AO 106 (Rev.
~fB5)
Document 3
Filed 02/12/2008
Page 1 of 18
Affidavit fOr Search VI.
~iltitpo ~tatrz
In the Matter of the Search of
iName, address Dr tJrief des<;r;pl'on of person or properly to De
~earch~rjl
;ill iztrid QIourt
DELAWARE
DISTRICT 01
Milton, Delaware 1996 ,
described more particularly
on Attachment A
David B. Ye"ry I am a(n) that
~t~\~\)
f
APPLICATION AND AFFIDAVIT
FOR SEARCH WARRANT
CASE NUMBER
08-
J (. Jf/I
.
being duly sworn depose and say: and have reason to believe
U. S. Immigration and Customs Enforcement Agent
0
on the person of or
00 on the premises known as (n~me,
,.
;
descripholl aM/or location)
in the District of De laware there is now concealed a certain person or property, namely (describe the person or properly)
described in Attachment B
which is
(give alleged grouMs lor search and seizure under Rule 41(b) Dr the Federal Rures of Criminal Pro<;edure)
evidence of a crime and contraband
in violation of Title 18 ._.._ United States Code, Section(s) --.3..252 and 2252A nle facts to support the issuance of a Search Warrant are as follows: Affidavit attached.
-,
Continued on the attached sheet and made a part hereof.
D
Signature of Affia
No
David B. Yeary, Special Agent Sworn to before me, and subscribed in my presence
~~t---~-Wi Iming ton, D.::e..::l::::a:::wc.::a:.:r:..:e~
_
U.S. Immigration & Customs Enforcement
Date
BbN.L\. ~
f J L-\)~
at
City an
Honorable Leonard P. Stark United: States Magistrate Judge Name and Tille of Judicial Officer
Signature of Judicial Officer
Case 1:08-mj-00021-UNA
Document 3
Filed 02/12/2008
Page 2 of 18
ATTACHMENT A: DESCRIPTION OF LOCATION TO BE
The residence located at:
SEAHCH~:I>
Milton, Delaware 19968 s a single-family three-story residence, which has a reddish brown exterior with a detaehcd garagc_ The front of the house facing Chestnut Street, has two windows on (he ground /loor and tree windows on the second /loor, all windows have a white/brownish awning over eaeh window. The fronl door consists of a white storm door, with a white mailbox attached to it A picture of a Santa Claus is placed over the window of the interior front door. The front door landing area has a white/brownish awing covering it There is also white donner window un the front of the house. The left side of the hOllse four windows on the ground floor with the window closest to Chestnut, having a whitelbrownish awning, the second floor has three windows with the window closest to Chestnut, having a white/brownish awning_ There is a white donner window on the left side of the house. The right side of the house has three windows On the ground floor and three windows on the second 1100r. The window closest to Chestnut has a whitelbrown awning and an air conditioner in the window. There is a white donner window on the right side of the house. There is a small satellite dish attached to the roof at the rear of the house on the right side_
Case 1:08-mj-00021-UNA
Document 3
Filed 02/12/2008
Page 3 of 18
ATTACHMENT B:
DESCRIPTION OF ITEMS TO BE SEARCHED FOR ANn SEJZr<:O
The following is a dcscription of the itcms cvidcncing violations of Title 18, Unitcd States Code, Sections 2252 and 2252A to be searched for and seizcd, pursuant to the attached search warrant. The seizurc and search of computers and computcr media will be conducted in accordance with the process described in the affidavit submitted in support of this warrant: a. images of child pornography, files containing images of child pornography in any fDIm, and records or materials relating to such images, including the images discussed wherever they may be stored or found, including, but not limitcd to:
l.
111
this affidavit,
any computer, computcr system and relatcd peripherals; tapes, cassettes,
cartridges, streaming tape, commercial software and hardware. computer disks, disk drives, monitors, computer printers, modems, tape drives, disk application programs, data disks, system disk operating systems, magnetic media floppy disks, hardware and software operating manuals, tape systems and hard drive and other computer-related operation equipment, digital cameras, scanners, computer photographs, Graphic Interchange formats and/or photographs, undeveloped photographic film, slides, and other visual depictions of such Graphic Interchange formats (including, but not limited to, lPG, GIF, TIF, AVI, and MPEG), any c1ectronic data storage devices (including, but not limited to hardware, software, diskettes, backup tapes, CD-ROMS, DVD, Flash memory devices, and other storage mediums), any input/output peripheral devices (including but not limited to passwords, data security devices and related documentation), and any
Case 1:08-mj-00021-UNA
Document 3
Filed 02/12/2008
Page 4 of 18
hardware/software manuals related to or used to visunlly depict child pornography, to contain infonnation pertaining to the interest in ehild pornography; and/or to distribute, receive, or possess child pornography, as well as information pertaining to an interest in child pornography;
lI.
