Case 1:16-cr-00080-LPS Document 1 Filed 02/25/16 Page 1 of 15 PageID #: 1
AO 91 (Rev. 02/09) Criminal Complaint

UNITED STATES DISTRICT COURT
for the
District of Delaware
United States of America
v.
Roy HARVENDER, Jr.

)
)
)
)
)

Case No. 16-

L/~ JI\

Defendant

CRIMINAL COMPLAINT
I, the complainant in this case, state that the following is true to the best of my knowledge and belief.
On or about the date of

06/~ 2/2,014 -in

02(2572016

Delaware
, the defendant violated
, an offense described as follows:

New Castle
the county of - - - - - - in the - - - - - - District of
18
U. S. C. § 2251 d)(1 ); 2252A(a)(2)(A); and
2252A(a)(5)(B)

the defendant advertised, distributed, received, and possessed images depicting children less than 18 years old
engaged in sex acts and in the lascivious exhibitoin of the genitals

This criminal complaint is based on these facts:
see attached affidavit

~ Continued on the attached sheet.

Complainant's signature

SA Michael Lipsner, FBI
Printed name and title

Sworn to before me and signed in my presence.

Date:

a/d.c; I ;){)1lr

City and state:

Wiimington, DE

Honorable Christopher J. Burke
Printed name and title

 Case 1:16-cr-00080-LPS Document 1 Filed 02/25/16 Page 2 of 15 PageID #: 2

AFFIDAVIT IN SUPPORT OF CRIMINAL COMPLAINNT
INTRODUCTION

I, Michael Lipsner, ("Your Affiant"), a Special Agent (SA) with the Federal Bureau of
Investigation (FBI), Baltimore Division, Baltimore, Maryland, being duly sworn, depose and state
as follows:

1.

Your Affiant has been a Special Agent (SA) with the FBI since September 23, 2012.

I am currently investigating federal violations concerning child pornography and the sexual
exploitation of children. I have gained experience through training in seminars, classes, and daily
work related to conducting these types of investigations. I have also participated in the execution of
numerous search warrants, of which many have involved child exploitation and/or child
pornography offenses. In the course of my employment with the FBI, I have also participated in the
execution of numerous search warrants resulting in the seizure of computers, magnetic storage
media for computers, other electronic media, and other items evidencing violations of federal laws,
and I have had the opportunity to observe and review numerous examples of child pornography (as
defined in 18 U.S.C. § 2256) in all fonns of media including computer media.
2.

As a federal agent, I am authorized to investigate violations of laws of the United

States and to execute warrants issued under the authority of the United States.
3.

I am submitting this Affidavit in support of a Criminal Complaint for Roy

Harvender, Jr. for violations of: 18 U.S.C. § 2251(d)(l), (advertising, attempting to adve1iise, and
conspiracy to advertise child pornography); 18 U.S.C. § 2252A(a)(2)(A) and (b)(l) (receipt and
distribution of, conspiracy to receive and distribute, and attempt to receive and distribute child
pornography); and 18 U.S.C. § 2252A(a)(5)(B) and (b)(2) (possession of, knowing access,
conspiracy to access, or attempted access with intent to view child pornography).

 Case 1:16-cr-00080-LPS Document 1 Filed 02/25/16 Page 3 of 15 PageID #: 3

4.

The statements contained in this affidavit are based in part on: information provided

by FBI Special Agents; written reports about this and other investigations that I have received,
directly or indirectly, from other law enforcement agents; information gathered from the service of
administrative subpoenas; the results of physical and electronic surveillance conducted by federal
agents; the results of interviews; independent investigation and analysis by FBI agents/analysts and
computer forensic professionals; and my experience, training and background as a Special Agent
(SA) with the FBI. This affidavit includes only those facts that I believe are necessary to establish
probable cause and does not include all of the facts uncovered during the investigation.
5.

The instant investigation, described more fully below, involves an Internet-based

website referred to as "Website 19". 1 The instant investigation has revealed that an individual
residing at the SUBJECT PREMISES was a registered member of "Website 19" who uploaded
child pornography to "Website 19."
STATUTORY AUTHORITY

6.

