in 18 U.S.C. 2256.