Case Document 3 Filed 04/11/13 Page 1 of 12 1?-Jim tn-n? mm UNITED STATES DISTRICT COURT APR 7 2973 FOR THE DISTRICT OF MARYLAND Atmrmapg fi XMT BALTIMORE DIVISION 9* mi-, IN THE MATTER OF THE APPLICATION OF THE UNITED STATES OF AMERICA FOR A SEARCH WARRANT FOR THE LAVABIT LLC, EMAIL ACCOUNT Crim. No. 34.3-0e07sAc A AFFIDAVIT IN SUPPORT OF SEARCH WARRANT Your Affiant, Daniel E. O'Donnell, Special Agent with the Federal Bureau of I Investigation, Linthicum, MD, Violent Crimes Against Children Section, Major Case Coordination Unit, being duly swom, hereby deposes and states as follows: 1. Your Affiant has been employed as a Special Agent (SA) with the Federal Bureau of Investigation (FBI) since March 2004, and is currently assigned to the FBI's Violent Crimes Against Children Section (VCAC), Major Case Coordination Unit (MCCU). Your Affiant is currently investigating federal violations concerning child pornography and the sexual exploitation of children and has gained experience through training in seminars, classes, and everyday work related to these types of investigations. Your Affiant has participated in the execution of numerous warrants involving the search and seizure of computers, computer equipment, software, and electronically stored information. 2. As a federal agent, Your Affrant is authorized to investigate violations of the laws of the United States and is a law enforcement officer with the authority to execute warrants I issued under the authority of the United States. 3. This affidavit is made in support of applications for a Search warrant for information associated with a certain account that is stored at a premises owned, maintained, 1 Case Document 3 Filed 04/11/13 Page 2 of 12 1,3-06073119 controlled, or operated by Lavabit LLC., an electronic mail/Internet service provider headquartered at 3930 McKinney Avenue, #5 76, Dallas, Texas 75204. Lavabit LLC is a web- based e-mail provider incorporated in Texas in 2004 that provides free and paid e--mail services to approximately 60,000 users. The information to be searched is described in the following paragraphs and in Attachment B. This affidavit is made in support of an application for a search warrant under Title 18, United States Code (U.S.C.) 2251 and 2252A, involving the use of a computer in or affecting interstate commerce to transport, advertise, receive, distribute, possess and/or access child pornography; to require Lavabit LLC. to disclose to the government records and other information in its possession pertaining to the subscriber or customer associated with the electronic mail account (e-mail), joey006@lavabit.com, more particularly described in Attachment A. 4. Your Affiant is requesting authority to search the e-mail account where the items specified in Attachment A may be found, and to seize all items listed in Attachment as instrumentalities, fruits, and evidence of crime. 5. Since this affidavit is being submitted for the limited purpose of securing a search warrant, I have not included each and every fact known to me conceming this investigation. I have set forth only the facts I believe necessary to establish probable cause to believe that evidence, fruits, and instrumentalities of the violations of Title 13, U.S.C. 2251 and 2252A, involving the use of a computer in or affecting interstate commerce to advertise, transport, receive, distribute, possess andforaccess child pornography, are presently located within thee- mail accountjoey006@lavabit.corn. Where statements of others are set forth in this Affidavit, they are set forth in substance and in part. 6. This investigation, described more fully below, has revealed that the individual Case Document 3 Filed 04/11/13 Page 3 of 12 using the e-mail account joey0O6@lavabit.com did knowingly utilize e-mail to transport, advertise, receive, distribute, possess andlor access child pornography and that there is probable cause to believe there is evidence, fruits, and instrumentalities of the violations of Title 18, U.S.C. 2251 and 2252A located in the e-mail account. I STATUTORY AUTHORITY 7. This investigation concerns alleged violations of Title 18, U.S.C., 2251 and 2252A, relating to material involving the sexual exploitation of minors: a. 18 U.S.C. 225l(d)(l)(a) prohibits a person from knowingly making, printing, publishing, 'or causing to be made, printed, or published, any notice or advertisement seeking or offering to receive, exchange, buy, produce, display, distribute, or reproduce, any visual depiction, if the production of such visual depiction involves the use of a minor engaging in sexually explicit conduct and such visual depiction is of such conduct. b. 18 U.S.C. 2252A prohibits a person from knowingly mailing, transporting, shipping, receiving, distributing, reproducing for distribution, possessing pornography, as defined in 18 U.S.C. ?2256(8), when such child pornography was either mailed or shipped or transported in interstate or foreign commerce by any means, including by computer, or when such child pornography was produced using materials that had traveled in interstate or foreign commerce. BACKGROUND ON COMPUTERS AND CHILD PORNOGRAPHY - 8. Based on my knowledge, training, and experience in child exploitation and child pornography investigations, and the experience and training of other law enforcement officers Case Document3 "Filed 04/11/13 Pariiejt of 2 -- Ge 0 7SAG with whom Ihave had discussions, computers, computer technology, and the Internet have revolutionized the manner in which child pornography is produced and distributed. I I 9. Individuals who have a sexual interest in children or images of children may receive sexual gratification, stimulation, and satisfaction from contact with children, or from fantasies they may have viewing children engaged in sexual activity or in sexually suggestive- poses, such as in person, in photographs, or other visual media," or from literature describing such activity. 