The investigation concerns alleged violations of Title 18, United States Code,

§2251 (d)(l ), which, in pertinent part, makes it a federal crime for any person to knowingly make,
print, or publish, or cause to be made, printed, or published, any notice or advertisement seeking or
offering in order to receive, exchange, buy, produce, display, distribute, or reproduce, any visual
depiction, if the production of such visual depiction involves the use of a minor engaging in
sexually explicit conduct and such visual depiction is of such conduct.
7.

Title 18 U.S.C. §2252A(a)(2), in pertinent part, makes it a federal crime for any

person to knowingly attempt to receive or distribute any visual depiction that has been mailed, or

1

The actual name of the website is known to law enforcement. Investigation into the users of this and other related sites
remains ongoing and disclosure of the names of the sites would potentially alert users to the fact that law enforcement
action is being taken against the sites, potentially provoking users to notify other users of law enforcement action, flee,
and/or destroy evidence.

2

 Case 1:16-cr-00080-LPS Document 1 Filed 02/25/16 Page 4 of 15 PageID #: 4

has been shipped or transported in interstate or foreign commerce, or which contains materials
which have been mailed or so shipped or transported, by any means_ including by computer, if the
producing of such visual depiction involves the use of a minor engaging in sexually explicit
conduct; and such visual depiction is of such conduct.
8.

Title 18 U.S.C. §2252A(a)(4)(B), in pertinent part, makes it a crime to knowingly

possess, or knowingly access with intent to view, 1 or more books, magazines, periodicals, films,
video tapes, or other matter which contain any visual depiction that has been mailed, or has been
shipped or transported in interstate or foreign commerce, or which contains materials which have
\

been mailed or so shipped or transported, by any means including by computer, if the producing of
such visual depiction involves the use of a minor engaging in sexually explicit conduct; and such
visual depiction is of such conduct.
BACKGROUND OF THE INVESTIGATION AND PROBABLE CAUSE
Description of "Website 19"
9.

"Website 19" was an online bulletin board whose pnmary purpose was the

advertisement and distribution of child pornography. The website operated throughout 2012-2014
and ceased operating in December of 2014.

As of December of 2014, the website contained

416, 198 posts and 105 ,651 registered users. "Website 19" required its users to continually share
child pornography in order to gain and keep membership.
10.

"Website 19" was organized by different topical areas or forums.

For example,

"Application Rules" or "Hardcore" would have individual threads containing posts that one would
expect to topically conforn1 to the forum heading. A review of the initial forums accessible on
"Website 19" prior to registering an account with the website revealed a post entitled "App~ication
Rules," which contained the following instructions, among other things:

3

 Case 1:16-cr-00080-LPS Document 1 Filed 02/25/16 Page 5 of 15 PageID #: 5

a.
. .. Must contain clearly preteen hardcore material (does NOT
need to be private, rare or new); no softcore, no JB or borderline JB; if at least one of
the participants is 12 years old or less, flat-chested, hairless and engaging in sexual
activity, it most likely qualifies (this requirement applies to applications only) ....
b.
. .. Must have 50-200 MB of total uploads, which may consist
of one or more videos or image sets in a single post; posts containing less than 50 or
more than 200 MB of uploads will be rejected. (this requirement applies to
applications only) ....
c.
. . An Admin Team member will review your application
post and, if not approved, a reply will be posted that explains what is missing or
incorrect with the post. Please allow up to 48 hours for the review process to be
completed. Once you have created a post that conforms to the rules, you will be
promoted to Full Member and be granted access to the posting forums.2

11.

Another forum on "Website 19" that was available prior to registering an account

contained a post entitled "Activity Rules and Posting Information." Review of this post revealed the
following text, among other things:
a.
. What does count as a contribution and what does not?
COUNT as contribution: .
Set(s) of pictures and/or videos displaying child/teen (pubescent)
modeling, child/teen (pubescent) nudity, softcore or hardcore erotica.
Nudism/naturism.
Webcam captures.
Working backdoors and passwords of on-topic sites (if they don't
require JavaScript or Flash).
Helping the community with tutorials, re-uploads and filling requests
of all of the above . . . .
·
b.

