Case 1:16-cr-00128-TSE Document 2 Filed 04/04/16 Page 1 of 18 PageID# 2

I

?
p

L

E

APR = 4 2016

IN THE UNITED STATES DISTRICT COURT
FOR THE EASTERN DISTRICT OF VIRGINIA

CLERK, U.S. DISTRICT UUUHiAlexandria Division

Al FXAND'^IA VIRGINIA

UNITED STATES OF AMERICA
V.

EDWARD PARSON

a.k.a. "Danny,"
Case No. 1:16-MJ-142
ALLAN CORTEZ

a.k.a "Max,

Filed Under Seal

and
JEFFERY VAN DYKE

a.k.a. "jjaayy"
Defendants

AFFIDAVIT IN SUPPORT OF A CRIMINAL COMPLAINT
AND ARREST WARRANTS

I, Daniel J. Johns, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND

1.

This affidavit is submitted in support of a criminal complaint and arrest warrant

charging defendants EDWARD PARSON, ALLAN CORTEZ and JEFFERY VAN DYKE with
Conspiracy to Produce Child Pornography, in violation of 18 U.S.C. §§ 2251(a) and (e).
2.

I am a Special Agent with the Federal Bureau of Investigation ("FBI"), duly

appointed according to law and acting as such. I have been so employed by the FBI since March

of2007. Currently, I am assigned to the Violent Crimes Against Children Section, Major Case
Coordination Unit, where I am responsible for conducting and assisting in investigations involving
child pornography and the sexual exploitation of children. I have gained experience through

training and work related to conducting these types of investigations. During my career, I have

n\

 Case Document 2 Filed 04/04/16 Page 2 of 18 Page D# 3

participated in investigations involving international terrorism members, narcotics traf?ckers,
human traf?cking organizations, and persons who produce, distribute, and possess child
pornography.

3. This af?davit is based on my personal observations during the course of this
investigation, information conveyed to me by other law enforcement of?cials, my review of
records, documents, and other physical evidence obtained during this investigation, and interviews
of witnesses. This af?davit contains information necessary to support a ?nding of probable
cause, but does not include each and every fact observed by me or known by the government.

PROBABLE CAUSE

4. The FBI is investigating a group of individuals who operated two similar websites,
(MyVlog) and (SOWYD), which were designed to trick
children, primarily between the ages of 7 and 16, into engaging in sexually explicit activity on web
cameras. Unbeknownst to the children, the live web camera video was secretly recorded by the
websites, and those videos were available for download by some members of the websites.

5. The FBI investigation recovered a copy of the servers hosting SOWYD, including
logs of the IP addresses of the members who accessed the websites. Using these logs and other
investigative techniques discussed below, the FBI located and executed federal search warrants at
the residences of Jeffery VAN DYKE, Edward PARSON, and Allan CORTEZ. Evidence
obtained from those search warrants and interviews conducted during their execution show that
these individuals conspired to produce child pornography on MyVlog and SOWYD.

Investigation of MyVlog

6. On September 9, 2014, the FBI arrested a subject (81) on charges related to his use

Case Document 2 Filed 04/04/16 Page 3 of 18 Page D# 4

of a website that facilitated the sexual abuse of minors and the production and traf?cking of child
pornography. Following his arrest, 81 consented to being interviewed by law enforcement
agents. During the interview, 81 admitted to accessing, using, and distributing child pornography
on that website. 81 also stated that an individual (S2) alerted to the existence of another
website Where individuals commonly enticed minors to engage in sexually explicit conduct via
web camera. Sl told investigators that, although 82 had invited him to join this website, 81 had
declined. .

7. SI consented to allow the FBI to assume his online identity on an Intemet~based
instant messaging service On September 9, 2014, an undercover agent with the FBI 
(hereinafter began communicating using 81 ?3 online identity on the IMS. On
September 12, 2014, using Sl?s online identity on the IMS, the UCA engaged in online
communications with two individuals (S2 and S3) regarding the website MyVlog.