10. Individuals who have a sexual interest in children or images of children often maintain their collections that are in a digital or electronic fonnat in a safe, secure and private environment, such as a computer and surrounding area. These collections are often maintained for several years and are kept close by, usually at the collector's residence, to enable the individual to view the collection, which is valued highly. ll. Individuals who have a sexual interest in children or images of children also may correspond with andior meet others to share information and materials, rarely destroy correspondence from other child pornography distributorsfcollectors, conceal such correspondence as they do their sexually explicit material, and often maintain lists of names, addresses, telephone numbers, and/or e-mail accounts of individuals with whom they have been in contact and who share the same interests in child pornography. 1'2. Individuals who have a sexual interest in children or images of children prefer not to be without their child pornography for any prolonged time period. This behavior has been consistently documented by law enforcement officers involved in the investigation of child pornography. Case Document 3 Filed 04/11/13 Page 781.9 13. In addition, computer files or remnants of such files can be recovered months or even years after they have been downloaded onto a hard drive, deleted, or viewed via the Internet. Electronic files downloaded to a hard drive can be stored for years at little to no cost. Even when such files have been deleted, they may be recoverable months or years later using readily available forensic tools. 14. Collectors and distributors of child pornography also use online resources to retrieve and store child pornography, including services offered by Internet Portals such as Yahoo! and Gmail, among others. The online services allow a user to set up an account with a remote computing service that provides e-mail services as well as electronic storage of computer files in any variety of formats. A user can set up an online storage account from any computer with access to the ilntemet. Evidence of such online storage of child pornography is often found on the user's computer. Even in cases where online storage is used, however, evidence of child pomography can be found on the user's computer in most cases. 15. Further, based on my knowledge, training, and experience in child exploitation and child pornography investigations, and the experience and training of other law enforcement officers with whom I have had discussions, collectors and distributors of child pornography often utilize the same online account(s), such as an e-mail account, for an extended period of time to collect and distribute child pornography material. One of the reasons for this is to establish the account(s) as being known to other collectors and distributors of child pornography to foster the individual's ability to obtain child pornography material. Similar investigations involving the distribution of child pornography materials via e-mail have routinely identified individuals who have utilized the same e-mail account(s) for an extended period of time; many times over a multiple-year period. Case Document 3 Filed 04/11/13 Page courts have repeatedly held, collectors, and those involved with the distribution of child pornography more generally, hold onto their collections of child pornography for extended periods of time. See United'States v. Richardson, 2008 WL 818863 (W.D.N.C. 2008), aff'd, -- F.3d --, 2010 WL 2340233 (4th Cir. 20l0)(holding that information that was two months to seventeen months old was not stale because the warrant included information that the defendant transmitted child pomography usingihis AOL e-mail in June 2004 and September 2005 and had a criminal history of sex offenses involving children). PROBABLE CAUSE 17. On the Honolulu Division of the Federal Bureau of Investigation (FBI) executed a federal search warrant at a residence utilized by an individual hereafter referred to as in regards to the distribution of child pornography (CP) via his e-mail account, hereafter referred to as 18. Pursuant to this search warrant on 02/20/2013, K.K. voluntarily provided the FBI consent to assume his online identities and signed a Consent to Assume Online Identity Authorization Form. This consent was witnessed by Special Agent Ethan Cumming, FBI. As part of this consent, K.K. provided user IDs and passwords for multiple online accounts he utilized. One of these accounts was 19. On 02/23/2013 and Special Agent Cumming provided the aforementioned user IDs and consent form to your Affiant for further investigation. 20. 'On 03/05/2013, pursuant to the above consent, your Affiant accessed the e-mail account from an Internet connection at the FBI's VCAC, MCCU's offices in Linthicurn, Maryland, and reviewed the contents. Case Document 3 Filed 04/11/13 Page SAG 21. Analysis of the account revealed over 1,200 e-mails sent between this account and numerous other e-mail accounts. The majority of these e--mails appeared to contain CP imagesland videos, child erotica images and videos, or text indicative of an interest in CP and child erotica. One of these other e-mail accounts was identified as joey006@lavabit.com. 22. On 03/08/2013, your Affiant again accessed the e-mail account from an Internet connection at the FBI's VCAC, MCCU's offices in -Linthicum, Maryland, and downloaded the entire contents of the account to a computer maintained at the MCCU's offices in Linthicum, Maryland. 