books and magazines containing visual depictions of minors engaged in sexually
explicit conduct, as defined in 18 U.S.c. § 2256;
lIl.
originals, copies, and negatives of visual depictions of minors engaged in sexually
explicit conduct, as defined in 18 U.S.c. § 2256; and
IV.
motion pictures, films, videos, and other recordings of visual depictions of minors
engaged in sexually explicit conduct, as defined in 18 U.S.c. § 2256; b. information or correspondence pertaining to the possession, receipt or distribution of visual depictions of minors engaged in sexually explicit conduct, as defined in 18 U.S.c. § 2256, that were transmitted or received using computer, some other facility or means of interstate or foreign commerce, common carrier, or the U.S. mail including, but not limited to:
I.
envelopes, letters, and other correspondence including, but not limited to,
electronic mail, chat logs, and electronic messages, establishing possession, access to, or transmission through interstate or foreign commerce, including by United States mail or by computer, of visual depictions of minors engaged in sexually explicit conduct, as defined in 18 U.S.c. § 2256 to include internet paysites Red Vids 2, Home Collection IOOllDesired Angels and Home Collection l002; and
II.
books, ledgers, and records bearing on the production, reproduction, receipt,
Case 1:08-mj-00021-UNA
Document 3
Filed 02/12/2008
Page 5 of 18
shipmcnt, orders, requcsts, trades, purchases, or transactions of any kind involving the transmission through interstate or foreign commeree including by United States mail or by computcr of any visual depiction or minors engaged in sexually explicit conduct, as defined in 18
u.s.C § 2256;
a~
c. credit card inf()[mation, including but notlimitcd tt) bills and payment rccords, such
records
relating to the purchases discussed in this affidavit, for accounts to include American Express
creditcards ....IIIIII.......
d. records evidencing occupancy or ownership of the premises described above, including, but not limited to, utility and telephone bills, mail envelopes, or addressed correspondence; and e. records or other items which evidence ownership or use of computer equipment or activity found in the above residence, including, but not limited to, sales reccipts, bills or records regarding procurement of Intemet access, records regarding accounts held with ISPs, to include Comcast Cable communications, screen names, to include notes, and handwritten
Case 1:08-mj-00021-UNA
Document 3
Filed 02/12/2008
Page 6 of 18
IN THE UNITED STATES DISTillCf COURT
FOR THE DISTRICT OF DElAWARE
IN THE. MATTER OFTIIE SCARCH OFTHE RESIDENCE LOCATED AT: ) )
)
)
Case No. 07 FILED UNDER SEAL
Mihon, Delaware 19')68
)
)
)
)
AFFIDAVIT IN SUPPORT OF SEARCH WARRANT I, David B. Yeary, being duly swom, depose and state the following:
I. I am a Special Agent with United States ImllligTation ;md Customs Enforcement
("ICE"), all investigative branch of the United States Department of IfomeLmd Security. I am a federal law enforcement officer authorized by the Secretary of Homeland Security to request the issuance of search walTants. I have been employed as a Special Agent for ICE for approximately five years and am clnTently assigned to tlle Resident Agent in Charge Office in Wilmington, Delaware. My responsibilities include conducting investigations into various types of federal crimes, including crimes involving child pornography. I have received training from ICE reg-drding child pornography, the sexual abuse of children, the behavior of preferential child molesters and bow 1.0 conduct investigations of child sexual exploitation and obscenity crimes. As part of my work on these cases and in these training courses, I have observed and reviewed nnmerous examples of child pornography (as that tenn is defiued in 18 U.S.G § 2256) in all forms of media, including computer media. In the course of my investi!,'
Case 1:08-mj-00021-UNA
Document 3
Filed 02/12/2008
Page 7 of 18
distribution, salc, ;md possession of child pornognphy. And I have assisted in the execntion 01
IlUI11CrOliS search W;-UTants relating to investigations of child pornogTaphy criIlH:S.