8. During the course of communications with S2 and S3, the UCA determined that S3
was an administrator of MyVlo g. In subsequent online communications, S3 encouraged the UCA
to create an account at MyVlog. SB explained to the UCA that MyVlog contained both public and
private areas. According to S3, the public area of MyVlog contained no child pornography and
was not very active and was ?really just cover for the private side of the site.? S3 explained to the
UCA that children were lured to the site from other social media websites. S3 stated that MyVlog
users adopted the persona of male and female children, aged 10 to 16, when chatting with children.
S3 said that most of their personas were female and that they needed good pre-recorded videos to
match their ?characters.?

9. The UCA created an account and logged into MyVlog on various dates and times

Case Document 2 Filed 04/04/16 Page 4 of 18 Page D# 5

between September 17, 2014, and September 24, 2014. Upon initially visiting MyVlog,- the UCA
was provided with two options: ?New? and ?Login.? Once the UCA created an account, he/she
could visit several chat room areas. Chat rooms were designed to show ?logged in? or active
users on the left column, with a large chat screen taking up the remainder of the screen. Within
the chat screen, users could engage in text conversations with any other users present. Within the
main chat room, there was also an option to enter additional chat rooms. The UCA determined
that these rooms could be created by any user with an account to MyVlog. In chatrooms, users
were able to communicate via text and to broadcast images and videos via their web-camera.

10. S3 told the UCA that he would upgrade the account. Upon logging in after
that conversation, the UCA observed new Options:

a. ?Create a link? allowed the UCA to generate a link to MyVlog. A person who
clicked on the click would be directed into a hidden chatroom?on MyVlog.

b. ?Private Hidden? allowed an upgraded user to login and enter the chat area While
invisible to other users. A ?private hidden? user was not able to interact with the
other users, but was able to view all video being broadcast and enter all chat rooms
without being seen. The UCA was able to View text, video, and audio
communications while using the ?private hidden? function.

e. The ?lounge? was an area on the private, hidden side of the site. Upgraded users
could access the lounge and would be noti?ed when a minor had been linked in to
the site. The noti?cation provided the minor?s screen name for MyVlog, room
location, and geographic location by city and state. In the lounge, the users

discussed what was occurring in the chatrooms, including tactics for enticing

Case Document 2 Filed 04/04/16 Page 5 of 18 Page D# 6

minors to engage in sexual activity.

11. On September 17, 2014, the UCA logged into MyVlog. Because the 
account had been ?upgraded? by S3, the UCA was able to surreptitiously view all of the user
activity being conducted on MyVlog. Among other things, the UCA observed MyVlog users
persuading apparent minors to engage in sexually explicit behavior on web cameras. In one
instance, the UCA observed an exchange between a MyVlog user posing as a minor and a user
who appeared to be an actual minor. By streamng a video of a minor inserting her ?ngers into
her vagina, the MyVlog user was able to convince the actual minor to remove her underwear and
expose her vagina. Based upon my training and experience, the child appeared to be
prepubescent because she had undeveloped breasts and no pubic hair, and the minor has been
identi?ed as a 13-year-old female. The minor was seemingly unaware that her web camera
activity was both viewable by multiple MyVlog users and being recorded.

Investigation of SOWYD

12. On September 24, 2014, the UCA again attempted to access MyVlog, but found
that the website was not functioning. The UCA contacted S3 on the IMS, and S3 told the UCA
that the website was down because it had been ?hacked.? In subsequent communications through
the IMS, S3 informed the UCA that the hacker may have gained access to many of the MyVlog
?les and that, as a security precaution, S3 had ?wiped? the server on which MyVlog was hosted.
S3 advised the UCA that S3 would create a new website, stating ?when the site comes back, it will
be a new name, new domain, new software.?

13. On October 15, 2014, the UCA and S3 communicated online via the IMS. S3

provided the UCA with the web address for the new website and advised that, although S3 was still

Case Document 2 Filed 04/04/16 Page 6 of 18 Page D# 7

in the process of ?debugging? the new website, the UCA could create an account on it. Based on
the investigation+including multiple communications with SB?it was apparent that S3 was
designing the new website to facilitate the sexual exploitation of children in the same manner as
MyVlog.

