Case Document 1 Filed 06/16/15 Page 1 of 1 A0 Criminal Complaint UNITED STATES DISTRICT COURT for the District of Maryland United States of America v. I Case NoRobert P. Kramer Defendant(s) CRIMINAL COMPLAINT I, the complainant in this case, state that the following is true to the best of my knowledge and belief. On or about the date(s) of June 7, 2014 in the county pf Anne Arundel in the District of Maryland the defendant(s) violated: Code Section Offense Description 18 U.S.C. 2251(d) Advertising Child Pornography This criminal complaint is based on these facts: . . TERED See Attached Affidavrt A TMDPE- 1' if Continued on the attWW I Compi'ai?nam '5 Signature Michael Lipsner, Special Agent, FBI Swom to before me and signed in my presence. I Judge '5 signature: City and state; Baltimore, Maryland JnMarkiCoulson; US iglagietrate tr Printed name am; rifle" - it 5? - it"; 3? I Case Document 1-1 Filed 06/16/15 2f 80% AFFIDAVIT IN SUPPORT OF APPLICATION FOR CRIMINAL COMPLAINT INTRODUCTION 1, Michael Lipsner, being ?rst duly sworn, hereby depose and state as follows: 1. I have been employed as a Special Agent of the FBI since 2012, and am currently assigned to the FBI-Baltimore Division, Annapolis Resident Agency, Maryland Child Exploitation Task Force (MCETF). I have had the opportunity to observe and review numerous examples of child pornography (as de?ned in 18 U.S.C. 2256) in various forms of media including computer media. 2. I have also participated in the execution of numerous search warrants which involved child exploitation and/or child pornography offenses and included the search and seizure of computers, computer equipment, software, and electronically stored information. 3. As a federal agent, I am authorized to investigate violations of laws of the United States and to execute warrants issued under the authority of the United States. 4. I am submitting this af?davit in support of a criminal complaint and arrest warrant for ROBERT P. KRAMER 385 Long Meadow Way, Arnold, Maryland 21012, for violations of 18 U.S.C. 2251(d)(1) (Advertising Child Pornography). 5. The statements contained in this af?davit are based in part on: information provided by FBI Special Agents; written reports about this and other investigations that I have received, directly or indirectly, from other law enforcement agents; information gathered from the service of administrative subpoenas; the results of physical and electronic surveillance conducted by federal agents; independent investigation and analysis by FBI and computer forensic professionals; and my experience, training and background as a Special Agent Case Document 1-1 Filed 06/16/15 Page 2 of 10 (SA) with the FBI. This affidavit includes only those facts that I believe are necessary to establish probable cause and does not include all of the facts uncovered during the investigation. PROBABLE CAUSE 6. The instant investigation, described more fully below, involves an Internet-based website referred to as ?Website 19,?1 a website whose primary purpose was to advertise and distribute child pornography. There is probable cause to believe that KRAMER was a registered member of ?Website 19,? under the usemame ?walrus,? and that KRAMER uploaded child pornography to ?Website 19? and advertised child pornography that he made available to other users of ?Website 19.? Description of ?Website 19? ?Website 19? was an online bulletin board, the primary for which was the advertisement and distribution of child pornography. The website operated throughout 2012- 2014 and ceased operating in December of 2014. As of December of 2014, the website contained 416,198 posts and 105,651 registered users. ?Website 19? required its users to continually share child pornography in order to gain and keep membership. 8. ?Website 19? was organized by different topical areas or forums. For example, ?Application Rules? or ?Hardcore? would have individual threads containing posts that one would expect topically conform to the forum heading. A review of the initial forums accessible on ?Website 19? prior to registering an account with the website revealed a post entitled ?Application Rules,? which contained the following instructions, among other things: 'The actual name of the website is known to law enforcement. Investigation into the users of this and other related sites remains ongoing and disclosure of the names of the sites would potentially alert users to the fact that law enforcement action is being taken against the sites, potentially provoking users to notify other users of law enforcement action, ?ee, and/or destroy evidence. 