2. This aJfidavit is submilled in snpport of an application lor a search W'UTant I,)r the residence of Grego!)' HIIMPHREYS, located at ilton, Delaware 19968
(the "Subject Premises") and the computeds) located therein, for evidence ofviolations ofTil!e 18, United States Code, Sections 2252 and 2252A ("Section 2252" and "Section 2252A"). Tbe Subject Premises is more fully desClibed in Attachment A. 3. Because this aIlldavit is being submitted for the limited purpose of securing a search warrant, I have not included each and every fact known to me concerning this investig-dtion. I have set/orUI lacts thaI I believe arc necessal)' to establish probable eallSe
10
believe Ulat evidence of
violations of Section 2252 and Section 2252A is presently located at the Subject Premises.
RELEVANT STATIITES
4. TIris investigation concerns alleged violations of Section 2252 and Section 2252/\, relating to material involving Ule sexual exploitation of minors. 5. Sections 2252 and 2252A prolribit a person from, inler alia, knowingly transporting, receiving, or distributing clrild pornography in interstate or foreign commerce, by allY means including by computer, or from possessing child pornography that has been transported in interstate or foreign commerce by any means, including by computer.
2
Case 1:08-mj-00021-UNA
Document 3
Filed 02/12/2008
Page 8 of 18
DEFINITIONS
6. The J(Jllowing definitions apply to lhis AJJidavit and Attachment B to this AHidavit:
7. "Child jJornography" means any visual depiction or sexually explicit conduct where (a)
the production of such visual depiction involves the nse or a minor cngaging in sexually explicit conduct; (b) such visnal depiction is a digit,J image, computer image, or computer-generated image that is, or is indistinguishable Irom, that of a minor engaging in sexually explicit conduct: or (e) such visual depiction has been created, adapted, or modilIed to appear that an identiliable minor i.I engaging in sexually explicit conduct. See 18 U.S.c. § 2251;(8).
8. "Visual depiuiollS" include undevelojJed lilm and videotape, and data stored on
computer disk or by electronic means, which is capahle of conversion into a visual image. See 18 U.S.C.
~
2256(5).
9. "Minor" meaIlS any person under the age ofeigilleen years. See 18 U.S.c. § 2256(1). 10. "Sexually explicit cOllduct" me,UlS actual or simulated (a) sexual intercourse, including genital-genital, oral-genital, anal-gellital or oral-anal, whether between persons of the saIlle or opposite sex; (b) bestiality; (e) masturbation; (d) sadistic or masochistic abuse; or (e) lascivious exhibition of lhe genitals or pubic area of any perSall. See 18 U.S.c. § 2256(2). I!. "Internet Service Providers" ("ISPs") arc commercial org
3
Case 1:08-mj-00021-UNA
Document 3
Filed 02/12/2008
Page 9 of 18
Internel via a telephone line; (b) broadband-based access, whereby a customer accesses the Internet via a digital subscriber line ("DSL") or cable television line; (c) access to the Internet via dedicated circuits; or (d) a satellite-based snbscription that provides Internel access. ISPs t)Vical1y charge the customer a fcc based upon the type of connection the customer chooses to employ 'md the volume of data (or "bandwidth"), Ihal Ihe couneclion supports. Many ISPs assign each
C sn bsen'ber all account llaJne (Dilen re f'errc d to as a " user BaIne " or " screen IlaIHe ") ,an e-JllaJ'1
address and an e-mail mailbox. The subscriber, in Inrn, tyVically creates a password thai allows f,)r reslIicled access to the aecounL Therefore, by using a computer equipped wiul a telephone or cable modem, Ule subscriber can cstablish COlllnnlIlicatioll ,vith an ISP over a telephone line or through a cable system and can tlJen access U,e Internet by inpntting his or her account name and password. 12. "Dolllain Name" refers to Ule common, easy to remember names associated with an Internet Protocol addrcss ("IP address"). For exanlple, a domain n,une of "www.usdoj.gov" refers to U,e Internet Protocol address of 149.101.1.32. Domain names are typically slrings of alphanumeric characters, with each level delimited by a period. Each level, read backwards - from right to left - furtlJer ideutifies parts of all organization. Ex,unples of first-level, or top-level
· . ..II C ' orgo-illizatlons; (I) " .gov" f'or govcrnmen tal a ) ' d oma.tlls are tYI>IGl.I y: ()" .conl " lor conunerc)' a J "
organizations; (e) ",org" for organizations; and (d) ",edu" for educational org'd.nizations, Secondlevel domains ,viII furUler identify the organization, as, f'lr example, "usdqj,gov" further identifies the United States governmental agency to be the Department oUustice, Additionallevcls may exist as needed until each domain is uniquely identifiable, For example, "www.usdoj,gov" identifies tlle world wide web server located at the United States Departmeut oUustice, which is
4
Case 1:08-mj-00021-UNA
Document 3
Filed 02/12/2008
Page 10 of 18
part of the United Statcs governmcnt. 1,1 "Lop; Files" or "logs" arc records automatically produced by computer pro6'Tams to documcnt clcctronic events that occur on computers. Computer progr,uns
Gill
record a \\~de