I 14. . The UCA logged into SOWYD on multiple occasions between October 15, 2014,
and November 4, 2014. The site appeared to operate in the same manner as MyVlog with only
slight differences. The UCA notified S3, via the IMS, that he/she had created an account on
SOWYD. At next login, the UCA was able to view a structure similar to what was seen on
MyVlog, including the following options: Enter, Make Private Room, Join Private Room, Log
out, Create a link, Join Lounge, Public Hidden, and Private Hidden.I

15. On October 28, 2014, the UCA logged into SOWYD and observed a user streaming
a child pornography video that depicted a female child who lowered her underwear and exposed
her vagina. The child appeared to have undeve10ped breasts and no pubic hair. Based upon my
training, experience and previous observations, the child appeared to be under the age of ?fteen.

16. On October 29, 2014, the UCA logged into SOWYD and engaged in a
conversation with S3. S3 indicated to the UCA that the new website would be functional to all
members beginning on October 31, 2014.

17. On November 3, 2014, while logged into SOWYD and utilizing the private hidden
?mction, the UCA observed a female minor expose her breasts, remove her underwear and

manipulate her vagina. The child appeared to have undeveloped breasts and no pubic hair. That

 

lUnlike on MyVlog, all users, whether logged in as public or private, were viewable in the lounge.
Other public ?upgraded? users were able to view a private hidden user, but non?upgraded users
(who appeared to include predominantly minors) could not see the private hidden user. Upgraded
users were able to use this hidden feature on both the public and private portions of SOWYD.

6

Case Document 2 Filed 04/04/16 Page 7 of 18 Page D# 8

minor has since been identi?ed as having been 14 years old at the time. The minor did all of these
activities after being coaxed by a member of the website. The member coaxed the minor through
the use of both written text and streaming child pornography to make it appear as though another
minor was conducting similar actions.

Seizure of SOWYD

18. According to publicly available information, the domain registration company for
domain was eNom, Inc., and the IP address for the computer server hosting SOWYD
was assigned to Internet hosting provider Ecatel LTD in the Netherlands. On October 30, 2014,
the US. District Court for the Eastern District of Virginia authorized the seizure and forfeiture of
the Internet domain name for SOWYD. The seizure and forfeiture authorization ordered eNom,
Inc., to direct communications intended for the domain name of SOWYD to an IP address that
resolved to a computer server leased by the FBI. The same Court also authorized a pen register
trap and trace order on the FBI-leased server, authorizing the collection of Internet routing data
(including IP address data) for that computer server.

19. The warrant and order were executed, and communications of computers
attempting to access the domain for SOWYD were routed through the FBI-leased server.

20. Upon completion of the domain redirect to the FBI-leased server, SOWYD was
rendered inoperable. However, on November 3, 2014, the UCA logged into SOWYD, which was
operating normally. Agents of the FBI determined that SOWYD was able to function because a
new domain name had been established and was pointing to the original computer server. By 
establishing the new domain, the person administering SOWYD was able to circumvent the 

Court-ordered domain redirect, thereby allowing the site to operate. Open source checks showed

Case Document 2 Filed 04/04/16 Page 8 of 18 Page D# 9

the new domain was registered using TLD Registrar Solutions, a United Kingdom-based company
outside the jurisdiction of the FBI.

On November 4, 2014, law enforcement representatives from the Netherlands
reported to the FBI that the computer server hosting SOWYD was voluntarily removed from the
Internet by Ecatel?after law enforcement representatives informed the provider of ongoing illegal
activity on the server. SOWYD was thenrendered ?nally inoperable.

22. Pursuant to a Mutual Legal Assistance Treaty (MLAT) request, on
December 3, 2014, the Dutch National Police provided the FBI with a forensic image of the server
that hosted SOWYD. The image contained various archive ?les and log ?les related to
SOWYD, including user login records, user chat records, user activity records and download logs.