2 Case Document 1-1 Filed 06/16/15 Page Must contain clearly preteen hardcore material (does need to be private, rare or new); no softcore, no JB or borderline if at least one of the participants is 12 years old or less, ?at-chested, hairless and engaging in sexual activity, it most likely quali?es (this requirement applies to applications onlyMust have 50?200 MB of total uploads, which may consist of one or more videos or image sets in a single post; posts containing less than 50 or more than 200 MB of uploads will be rejected (this requirement applies to applications onlyAdmin Team member will review your application post and, if not approved, a reply will be posted that explains what is missing or incorrect with the post. Please allow up to 48 hours for the review process to be completed. Once you have created a post that conforms to the rules, you will be promoted to Full Member and be granted access to the posting forums. 9. Another forum on ?Website 19? that was available prior to registering an account contained a post entitled ?Activity Rules and Postng Information.? Review of this post revealed the following text, among other things: a. . . . What does count as a contribution and what does not? COUNT as contribution: Set(s) of pictures and/or videos displaying child/teen (pubescent) modeling, child/teen (pubescent) nudity, softcore or hardcore erotica. Nudism/naturism. Webcam captures. Working backdoors and passwords of on-topic sites (if they don't require avaScript or Flash). Helping the community with tutorials, re-uploads and ?lling requests of all of the above . . . . b. . . . COUNT as contribution: Late teen nudity/erotica/porn (Jailbait who passed puberty and look like adults: i14 years old for girls and i15 years old for boys). Adult nudity/erotica/porn. This includes fake jailbait porn (young looking women that act like teenagers but are obviously 18+) Case Document 1-1 Filed 06/16/15 Page 4 of 10 c. All Full Members are required to contribute at least once every 30 days. The ?rst 30-day contribution period begins on the day of promotion to Full Member. d. VIP Members: All VIP Members are required to contribute at least once every 30 days, in any section of the board. e. SVIP Members: All SVIP Members are required to contribute at least once every 30 days, in any section of the board. 10. After reviewing the above forums and postings, on July 23, 2014, an undercover FBI agent then accessed ?Website 19? using an account previously registered on the website by a user of the website and subsequently seized by law enforcement pursuant to the user?s consent to assume his online identity. 11. After successfully logging into ?Website 19?, a review of the various topics within the forums (such as ?Hardcore,? ?Pics?, and ?Vids?) revealed, among other things, numerous image and Video ?les that contained child pornography (CP) or child erotica. The images included depictions of prepubescent girls, boys, and toddlers with their genitals lasciviously exhibited, as well as the same prepubescent girls, boys, and toddlers engaged in sexual acts. The sexual acts included anal, vagina], or oral penetration. The last post section included the date and time of the post as well as the author. Upon accessing a topic, the original post appeared at the top of the page, with any corresponding replies to the original post included in the post thread below it. Typical posts appeared to contain text, images, thumbnail previews of images, compressed ?les (such as ?.rar? ?les), links to external sites, or replies to previous posts. 12. Examples and descriptions of posts containing child pornography depicting prepubescent girls and boys are as follows: a. On July 23, 2014, a user posted a topic in the Webcams-Boys forum that contained numerous images depicting child pornography and child eroticaof prepubescent boys. Several of these images depicted the naked prepubescent boys lying next to each other with their legs Spread apart, exposing their genitalia, and holding their penises. 4 Case Document 1-1 Filed 06/16/15 Page 5 of 10 b. On July 11, 2014, a user posted a topic in the Hardcore-Girls-Pics forum that contained numerous images depicting child pornography and child erotica of a prepubescent girl. Several of these images depicted the naked prepubescent girl lying on what appeared to be a bed with her legs spread apart and being anally and vaginally penetrated by an adult man. 13. A private message feature was also available on the site that allowed users to send each other private messages. Finding and Accessing ?Website 19? 