range of events, including remote access, tile transfers, 10gon/iogolT times, and system errors. Logs
5
Case 1:08-mj-00021-UNA
Document 3
Filed 02/12/2008
Page 11 of 18
17,
~rhe
tenns '-'reeords" "doeulnents" ,md "nlaterials", as used herein, include all
l l
inforrnation recorded in
i-Uly
fonn, visual or aural, and by any
IlIC;UIS,
whether in handnlade f()nn
(including, but nol limited to, writings, drawings, paintings), photographic form (including, but not limited to, microfilm, microtiche, prints, slides, neg'dtives, videotapes, motion pictures, photocopies), mechanical form (including, but not limited to, phonograph records, printing, typing) or electrical, electronic or magnetic torrn (including, bnt not limited to, tape recordings, casselles, compact discs, electronic or magnetic storage devices such as floppy diskettes, hard disks, CD-ROMs, digital video disks (HOVOS"), Personal Digital Assistants ("PDAs"), Multi Media Cards ("MMCs"), memory sticks, optical disks, printer bulkrs, smart cards, memory calculators, electronic dialers, or electronic notebooks, as well as digital data liles and printonLs or readouts from any magnetic, electrical or electronic storage device),
BACKGROUND REGARDING SEIZURE OF COMPUTERS
18, Based upon my knowledge, training and experience, as well as the experience of other law enforcement personnel, I know that searches and seizures of evidence Ii-om computers commonly require agents to seize most or all of the items that relate to that computer (including hardware, software and instructions) to be processed later by a qualified computer expert in a laboratory or other controlled environment. That is almost always true because of the lollowing: 19, Computer storage devices (like hard drives, diskettes, tapes, laser disks, Bernoulli drives and others) store the equivalent of thousands of pages of inl')mlation. Especially when the user wants to conceal criminal evidence, he or she may store it in random order with deceptive file names. This requires searching authorities to examine all the stored data to delemline whether it
6
Case 1:08-mj-00021-UNA
Document 3
Filed 02/12/2008
Page 12 of 18
is included in the search warrant. This examination process can take wceks or months, ,!cpcnrlillp; on the volumc of the data stored, and it would be impracticaJ to attempt this kind of data scarch
on-site.
20. Searching computer systems I"l' criminal evidence is a highly terlmieaJ process requiring expert skills in a properly controlled environment. The vast arrayal' computer hardware and software available today reqnires that even computer experts must specialize in some systems and applications. Before a search is conducted, it is diJTicult to know which expert should analyze the computer syskm and itB data. A search of a computer system is au exacting scientific procedure, which is designcd to prolect the integrity of the nidence and to recover hidden, erased, compressed, password-protected, and other encrypted li!cs. Becausc computer evidcnce is extremely vulnerable to tampering and destruction (both from cxternal sources and from code embedded in the system as a "booby-trap"), the controlled emironment of a lahoratory is essential to its complete and accuratc analysis. 21. In order to fully retrieve data from a computer system, Ille analyst needs all magnetic storage devices, as well as the central proccssing unit ("CPU"). In cascs likc Illis one, where the evidence consists partly of graphic tiles, the computer monitor and printer arc also essential to show the nature and quality of the graphic images that Ille system can produce. In addition, Ille analyst needs all assisting software (operating systems or interfaces, and hardware drivers) and any applications software, which may havc been used to create the data (whether stored on hard drives or on external media), as well as all related instructional manuals or other docmnentation and security devices, to uuderstand how that data was created. Moreover, searching computerized information for evidence or instrumentalities of a crimc commonly requires Ille seizure of the
7
Case 1:08-mj-00021-UNA
Document 3
Filed 02/12/2008
Page 13 of 18
entire computer's input/outpul peripheral devices (includiug related doeumeutation, passwords and secunly devices) so thai a qualifled expert can accurately retrieve the syslcm's data in a controlled emironmenl. Peripheral devices, which allow users
10
enler and retrieve data li'om
stored devices, vary widely in their cOIllpatibility with other hanlware amI software. Many system slorage devices require particular input/ontput devices in order to read the data on the system. 22. In addition to being evidence of a crime, in cases of this sort, there is probable canse to believe that not only the compuler, bUI also iLs storage devices, the llIouilor, keyboard, printer, modem and the other system componenLs were all used as a means of committing olTenses involving the sexual exploitation of minors in violation of law, and should all be sCLzed on that basis alone. Accordingly, permission is sought herein to seize and search compnters and related devices consistent with the scope of the requested search.