23. Agents of the FBI successfully and extracted the archived ?les from the
server which hosted SOWYD.

Arrest of S3

24. In March, 2015, the South African Police Service (SAPS) executed a search
warrant at the residence of S3. FBI agents and a forensic examiner were present during the search
warrant at S3?s residence. After being informed of his rights, S3 agreed to cooperate with SAPS
investigators and the FBI.

25. S3 stated he was the administrator for MyVlog and SOWYD. S3 con?rmed that
one of his devices contained approximately 500 gigabytes to one terabyte of content for MyVlog,
including log ?les, and approximately ten videos for SOWYD.

26. During the execution of the search warrant, an FBI forensic examiner identi?ed an

open container connected to 83?s computer. This container had six folders within it,

Case Document 2 Filed 04/04/16 Page 9 of 18 Page D# 10

two of which were named ?_logs? and ?site2.? The ?_logs? folder had three additional folders
labeled ?2012,? ?2013,? and ?2014.? Located within the 2014 folder were thousands of log ?les
pertaining to MyVlog. Captioned log ?les contained chat conversations from January 2014 to
September 2014. In addition to chat conversations, the log ?les contained a date, time, and IP
address stamp for every communication that was made on MyVlog.

27. Located within the ?site2? folder were over 66,000 Video ?les. The vast majority
of the video ?lenarnes contained usemames for MyVlog users. Over 9,000 of the video ?les
contained child pornography.

Identi?cation of Jeffe? VAN DYKE

28. S3 stated that MyVlog user ?jjaayy,? who most often went by ?jay,? only linked
children to MyVlog and did not chat. S3 told investigators that jay introduced another user (S6)
to MyVlog. Log ?les recovered from 83?s residence were utilized to locate and arrest S6, who
ultimately pleaded guilty to conspiracy to produce child pornography.

29. S6 stated that although they never met, he had developed a friendship with jay and
knew him as ?Jay Smith.? Jay and S6 joined MyVlog together. S6 spoke with jay on his/her
cellular phone On at least one occasion. S6 advised that jay?s cellular phone number was on 
his/her phone under ?Jay.? Jay told S6 that he resided in Weed, California, worked in the
construction business, was an assistant coach with the local high school football team, and was
formerly a member of the United States Army.

30. Agents searched S6?s cellular phone, which was in FBI custody, and identi?ed an
entry for ?Jay Smith? with a corresponding Verizon Wireless phone number 530-859-1677

(hereinafter the ?Subject Phone?). On July 31, 2015, in response to an administrative subpoena,

Case Document 2 Filed 04/04/16 Page 10 of 18 Page D# 11

Verizon Wireless provided subscriber information and toll billing records for the Subject Phone
including the name Jeffery VAN DYKE with an address in the 16000 block of Rockwood place in
Weed, California 96094, and dates of service from 03/11/2009 to 12/04/2013.

31. Agents reviewed toll billing records for the Subject Phone and identi?ed a call
received on December 27, 2012, from Tracfone cellular phone number 815-875-7231, which S6
con?rmed was his/her cellular phone number.

32. The log ?les from 83?s computer included a chat from MyVlog dated June 6, 2014,
in which jay logged into the private section available only to upgraded members. Jay made
several statements indicating that he was a new user to MyVlog, including ?give me a minute to
?gure shit out haha.? Later in the conversation, jay stated ?anyways i linked a decent amount of
girls a few replied and said they were gonna come here, no idea if any did yet.? Jay continued to
ask questions regarding the functionality of the site including ?i see how it works i think, so when-
a girl shows up she will go straight to whatever room 11 linked her to right?? After direction from
other users, including S3, Jay engaged in the following conversation with S3:

jay: so the links I made arent really the name of the room she will be in, thats just a link to
login

S3: yes, jay

jay: and when a girls gets on we get a notice like we just got

S3: and once she uses the link, we have her in our grubby paws.

jay: sounds sexy

33. Later that date, while chatting with S3 and another user, jay stated, ?so im gonna
take off, get my loops together and maybe link a few more for tomorrow. Now that i kind of see

how it works I will be on more.?