. .. DON'T COUNT as contribution:

Late teen nudity/erotica/porn (Jailbait who passed puberty and look like adults: ±14
years old for girls and ±15 years old for boys).
2

Based on my law enforcement training and experience, and my review of the contents of Website 19, the referenced
term "JB" is believed by your Affiant to stand for "Jail Bait". The term "Jail Bait" is known to law enforcement to be
terminology commonly used by individuals with a sexual interest in minors who possess and traffic child pornography.
It is used to refer to minors who are post-pubescent, but believed to be younger than the age of consent for sexual
activity.

4

 Case 1:16-cr-00080-LPS Document 1 Filed 02/25/16 Page 6 of 15 PageID #: 6

Adult nudity/erotica/porn. This includes fake jailbait porn (young looking women
that act like teenagers but are obviously 18+)
c. .
All Full Members are required to contribute at least once
every 30 days. The first 30-day contribution period begins on the day of promotion
to Full Member.
d.
VIP Members: All VIP Members are required to contribute at
least once every 30 days, in any section of the board.
e.
SVIP Members: All SVIP Members are required to contribute
at least once every 30 days, in any section of the board.

12.

After reviewing the above forums and postings, on July 23, 2014, an undercover FBI

agent then accessed "Website 19" using an account previously registered on the website by a user of
the website and subsequently seized by law enforcement pursuant to the user's consent to assume
his online identity.
13.

After successfully logging into "Website 19'', a review of the various topics within
.
'
the forums (such as "Hardcore," "Pies", and "Vids") revealed, among other things, numerous image
and video files that contained child pornography (CP) or child erotica.

The images included

depictions of prepubescent girls, boys, and toddlers with their genitals lasciviously exhibited, as
well as the same prepubescent girls, boys, and toddlers engaged in sexual acts. The sexual acts
included anal, vaginal, or oral penetration. The last post section included the date and time of the
post as well as the author. Upon accessing a topic, the original post appeared at the top of the page,
with any corresponding replies to the original post included in the post thread below it. Typical
posts appeared to contain text, images, thumbnail previews of images, compressed files (such as
".rar" files), links to external sites, or replies to previous posts.
14.

Examples and descriptions of posts containing child pornography depicting

prepubescent girls and boys are as follows:
5

 Case 1:16-cr-00080-LPS Document 1 Filed 02/25/16 Page 7 of 15 PageID #: 7

a.
On July 23, 2014, a user posted a topic in the Webcams-Boys
forum that contained numerous images depicting child pornography and child erotica
of prepubescent boys. Several of these images depicted the nude prepubescent boys
lying next to each other with their legs spread apart, exposing their genitalia, and
holding their penises.
On July 11, 2014, a user posted a topic in the Hardcore-Girlsb.
Pics forum that contained numerous images depicting child pornography and child
.erotica of a prepubescent girl. Several of these images depicted the nude
prepubescent girl lying on what appeared to be a bed with her legs spread apart and
being anally and-vaginally penetrated by an adult man.

15.

A private message feature was also available on the site that allowed users to send

each other private messages.

Finding and Accessing "Website 19"
0

16.

"Website 19" operated on a computer network, hereinafter "the Network," available

to Internet users that is designed specifically to facilitate anonymous communication over the
Internet. In order to access that Network, a user must install computer software that is publicly
available, either by downloading software to the user's existing web browser, downloading free
software available from the network's administrators, or downloading a publicly-available thirdparty application. 3

Using the Network prevents someone attempting to monitor an Internet

connection from learning what sites a user visits and prevents the sites the user visits from learning
the user's physical location. Because of the way the Network routes communication through other
computers, traditional IP identification techniques are not viable. Websites that are accessible only
to users within the Network can also be set up within the Network. "Website 19" is just such a
website. A user could only reach websites like "Website 19" if the user is operating in the Network.

3

Users may also access the Network through so-called "gateways" on the open Internet, however, use of those gateways
does not provide users with the anonymizing benefits of the Network.

6

 Case 1:16-cr-00080-LPS Document 1 Filed 02/25/16 Page 8 of 15 PageID #: 8

User "beansnrice" on "Website 19"

17.

While accessing "Website 19" in an undercover capacity using an account previously

seized by law enforcement, an undercover FBI agent observed the user profile of "Website 19" user
"beansnrice." Profile information on "Website 19" may include contact information and other
information that is supplied by the user. It also contains information about that user's participation
on the site, including statistical information about the user's posts to the site and a categorization of
those posts.
18.