BACKGROUND REGARDING THE INTERNET
23. As previously noted, your all;arlt has received formal training in the investig-,rtion of crimes invohing child pomography and the sexual exploitation of children. Based on tillS training and knowledge, and tile experience of otller law enforcement personnel involved in this investigation, I know the following: 24. The Internet is a worldwide computer network thai connecls compnters and allows commnnications and the transfer of data and infornlation across state and national boundaries. A user accesses the Internet from an ISP, which connects tllem to the Internet. In doing so, the ISP assigns each user an IP address. Each IP address is unique. Every computer or device on the Intemet is referenced by a unique IP address the same way every telephone has a
8
Case 1:08-mj-00021-UNA
Document 3
Filed 02/12/2008
Page 14 of 18
uniqne telephone number. An II' address is composed of lour sets of digits known as "octets," ranging in value (i'om 0-255, separated by decimal points. An example of an II' address is 192.1 68. 10.1 02. Each time a device (computer, modem, Personal Digital Assist;mt (PDA) eCL), accesses the Internet, the device li'OIll which initiales access is assigned an II' address. A central authority provides each lSI' a limited block of II' addresses for nse by that ISP's customers or subscribers. Most ISP's employ
"dl~lall1ic"
II' addressing, that is, they allocate any unused II'
address at the time of initiation of an Internet session each time a customer or subscriber accesses the Internet A dynamic II' address is reserved by an lSI' to be shared among a group of devices over a peciod of time. II' addresses might also be "static," if an lSI' assigns a usee's computer a particular II' address which is used each time the computer accesses the Internet. The lSI' log,; the date, time and duration of the Intemet session for each II' address. It can identify the user of that
II' address for a particular computer session li'om these records, so long as the lSI' has retained
the records dating back to that time period. 25. Photographs and other images can be used to create data that can be stored in a computer. This storage can be accomplished using a "scanner," which is an optical device that can recognize characters on paper and, by using specialized software, convert them to digital foml. Images can also be captured Ii'om single li',unes of video on a computer. After the photograph or other image has been scanned into or captured hy tI,e computer, the computer can store the data from the image as an individual "file." Snch a lile is known an image file. Computers arc capable of displaying an image lile as a facsimile of the original image on a computer screen. 26. The computer's capability to store images in digitallorm makes it an ideal repository for child pornography. A single compact disk can store hundreds of images and thonsand of pages
Case 1:08-mj-00021-UNA
Document 3
Filed 02/12/2008
Page 15 of 18
of texl. Tile size of the c!eetronie storai\e media (commonly refelTed to as a hard drivel used in home computers has gTown tremendously within the hst several years. Hard drives with the capacity of 250
h~gaby1es
arc not uncommon. These ,hives can store thonsands of images al very
high reSOIUUOlI. Ma;,'nctie storage located ill host computers adds another dimension to the eqnation. It is [Jossible to usc a ,ideo camera to capture an image, process thaI ilIlage in a computer with a ~deo capture board, amI save that image to storage on a different com[Juter system in another cOlllllry. Once this is done, there is no readily a[Jparent e~dence at the "scene of the crime." Only with careful laboratory examination of electronic storage devices is it [Jossible to recreate the evidence tr,u!. 27. WiUI Intemet access, a computer user can transport an image tile from Ule Intemet or from another user's computer to Iris own computer, so that Ule image lile is stored in his computer. The process of trans[Jorting an image file to one's mm computer is called "downloading." The User can then display Ule image file on Iris computer screen and call choose to "save" UTe image on Iris computer and/or print out a hard cO[Jy of tIle image by using a plinter
de~ee
(such
'LS
a laseljet or inkjet printer).