23. One of the e-mail accounts identified as having sent or received CP images, child erotica images, or text indicative of an interest in CP to/from was identified as joey006@1avabit.com. INVESTIGATION 24. Analysis of the e-mail account revealed e-mail conversation and multiple CP or child erotica images being sent between and joey006@lavabit.com from January 8, 2013 through January 18, 2013. Examples of these are as follows: 25. . On January 8, 2013, at approximately 08:26:13 (-0500), the user ofthe e-mail - account joey006@lavabit.com sent an e-mail to that contained one attached image, described as follows: a. An image depicting a partially naked prepubescent female wearing pink and white underwear. The underwear is being pulled open by what appears to an adult's fingers, exposing the prepubescent female's vagina. Her face is not visible in the image. 26. On January 9, 2013, at approximately 05:33:45 (-0500), the user of the e-mail account joey006@lavabit.com sent an e-mail to that contained one attached image, described as follows: Case Document 3 Filed 04/11/13 Page 8 of 12 13--0@07sts a. An image depicting a prepubescent female wearing a light green or yellow shirt and naked from the waist down. The prepubescent female is lying on her back with legs spread apart, exposing her vagina. 27. On January 18, 2013, at approximately 07:50:49 (-0500), the user ofthe e-mail account joey006@lavabit.com sent an e-mail to that contained one attached image, described as follows: a. An image depicting what appears to be a prepubescent female wearing a light blue shirt. The prepubescent female is facing what appears to be an adult wearing a white shirt and blue jeans, with the zipper open. The prepubescent female's right hand is holding the left side of the zipper open, while her left hand is on the zipper itself. No faces are visible in the image. CONCLUSION 28. Your Affiant has probable cause to believe that Lavabit LLC, 3930 McKinn_ey Avenue, #576, Dallas, Texas 75204, maintains evidence of a violation of Title 18, U.S.C. 2251 and 2252A, involving the use of a computer in or affecting interstate commerce to advertise, transport, receive, distribute, possess and/or pornography. This evidence," listed in Attachment to this affidavit, which is incorporated herein by reference, is contraband, the fruits of crime, or things otherwise criminally possessed, or property which is or has been used as the means of committing the foregoing offenses. 29. Therefore, I respectfully request that the attached warrant be issued authorizing the search and seizure of the items listed in Attachment B. 30. Pursuant to Title 18, U.S.C. 2703(g), the presence of a law enforcement officer is not required for the service or execution of this warrant. 31. Pursuant to Title, 18 U.S.C. 2705(b), I would request the Court order Lavabit LLC., not to notify any other person of the existence of this warrant for the next 180 days. This Case Document 3 Filed 04/11/13 Page 9 of 12 3.3-0607316 request is made because I believe notification of the existence of the warrant will seriously Special Agent Daniel-E. O'Donnell Federal Bureau of Investigation jeopardize the ongoing investigation. SUBSCRIBED TO AND SWORN BEFORE ME THIS DE 2-. - HONORABLE 317,' 15:41:45 A (ya/L UNITED STATES MA JUDGE . Case Document 3 Filed 04/11/13 Page SAG ATTACHMENT A ITEMS TO BE SEIZED AND SEARCHED This warrant applies to information associated with the e-mail account, joey006@laVabit.com, which is stored at premises owned, maintained, controlled, or operated by Lavabit LLC, a company headquartered at 3930 McKinney Avenue, #576, Dallas, Texas 75204. Case Document 3 Filed 04/11/13 Page 11 of 12 ;_a--ce07sia ATTACHMENT SPECIFIC ITEMS TO BE SEIZED 1. Information to be disclosed by Lavabit LLC. Lavabit LLC, is required to disclose the following information to the government for each account or identifier listed in Attachment A, for the time' from September 1, 2012, through March 28, 2013: l. The contents of all e-mails stored in the account, including copies of e-mails sent to and from the account, draft e-mails, the source and destination e-mails sent addresses associated with each e--mail, the date and time at which each e-mail was sent, and the size and length of each email; 2. All records or other information regarding the identification of the account, to include full name, physical address, telephone numbers and other identifiers, records of session times and durations, the date on which the account was created, the length of service, the types of service utilized, the IP address used to register the account, log-in IP addresses associated with session times and dates, account status, alternative e--mail addresses provided during registration, methods of connecting, log files, and means and source of payment (including any credit or batik account number); 3. All records or other information stored by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, and files; 4. All records pertaining to communications between joey006@lavabit.com and any person regarding this account, including contacts with support services and records of actions taken. 1 Case Document3 Filed 04/11/13 Page 12 of 12 II. Information to be seized by the government All information described above in Section I that constitutes fruits, evidence and instrumentalities of violations of Title 18, U.S.C. 2251 and 2252A, involving e-mail joey006@lavabit.com; including, for each account "or identifier listed on Attachment A, information pertaining to the following matters: 1. Communications to/from the e-mail account joey006@lavabit.com that demonstrate the ongoing violations of Title 18, U.S.C. 2251 and 2252A. I 2. Records relating to who created, used, or communicated with the account or identifier, including records about their identities and whereabouts.