14. ?Website 19? Operated on a computer network, hereinafter ?the Network,? available to Internet users that is designed speci?cally to facilitate anonymous communication over the Internet. In order to access that Network, a user must install computer software that is publicly available, either by downloading software to the user?s existing web browser, downloading free software available from the network?s administrators, or downloading a publicly-available third-party application.2 Using the Network prevents someone attempting to monitor an Internet connection from learning what sites a user visits and prevents the sites the user visits from learning the user?s physical location. Because of the way the Network routes communication through other computers, traditional IP identi?cation techniques are not viable. Websites that are accessible only to users within the Network can also be set up within the Network. ?Website 19? is just such a website. A user could only reach websites like ?Website 19? if the user is operating in the Network. Advertising of Child Pornography as ?walrus? on ?Website 19? 15. While accessing ?Website 19? in an undercover capacity using an account previously seized by law enforcement, an undercover FBI agent observed the user pro?le of ?Website 19? user ?walrus.? Pro?le information on ?Website 19? may include contact 2Users may also access the Network through so?called ?gateways? on the open Internet, however, use of those gateways does not provide users with the anonymizing bene?ts of the Network. 5 Case Document 1-1 Filed 06/16/15 Page 6 of 10 information and other information that is supplied by the user. It also contains information about that user?s participation on the site, including statistical information about the user?s posts to the site and a categorization of those posts. 16. The pro?le page of user ?walrus? indicated this user originally registered an account on ?Website 19? on April 29, 2013. According to the user pro?le for ?walrus?, this user was a (Very Important Person) Member of ?Website 19?. 17. According to the statistics on the pro?le page for user ?walrus?, between April 29, 2013, and December 9, 2014, this user made a total of approximately 69 postings to ?Website 19?. Examples and descriptions of these posts are as follows: 18. On June 5, 2014, the user ?walrus? made a post entitled ?Re: Siberian Mouse Sticky Place All Your Videos Here.? This post contained a preview of images, also known as a ?contact sheet?, as well as a hyperlink to an external website containing the full ?le, and a password to open the ?le. 19. The contact sheet contained 20 images, the majority of which contained child pornography and child erotica depicting two prepubescent or early pubescent girls, including images depicting the girls with their legs spread apart, exposing their vaginas. The ?le associated with the hyperlink was not accessible to the investigating agent. 20. On June 6, 2014, the user ?walrus? made a post entitled ?Two girls playing with dildos and a man.? This post contained a contact sheet, a hyperlink to an external website containing the full ?le, and a password to open the ?le. 21. The contact sheet contained 20 images, the majority of which contained child pornography and child erotica depicting two prepubescent or early pubescent girls, including Case Document 1-1 Filed 06/16/15 Page 7 of 10 those depicting the girls with their legs Spread apart, exposing their vaginas. The ?le associated with the hyperlink was not accessible to the investigating agent. 22. On June 7, 2014, the user ?walrus? made a post on ?Website 19? entitled ?More cute webcams?. This post contained contact sheets, hyperlinks to external websites containing electronic video ?les, and a password to open the advertised ?les. 23. On May 27, 2015, an undercover FBI agent viewed several postings made by ?walrus? and accessed the electronic video ?les made available in the posting referenced in paragraph 22 of this af?davit. Using a password supplied by ?walrus? the undercover FBI agent was able to successfully download the following ?les from the links described below: a. The June 7, 2014, posting to ?Website 19? by ?walrus? included a password and a hyperlink to a ?le hosted at a website known to your af?ant, and referred to here as ?Website with the ?le name Using the password posted by ?walrus? the investigating agent was able to download the ?le, which contained 20 images, ?ve (5) of which depicted a Caucasian pre-pubescent girl, nude from the waist down, posing to expose her vagina. b. The June 7, 2014, posting to ?Website 19? by ?walrus? also