The profile page of user "beansnrice" indicated this user originally registered an

account on "Website 19" on April 04, 2014.
19.

According to the statistics on the profile page for user "beansnrice", between April 4,

2014 and December 8, .2014, this user sent a total of approximately 30 private messages to other
users of "Website 19" and received approximately 23 private messages from other users of
"Website 19". During this same timeframe, the user "beansnrice" started approximately 89 threads
on "Website 19".
20.

According to the statistics on the profile page for user "beansnrice", between April 4,

2014, and December 8, 2014, the user "beansnrice" made a total of approximately 190 postings to
"Website 19". Examples and descriptions of these posts are as follows:
a. On June 12, 2014, the user "beansnrice" made a post to a thread entitled
"Gina2790". This post contained what is known as a "contact sheet",
which contained 36 small or "preview" images displayed on the same
page. This post also contained a hyperlink to an external website and
password. Based on my knowledge of how other users posted child
pornography to "Website 19'', there is reason to believe that this link
would have contained the full file-meaning each of the 36 small preview
images displayed as full size images or frames as part of an electronic
movie file.
1.

Several of the images visible on the "contact sheet" depict a prepubescent Caucasian girl. In some of these images, the minor
female is performing oral sex on what appears to be an adult
7

 Case 1:16-cr-00080-LPS Document 1 Filed 02/25/16 Page 9 of 15 PageID #: 9

Caucasian male's erect penis. Other images show the female
looking towards the camera with what appears to be ejaculate on
her face.
11.

At the time of this investigation, the link to the external website
containing the full file was inactive and the associated file was not
accessible to the investigating Agent.

b. On June 12, 2014, the user "beansnrice" made a post to a thread entitled
"Two girls-One cock aka VideoDJ(6) (re-up by ... )".This post contained
a contact sheet, which had 36 small or "preview" images displayed on the
same page. This post also contained a hyperlink to an external website
and password. Based on my knowledge of how other users posted child
pornography to "Website 19", there is reason to believe that this link
would have contained the full file- meaning each of the 36 small preview
images displayed as full size images or frames as part of an electronic
movie file.
I.

The majority of the 36 images contained on the contact sheet
depict Caucasian girls who appear to be toddlers between the ages
of 2 and 4 years old. (CHILD-I and CHILD-2). The top of the
contact sheet is labeled with the file name "VideoDJ (6).3gp".
The majority of these images depict CHILD-I performing oral sex
on what appears to be an adult Caucasian male's erect penis.
Several of the images show CHILD-2 touc.hing the adult male's
erect penis with her hands.

11.

At the time of this investigation, the link to the external website
containing the full file was inactive and the associated file was not
accessible to the investigating Agent.

c. On July 17, 2014, the user "beansnrice" made a post to a thread entitled
"(((Kingpass))) Rmix 01 - Alina VTCAP 04". This post contained a
contact sheet, which had 20 small or "preview" images displayed on the
same page. This post also contained a hyperlink to an external website
and password. Based on my knowledge of how other users posted child
pornography to "Website 19", there is reason to believe that this link
would have contained the full file - meaning each of the 20 small images
displayed as full size images or frames as part of an electronic movie file.
I.

The top of the contact sheet image is labeled with the file name
"(((Kingpass))) Rmix 01 - (including (pthc) - Alina VTCAP 01
(Hardcore)).mp4". The images displayed in the contact sheet
show a pre-pubescent Caucasian girl in various states of undress
and fully nude. In several of these images, the child is displayed
in a variety of poses which are sexually suggestive and
inappropriate given her young age. The minor is depicted
8

 Case 1:16-cr-00080-LPS Document 1 Filed 02/25/16 Page 10 of 15 PageID #: 10

spreading her labia with her fingers, touching her vaginal area,
and performing oral sex on what appears to be an erect adult
perus.
ii. At the time of this investigation, the link to the external website
containing the full file was inactive and the associated file was not
accessible to the investigating Agent.
d. On November 29, 2014, the user "beansnrice" made a post entitled
"Kristen MOV00607". This post contained a contact sheet, which had 18
small or "preview" images displayed on the same page. This post also
contained a hyperlink to an external website and password.
i.