28. Importanuy, computer files or remnants of such liles can be recovered months or even years after they have been downloaded onto a hard drive, deleted, or viewed via the Internet. This can occUr in varions ways. For example, electronic files downloaded to a hard drive can be stored for years at little to no cost. Even when such files have been deleted, they may be recoverable months or years later using readily-available forensic tools. When a person "deletes" a tile on a home computer, Ule data contained in the file docs not actually disappear; ratlTer, that data remains on Ule hard drive until it is overwritten by new data. Thercl'ore, deleted files, or remnants
10
Case 1:08-mj-00021-UNA
Document 3
Filed 02/12/2008
Page 16 of 18
of deleted files, may reside in "free space" or "slack spacc" - that is, in space on the hard drive that is not allocated to an active file or thaI is lell unused aner a lik has been allocated to a set block of storage space - for long periods of timc bel,)re they are overwrillell. In addition, a compnter's operating system may also keep a record of deleted data in a "swap" or "recovery" file. Similarly, files th"t have been viewed via the Internet arc automatically downloaded into a temporary Internel directory or cache. The browser typically Inaintains a Ilxed amount of hard drive space devoted to these liles, and the liles are only oveIWritten as they are replaced with more recently viewed Internet pages. Thus, tl,e ability to retrieve residne of an electronic lile from a hard urive depends less on when tlK lile was dO\mloaded or viewed than on a particular user's operating system, storage capacity, and computer habits.
BACKGROUND OF INVESTIGATION 29. In April 2006, Immigration and Customs Enforcement's Cyber Crimes Center, Child Exploitation Section ("ICE/C.3jCES") initiated an investigation into a criminal organization operating or controlling numerous commercial child exploitation websites. The investigation began with tl,e identillcation of one such website known as "Home Collection," which was located at http://members.homecollec!.us. 30. As set forth more particularly below, tlK investigation soon revealed that tl,e organization was operating in excess of 200 commercial child exploitation websites, access to which was restricted to those who paid to become "members" of the sites ("member-restricted websites"). The orhwlization solicited ellStomers to pay for access to these member-restricted websites through tl,e usc of a number of "advertisillg websites." When a customer visited these advertising
I I
Case 1:08-mj-00021-UNA
Document 3
Filed 02/12/2008
Page 17 of 18
websites, hc or she was oflered monthly acccss to a member-restrictcd wcbsitc for a fec of hetwecn $79.95 and $99.95 per month. Thc org
I. The ICE agent accessed a specific advertising website. 2. When the ICE agent clicked on an icon indicating that he or she wished to obtain access to a member-restricted website, the agent was redirected to an "iWest" payment website. That website required that the agent enter personal identifying information, including an e-mail account and credit card information. In addition, the "iWest" payment website identified the specific member-restricted website that the customer was purchasing access to, through the use of a "website identifier" - a name associated with the particular website. 3. After the agent completed the required information and clicked "submit," the agent was redirected to a second web page indicating that the payment was currently being processed. The website also stated that the agent should check the e-mail account the agent had typed into the iWest website and that the agent would receive an e-mail at that address providing further information on how to complete their purchase. 4. The ICE agent next received an e-mail at the e-mail address he or she had typed into the iWest payment website, which contained payment completion instructions. This e-mail included a hyperlink to a PayPal account and it instructed the agent to access that account in order to complete the transaction.
According to its website, located at http://www.Payl.al.com. PayPal is a company that enables any individual or business with an e-mail address to securely, easily and quickly send and receive payments online, using a credit card or bank account information. It is becoming an inexpensive way for merchants to accept credit cards in their on-line storefronts instead of using a traditional payment gateway. Payral identifies il't~counts by the name of the e-mail address(es) that a PayPal account holder provides to PayPal when registering for the account.
Case 1:08-mj-00021-UNA
Document 3
Filed 02/12/2008
Page 18 of 18
S. The ICE agent completed the transaction by again entering personal identifying
information into the PayPa! website and ultimately by making a payment to the owner of the PayPal account via credit card transaction. After completing the transaction via the PayPal account, the ICE agent received a receipt from PayPal, which contained an "Item/Product number." 6. The ICE agent then received an e-mail from the organization, which provided the agent with the URL for the member-restricted website the agent had gained access to, as well as password and login infonnation to enable the agent to access the site.