included a password and a hyperlink to a ?le hosted at a website known to your af?ant, and referred to here as ?Website with the ?le name Using the password posted by ?walrus? the investigating agent was able to download the ?le, which contained a video ?le depicting a Caucasian pre-pubescent girl posing to expose her vagina using Case Document 1-1 Filed 06/16/15 Page 8 of 10 her ?ngers to spread her vagina open. c. The June 7, 2014, posting to ?Website 19? by ?walrus? also included a password and a hyperlink to a ?le hosted at ?Website with the ?le name Using the password posted by ?walrus? the investigating agent was able to download the ?le, which contained 20 images, 18 of which depicted a Caucasian pre?pubsecent girl partially clothed posing to expose her chest and vagina. d. The June 7, 2014, posting to ?Website 19? by ?walrus? also included a password and a hyperlink to a ?le hosted at ?Website with the ?le name Using the password posted by ?walrus? the investigating agent was able to download the ?le, which contained a video ?le depicting a Caucasian pre-pubescent girl dancing nude in a bathroom setting, exposing her chest and genitalia and inserting what appears to be toilet paper into her vagina and anus. 24. A foreign law enforcement agency reported to the FBI that on November 13, 2014, user ?walrus? signed into ?Website 19? using the open internet IP address 68.33.210.176. 25. In December of 2014, in response to an administrative subpoena, Comcast informed the FBI that on November 13, 2014, IP address 68.33.210.176 was assigned to subscriber ROBERT KRAMER, at 385 Long Meadow Way, Arnold, Maryland 21012. 26. Further undercover investigation revealed that between March 14 and June 1, 2015, a user of the Verizon FIOS internet account, subscribed to by KRAMER at his residence, made several hundred electronic ?les of interest available for download on a Peer-to-Peer Case Document 1-1 Filed 06/16/15 Page 9 of 10 network on the open intemet, with numerous ?les containing names, based on my training and experience, indicative of child pornography. The undercover investigator was unable to download any of the ?les of interest because a number of other users were ahead of the investigator in the queue for downloading the ?les, and the user making the ?les of interest available disconnected from the network before those users had completed their downloads, preventing the investigator from moving up in the queue. 27. On June 12, 2015, the United States District Court for the District of Maryland, Hon. Timothy J. Sullivan, authorized warrant to search the residence at 385 Long Meadow Way, Arnold, Maryland 21012, the KRAMER residence, for evidence related to the advertising of child pornography, and other child pornography traf?cking offenses. 28. On June 16, 2015, the search warrant was executed at residence. During the execution of the warrant, KRAMER waived his Miranda rights in writing and agreed to speak with investigators. During the interview, KRAMER admitted to being a member of ?Website 19? with the usemame ?walrus.? KRAMER further admitted to uploading ?les of child pornography to other users of ?Website 19? in order to increase his status on the site. KRAMER did not recall and speci?c child pornography ?les that he uploaded, and stated that he deleted them from his system after uploading them. 29. KRAMER also stated that he engaged in peer-to-peer traf?cking of pornography. Initial forensic triage of desktop computer indicates that a peer?to-peer ?le sharing program had previously been run on the computer from an external drive. 30. After initially stating that his sexual interest was in girls aged 18 and over, KRAMER later stated that he has a sexual preference for teenage girls ages 15 to 17. KRAMER Case Document 1-1 Filed 06/16/15 Page 10 of 10 admitted that some of his pornography depicted girls under 18 and as such was probably illegal 31. During execution of the search warrant a number of computers, internet enabled devices and digital storage media were seized, and are being submitted for full forensic analysis. 32. Based upon all the information set forth in this application, your Af?ant respectfully submits that there is probable cause to believe that ROBERT P. KRAMER advertised child pornography in violation of Title 18, United States Code, Section 2251(d)(1). Sworn to under the pains and penalties of perjur: a Michael A. Lipsner Special Agent, Federal Bureau of Investigation Sworn to and subscribed before me this 16th day of June, 2015 HI norabie Mark Coulson: nited States Magistrate .i?dge jun-"553% JUN 1-6 7.015 10