The majority of the 18 images of the contact sheet depict a prepubescent girl holding the penis of a male. The hyperlink was
accessed by personnel at FBI Headquarters and a full video file
was downloaded. The full video file depicts, among other things,
the child holding the penis of a male, and shows the male's penis
penetrating the mouth of the minor. ·In parts of the video, the
focal point of the camera is on the child's mouth as she performs
oral sex on the male. In other parts, the child is shown
masturbating the male's penis.

11.

The links to the contact sheet and the external website containing
the full video file have since become inactive.

Seizure of Data from "Website 19" and
Identification of IP Address Information for User "beansnrice"

21.

The FBI has been advised by a foreign law enforcement agency (hereinafter

"FLA l ")that, in June 2014, FLA 1 arrested a user of "Website 19." Pursuant to the arrest, FLA 1
obtained consent to assume this user's account on "Website 19" and took over operation of the
account. Further review revealed this user had access to a backup copy of "Website 19." FLA 1
then provided a copy of this backup to the FBI, along with copies of subsequent backups obtained
after FLA 1 assumed that user's identity.
I

22.

FBI review of the backup data provided by FLA 1 revealed information on users'

accounts, profiles posts, and private messages. One of these accounts was the account of user
"beansnrice".
9

 Case 1:16-cr-00080-LPS Document 1 Filed 02/25/16 Page 11 of 15 PageID #: 11

23.

The FBI was also advised by foreign law enforcement agencies that after the arrest

of the user described in paragraph 22, the physical location of the computer server hosting "Website
19" was identified and seized by a second foreign law enforcement agency ("FLA 2"). The FBI has
been advised that the person who had been operating that server was also arrested by FLA 2 and
provided consent to assume his account on "Website 19." FLA 2 then provided a copy of the
computer server hosting "Website 19" to FLA 1, in accordance with each of those countries'
applicable laws.
24.

The FBI has been further advised that, acting independently and in accordance with

its own national laws, FLA 1 assumed control of "Website 19" in September 2014 and began
operating the site from a computer server in its own jurisdiction. "Website 19" operated under
control of FLA 1 until the first week of December, 2014, when "Website 19" ceased to operate.
25.

Websites that operate on the open Internet generally have IP address logs that can be

used to locate and identify the site's users. In such cases, after the seizure of a website whose users
are engaging in unlawful activity, law enforcement can review those logs in order to determine the
IP addresses used to access the site. A publicly available lookup could then be performed to
determine what Internet Service Provider ("ISP") owned the target IP address. A subpoena would
then be sent to that ISP to determihe the user to which the IP address was assigned at a given d_ate
and time.
26.

However, because of the Network software utilized by "Website 19," any logs of

user activity on the site, if they contained IP address information at all, would have only contained
the IP addresses of the last computer through which the communications of "Website 19" users
were routed before the communications reached their destinations (the destination being "Website
19"). It is not possible to trace such Internet use back through the Network to the actual users who

10

 Case 1:16-cr-00080-LPS Document 1 Filed 02/25/16 Page 12 of 15 PageID #: 12

sent the commµnications or requests for information. Those IP address logs therefore could not be
used to locate and identify users of"Website 19."
27.

FLA 1 advised the FBI that in early November 2014, acting independently and

according to its own national laws, FLA 1 uploaded a hyperlink to a file within a forum on
"Website 19" that was accessible only to registered members of "Website 19." The hyperlink was
advertised as a preview of a child pornography website with streaming video. When a "Website 19"
· user clicked on that hyperlink, the user was advised that the user was attempting to open a video file
from an external website. If the user chose to open the file, a video file containing images of child
_ pornography began to play, and FLA 1 captured and recorded the IP address of the user accessing
the file. FLA 1 configured the video file to open an Internet connection outside of the Network
software, thereby allowing FLA 1 to capture the user's actual IP address, as well as a session
identifier to tie the IP address to the activity of a particular "Website 19" user account.

Evidence Related to Location of "Website 19" User "beansnrice"

28.

FLA 1 reported to the FBI that on November 11, 2014, user "beansnrice" signed into

"Website 19" and accessed the video file described in Paragraph 28 from IP address 69.136.67.67
on November 11, 2014 at 12:55:01 (UTC).
29.

Using publicly available search tools, law enforcement determined that this IP

address belonged to Comcast Communications on the above-mentioned date.
30.