Pattern Two:
7. The ICE agent accessed a specific advertising website. 8. When the ICE agent clicked on an icon indicating that he or she wished to obtain access to a member-restricted website, the agent was redirected to an "iWest" payment website. That website required that the agent enter personal identifYing infomIation, including an e-mail account and credit card infonnation. In addition, the "iWest" payment website identified the specific member-restricted website that the customer was purchasing access to, through the use of a "website identifier" - a name associated with the particular website. 9. After the agent completed the required infonnation and clicked "submit," the agent was redirected to a second web page that indicated that the payment was currently being processed. The web page also contained a button the agent had to click to complete the payment. 10. The agent clicked the button and was redirected to a secure PayPal payment web page. I I. The ICE agent completed the transaction by again entering personal identifYing infonnation into the PayPal website and ultimately by making a payment to the owner of the PayPal account via credit card transaction. After completing the transaction via the PayPal account, the ICE agent received a receipt from PayPal, which contained an "lternlProduct number." 12. The ICE agent then received an e-mail from the organization, which provided the agent with the URL for the member-restricted website the agent had gained access to, as well as password and login infonnation to enable the agent to access the site.
13
Case 1:08-mj-00021-UNA
Document 3-2
Filed 02/12/2008
Page 1 of 16
IDENTIFICATION OF CERTAIN PAVPAL ACCOUNTS AND
CERTAIN MEMBER-RESTRICTED WEB SITES
32. As indicated above. this criminal organization utilizes multiple l'ayPal accounts to process customer paymcnts for the monthly subscription fees required to gain access to its child exploitation member-restricted websites. PayPal maintains transactional records for each such PayPal account During its investigation, ICEfC3/CES obtained the transactional records for the particular PayPal accounts the organization used to facilitate customer payments for access to the member-restricted websites. The transactional records include at least the following items lor each such transaction: the date of purchase, the time of purchase, the name of the customer, the subject of purchase, the amount of the purchase, the customer's II' address, the customer's e-mail address, the seller's e-mail address.an "Item ID" number and the customer's full billing address. The subject of the purchase refers to the notation in the "Subject" column in the PayPal transactional records listed below. 33. The PayPal accounts that ICE agents utilized to make the undercover transactions
described abovc are as follows (listed by the business name that accompanied the account, the primary e-mail address that was associated with the account and any alternate e-mail addresses associated with the account): Business Name Proof Soft Primary E-mail Address [email protected] Alternate E-mail Addresses [email protected] [email protected] [email protected]
Lencomps LTD Proof Soft
[email protected] a [email protected]
14
Case 1:08-mj-00021-UNA
Document 3-2
Filed 02/12/2008
Page 2 of 16
Belfast LTD
belfastltdCil)j uno.com
[email protected] emhighCiVcharter.net belfast-limitedlwi uno.com MMcCary340 [email protected] [email protected] [email protected] freewash [email protected] [email protected] bs [email protected] bsofteawhfalyahoo.com phillip reyes200 ICiVyahoo.com [email protected] [email protected] [email protected] lencom psltd!CiJ,j uno.com a [email protected] a serviceCaJ,yahoo.com [email protected] [email protected] a soft [email protected] al [email protected] al soft [email protected] Carlos S [email protected]
I
Belfast LTD Financial Services
lag89(il)nc.rr.com belfast ItdriVjuno.com
Proof Soft Bullet Proof Soft
[email protected] [email protected]
Bullet Proof Soft
PReycs II [email protected]
Bullet Proof Soft
[email protected]
Bullet Proof Soft Lencomps LTD Jtlre Financial
[email protected] itstime2changeCiVhotmail.com jufireCil)yahoo.com
S Market
webfsCiVemail.com
CS S'ven Enterprise
belfast [email protected]
34.