10

Case Document 2 Filed 04/04/16 Page 11 of 18 Page D# 12

34. On June 8, 2014, jay chatted with several other upgraded users and a minor female
who had previously told other MyVlog users that she was ?fteen years old and has been
identi?ed as 15 years old at the time of the conversation. Jay told V-l ?hi hot and
?wow have a great body.? Jay and other upgraded users repeatedly requested V-l to
remove her pants, then her underwear. One of the upgraded members stated ?pink undies should
go so we can see if theres anything else hott and pink going on hehe.? This statement was
followed by ?m yeah lay back let us all pleasure yur pussy with our clicks,? to which jay
responded ?yes babe move the cam a little lower,? then ?i would love to have my tongue deep
inside that pussy.?

35. On October 30, 2015, a federal search warrant was executed at the residence of
Jeffery VAN DYKE. During the execution of the warrant, VAN DYKE consented to an
interview after being advised of his Miranda rights and provided the following information:

a. VAN DYKE had browsed to MyVlog but could not recall his username or the last
time he had visited it.
b. VAN DYKE did not recall chatting on MyVlog because he was not a very good
looper or chatter. VAN primary role on MyVlog was to link children to
i the website.
0. VAN DYKE downloaded videos from MyVlog on one or two occasions. VAN
DYKE stated that a lot of child pornography would be located on his computer,

including child pornography of children under the age of twelve.

11

Case Document 2 Filed 04/04/16 Page 12 of 18 Page D# 13

36. A forensic review of digital evidence seized from VAN residence revealed

hundreds of child pornography images and Videos, including videos created on MyVlog.
Identi?cation of Allan CORTEZ

37. The log ?les from 83?s residence contained IP address 108.75.187.121 associated
with MyVlog users ?max,? ?Cassy,? and ?TonyStark.? Chats involving these usernarnes included
receiving directions on, how to talk to children on MyVlog and discussing children who engagedin
sexual activity. For instance, on August 10, 2014, user ?max? was logged into the lounge and had
the following conversation with several other MyVlog users.

tracy: is this a batingfactoryPZ

tracy: :hm:

tracy: i prefer a bate where the girl is enjoying it and is horny and happy about it js

raven: last i checked with al?e he agreed with me about megan so i have a hard time
believeing he banned her by himself 

squirtle: exactly, tracy

Star: and gia knows about it to he had no problems

max: i agree with tracy

 whos emoemogirl? nice loop if its any of you..shes cute [01
emoemogirl has joined the room r0 (0 - The Lounge)
emoemogirl: max

squirtle: 101 hey emo

max: damnit i was hoping it wasn't one of us lmao

 

2 Based on my investigation, ?hating? is a term that has two meanings. The ?rst is a shortened version of the word
masturbating. The second use of the term is used to describe the act of soliciting a child to engage in sexual activity.
In this sense, bating is is accomplished primarily by playing a loop or ?hate? video that depicts a minor engaged in
sexual activity.

12

Case Document 2 Filed 04/04/16 Page 13 of 18 Page D# 14

38. IP address 108.75.187 .121 was registered to An administrative subpoena
issued to revealed the subscriber to be Allan CORTEZ, with an address in the 2000 block of
Terrace in Wichita, KS 67218.