On December 3, 2014, an administrative subpoena requesting subscriber information

was issued to Comcast in regards to the use of IP address 69.137.67.67 on November 11, 2014 at
12:55:01 (UTC). In response, Comcast provided the following subscriber information:

11

 Case 1:16-cr-00080-LPS Document 1 Filed 02/25/16 Page 13 of 15 PageID #: 13

a. Subscriber Name: Jane Doe 4
b. Service Address: "XXXX" W. 3rd Street, Wilmington, Delaware 19805.
31.

On March 13, 2015 and January 21, 2016, in response to subsequent administrative

subpoenas issued to Comcast seeking subscriber information for the account associated with billing
address XXXX W. 3rd Street, Wilmington, Delaware 19805 ("SUBJECT PREMISES"), Comcast
confirmed that internet service at that location was provided to Jane Doe, beginning on
November 20, 2011 and that Jane Doe remained the subscriber associated with that billing address.
32.

Queries of the United States Postal Service on March 11, 2015 and February 3, 2016

confirmed that Jane Doe and Roy Harvender received mail at the SUBJECT PREMISES.
33.

According to searches of open source and government databases, the following

individuals resided at the SUBJECT PREMISES between September of 2014 and December of
2014, the time period in which user "beansnrice" accessed and made posts to "Website 19":

a. Jane Doe
b. Roy Harvender, Jr.
34.

On February 18, 2016, the United States District Court for the District of Delaware,

Honorable Mary Pat Thynge, authorized a warrant to search the SUBJECT PREMISES for
evidence related to the advertising of child pornography, and other child pornography trafficking
offenses.
35.

On February 25, 2016, your Affiant executed the search warrant at the SUBJECT

PREMISES. During the execution of the warrant, Roy Harvender, Jr. ("HARVENDER") waived
his Miranda rights in writing and agreed to speak with investigators.

During the interview,

HARVENDER admitted to being a member of "Website 19" with the user name "beansnrice."
HARVENDER further admitted to uploading files of child pornography to other users of
4

Jane Doe's true name is known to law enforcement and can be provided to the Court upon request.

12

 Case 1:16-cr-00080-LPS Document 1 Filed 02/25/16 Page 14 of 15 PageID #: 14

"Website 19." HARVENDER further admitted to residing at the SUBJECT PREMISES between
October 2014 and May 2015. HARVENDER acknowledged that child pornography constituted
images of pornography depicting children under the age of 18. He denied knowing that possession
of child pornography was illegal. When viewing child pornography, he commonly viewed images
of children estimated to be between the ages of 12 and 14, further described as a mix of pre- and
post-pubescent. He admitted investigators would find child pornography on his computer and a
SanDisk black and red thumb drive. He admitted downloading child pornography to his computer
approximately one week earlier.
36.

During the execution· of the search warrant, investigators found a laptop computer,

two thumb drives, an Ipod, and a cell phone. FBI computer forensic examiners conducted an onsite
preview of those devices and reported to your Affiant the following:
a.

The laptop computer contains no less than six images and three video

files depicting pre-pubescent minors engaged in sex acts and the lascivious
exhibition of the genitals.
b.

One of the thumb drives contains hundreds of videos and images of

child pornography, as defined in 18 U.S.C. §2256. Your Affiant knows that three of
these files are identified as those described in paragraph 20 of this Affidavit,
specifically, subparagraphs a, c, and d.

13

 Case 1:16-cr-00080-LPS Document 1 Filed 02/25/16 Page 15 of 15 PageID #: 15

37.

Based on the foregoing, there is probable cause to believe that Roy Harvender, Jr.

committed violations of the following: 18 U.S.C. §§ 2251(d)(l) and (e) (advertising, attempting to
advertise, and conspiracy to advertise child pornography); 2252A(a)(2)(A) and (b)(l) (receiving and
distributing or conspiracy to receive and distribute or attempting to receive and distribute child
pornography); and 2252A(a)(5)(B) and (b)(2) (knowing access, attempted or conspiracy to access
with intent to view child pornography).
Sworn to under the penalty of perjury.

Special Agent Michael A. Lipsner
Federal Bureau of Investigation

Sworn to and subscribed before me
this 416"1 day of February, 2016

Hono~hd/~:

United States Magistrate Judge

14