39. On June 23, 2015 a search warrant was executed at that address. During the
execution of that search, CORTEZ consented to an interview with Agents. After being advised of
his Miranda rights, CORTEZ provided the following information:

a. CORTEZ assumed the FBI was at his residence to investigate him for sexually
soliciting young girls online because another law enforcement agency had recently
been to his residence for the same reason. CORTEZ denied being involved in this
type of activity.

b. CORTEZ utilized Cox Communications for the intemet, but had previously
utilized Internet. home intemet used a wireless router, which
was password protected. The only persons in the residence with the wireless
password were CORTEZ, his wife, and his wife?s best friend. CORTEZ had
provided the wireless password to another individual a week prior to the search.
CORTEZ further stated that both he and his wife had their own computers and did
not share computers.

c. CORTEZ regularly uses wiping software and the program ?HistoryKill? to delete
his browser history.

d. CORTEZ and his wife had separated a month prior to the search warrant. During
that time, CORTEZ was on the intemet frequently. During that time, he talked to

girls online on meetme and YouTube. CORTEZ believed some of the girls he

13

Case Document 2 Filed 04/04/16 Page 14 of 18 Page D# 15

spoke to may have been under the age of eighteen. CORTEZ also acknowledged
encouraging girls to remove their clothes while online, but denied ever viewing
anything illegal.

40. A forensic review of desktop computer located ?ve images and 401
video ?les that appeared to depict child pornography. The computer also contained log ?les
relating to the Yahoo! Chat name ?kidsme69.? These ?les were located within the Microsoft
Windows user pro?le ?Allan.? The log ?les show user ?kidsme69? telling Yahoo! User
?homyl 1 15? that he is into children that are as young as twelve.

41. Additionally located on desktop computer were hundreds of ?ash video
?les which depicted children who were victimized on MyVlog, some of whom have been
identi?ed. These video ?les were located by searching digital media using known
MyVlog victim screen names. Several of these video ?les contained child pornography. All of
the video ?les had been deleted from desktop computer but were forensically
recovered. Prior to deleting the video ?les, they were located under the ?Allan? pro?le in a folder
titled ?Newfolder.? Also forensically recovered were shellbag records indicating that 

9?

desktop computer had been used to access a folder titled ?Myvlog dlz_?les. Based upon my
training and experience, a shellbag is a record within the Windows Operating System that tracks
the different views, sizes, and positions of a folder that is viewed using Windows Explorer.
Shellbag records are created not only when a user accesses local ?les on their computer, but also
when a user accesses ?le folders from removable media and network storage locations. Based

upon statements from cooperating subjects and undercover sessions, I know the term ?dlz? as seen

in the folder ?Myvlog dlz_?les? means ?download zone.? The ?download zone? was the area

14

Case Document 2 Filed 04/04/16 Page 15 of 18 Page D# 16

on MyVlog where users could download the ?les created by Myvlog. The ?download zone? was
only accessible to users who had suf?cient contributions to MyVlog during a designated time
period.

42. The naming convention of these ?les was identical to the ?les created by MyVlog
and found on S3 ?3 computer. A comparison of one of the deleted ?les from computer
was a visual match to a ?le created on MyVlog. This video ?le depicted an identi?ed minor
victim, who was 14 years old at the time, masturbating.

Identification of Edward PARSON

43. The log ?les from 83?s residence included IP address 97.80.106.52 associated with
MyVlog usemames ?danny,? ?brit,? ?hellokitty,? ?dani,? and ?deedee.? Chats involving these
usemames included receiving directions on how to talk to children on MyVlog and discussing
children who engaged in sexual activity. On September 21, 2014, user ?danny? was logged into
the ?Lounge? and had the following conversation with MyVlog user ?cristinaz?

cristina: who you get 

danny: 

danny: wait, maybe I didnt

danny: but I did get her doing dares when I chatted her

cristina: I want her naked bu ti don?t think she will

danny: fully nakid is tough, gonna have to so a quick 3 secs

cristina: nah I got a 5 sec thing going here lol

danny: 

cristina: I need serious help with truths-.-

15

Case Document 2 Filed 04/04/16 Page 16 of 18 Page D# 17

danny: just ask about the music, toys, videos food movies tv shows she likes

danny: and singers

44. An open?source query identi?ed IP address 97.80.106.52 as registered to Charter
Communications. In response to an administrative subpoena issued March 24, 2015, Charter
identi?ed the subscriber for IP address 97.80.106.52 as an individual at a speci?c address on
Cochran Street in Chicopee, MA 01020. As discussed below, that individual was identi?ed to be
Edward landlord.

45. On June 23, 2015, a federal search warrant was executed at that address. The
landlord consented to be interviewed and con?rmed he owned the entire building at 68 and 70
Cochran Street, and that he resided in one unit with his girlfriend. He rented another unit to
Edward PARSON, who lived downstairs. The landlord advised that PARSON was a Spring?eld
?re?ghter and has lived in the unit for approximately four to ?ve years. The landlord stated he
was the subscriber for the intemet and cable in the building. The modern and router were located
in the landlord?s apartment and were password protected. The landlord used the internet
occasionally only to pay bills, read the news, and shop online. He did not use online chat services
and had never heard of MyVlog. The landlord denied accessing or downloading child
pornography. The landlord did not know how to manage his intemet access or the router in his
residence. When the landlord obtained the router, PARSON helped install it and create the
password. The landlord could not recall the wireless network name because his device
automatically connected to it. An onsite preview was conducted of the landlord?s various digital
media. No evidence pertaining to child pornography was found.

46. During the execution of the search warrant at the landlord?s residence, PARSON

16

Case Document 2 Filed 04/04/16 Page 17 of 18 Page D# 18

returned to his residence below the landlord. PARSON agreed to Speak with agents inside his
residence and provided the following information:

a. PARSON acknowledged having set up and used the landlord?s wireless router.

b. PARSON initially agreed to a forensic preview of his digital media, but later
refused to sign the consensual search form because he was concerned about getting
in trouble based on what the agents found. PARSON was concerned because he
had visited numerous online websites like teenchat.com, myfreecamcom, stickam,
MyVlog, and Condorchat over the last couple years. PARSON admitted that
some of these websites involved minor females and had links to child pornography.
PARSON also admitted accessing child pornography on multiple occasions.

c. PARSON admitted to visiting MyVlog, but could not recall SOWYD. Parson
heard of MyVlog through ?chateen.? MyVlog had ?chatters,? ?linkers? and
involved looping, and role was a chatter on MyVlog.

d. PARSON explained that MyVlog kept track of it?s users statistics. Parson recalled
linkers obtaining higher statistics. If a MyVlog user had higher statistics, they
were given access to different videos and moderator capabilities. The videos that
members were given contained ?illegal stuff,? which included child pornography.
In order to download these videos, a user needed a minimum statistic. Parson
believed MyVlog automatically recorded the videos, but could not be certain. He
recalled losing access at times for not chatting enough.

e. PARSON identi?ed his MyVlog login as ?Danny,? but could not say with 100%

certainty that it was his. PARSON stated that the loop video he used for ?Danny?

17

Case Document 2 Filed 04/04/16 Page 18 of 18 Page D# 19

was of a boy who talked a lot.

f. PARSON recalled having hidden access on MyVlog.

g. After MyVlog stopped operating, PARSON deleted all of the ?les from his
computer. PARSON then stated that just by being on MyVlog, his career was now
over.

47. A federal search warrant was obtained and executed for PARSON?sresidence on
June 23, 2015. A forensic review of digital media revealed several ?les that appeared
to contain child pornography. Multiple Video ?les appeared to be screen captures of a MyVlog
user communicating with a child on MyVlog.

Conclusion

48. Based on the facts above, I respectfully submit that this af?davit sets forth probable
cause that from about January 2014 to about September 2014, in the Eastern District of Virginia
and elsewhere, EDWARD PARSON, ALLAN CORTEZ, and EFFERY VAN DYKE knowingly

combined, conspired, and agreed with others known and unknown to produce child pornography

on MyVlog in violation of Title 18, United States Code, Sections 22 and 

Daniel .7 oh?s
Special Agent
Federal Bureau of Investigation

Sworn to and subscribed before me this 4th day
of April 2016, at Alexandria, Virginia.

Michael S. Nachmanoff
United States Magistrate Judge
The Honorable Michael S. Nachmanoff
United States Magistrate Judge

18