As discussed in paragraph 31, ICE agents have conducted over 175 undercover
transactions during the course of this investigation. The undercover transactions have identified a group of PayPal accounts that are being used to facilitate customer payments to specific child exploitation member-restricted websites. Those specific member-restricted websites could be
15
Case 1:08-mj-00021-UNA
Document 3-2
Filed 02/12/2008
Page 3 of 16
identified in the PayPal transactional records by looking to the description in the "Subject" column - the name associated with the particular child pornography website that the customer was purchasing access to. The names in this Subject column -- referencing particular member restricted websites - matched the names of the "website identifiers" that ICE agents received after they had entered their personal identifying information into the iWest payment system, during the instances in their investigation when the agents paid to access the member-restricted websites. In addition to description in the Subject column, for each specific member-restricted website, the criminal organization assigned a unique Item ID number. These Item ID numbers also appeared in the PayPal transactional records. Those Item ID numbers corresponding to particular member restricted websites matched the "ItemlProduct Numbers" contained in the receipt that ICE agents received from PayPal, after those agents had paid to access the member-restricted websites during their investigation. Toward the end of November 2006, the criminal organization stopped using the listed descriptions in the Subject column to identify the specific member-restricted websites that were associated with each purchase. Therefore, for customer purchases before that point in November 2006, PayPal transactional records included both a description in the Subject column listing the particular member-restricted website that a customer was paying to access, as well as an Item ID number corresponding to that same website. For purchases after this point in November 2006, only the Item ID number associated with the member-restricted website will be present in the PayPal transactional records. The following descriptions were
16
Case 1:08-mj-00021-UNA
Document 3-2
Filed 02/12/2008
Page 4 of 16
either extracted from the Subject column from the PayPa[ transactional rccords or from the website identifier provided to ICE agents on the iWest payment system. They wcre then matched with the Itcm ID number that was associated with that same website during the ICE undercover transactions:
Subject Description
Home Collection 1000/Sexy Angels
,
Item ID Number
1000 1001 1002 1003 1004 1005 1006 1007 1010 1012 10[3 1014 1016 1017 1018 1019 1020
Home Collection I 00 I IDesired Angels Home Collection 1002 SickCR Package v5.06 Build 3638 DarkRO XP Tools v2.04 Underage Home Angel Collection I 006/Lolita Play Angel Collection 1007 Angel Collection 1010 HL Package/Hardlovers
RH Collection
FD2 Collections GOL-2 Collections EXTRA Collections LOH Collections LOPAR Collections NYMST Collections
17
Case 1:08-mj-00021-UNA
Document 3-2
Filed 02/12/2008
Page 5 of 16
Secret Collections Lo Editions 3/4 Collections BD Hot Collections BD-Photo Collections Lust Collections Red Vids 1 Red Vids 2 Secret Content 2 Shadow Com Charming Gentle Angels Video Nymphets Lo Video-2 Collections Pretty X-2 Collections Under Info-2 Collections Lo Editions 7/8 Collections BOM 1-4 Collections Phang Collections Spyeam Lolitas Boys Say Go LS Pics vl.O Video Shop COl Video Shop CO2
1021 1026 1029 1030 1034 1035 1036 1037 1038 1047 1049 1121 1126 1128 1129 1132 1135 1138 1144 1156 1158 1159 1160
18
Case 1:08-mj-00021-UNA
Document 3-2
Filed 02/12/2008
Page 6 of 16
Video Shop cm Video Shop CD4 Video Shop CD5
I
I 16 I 1162 1163 I 177 1183 I 193 1202 1215 1218
,
Kidz Index Kinder Schutz Web Lolitas Mixed CP City Extreme Material Excited Angles CP Home Video Pedoland-Kidz Porn Kidz Index
1222 1224 1227
THE SUBJECT OF THIS SEARCH WARRANT
35. Analysis of the transactional records obtained from PayPal provided the name and billing address of various customers that purchased access to at least one of the identified child pornography member-restricted websites, including the subject of this search warrant, Gregory HUMPHREYS. 36. On January 10,2007, Gregory HUMPHREYS made a payment to PayPal account Financial Services. The payment was for Red Vids 2 paysite, in the amount of $79.95. The PayPal transactional logs provided the following relevant information: (Information obtained from PayPal Administrative Tools web page which was furnished by
19
Case 1:08-mj-00021-UNA
Document 3-2
Filed 02/12/2008
Page 7 of 16
shows the full Credit Card numbers of and _ _This page also gives an alternate email address of airforee555(ilkol11ca~t.llel)
~l,
Date: Jan. 10, 2007 Time: 23:30:00 PST Name: Gregory HUMPHREYS Subject: Invoicc # 32829 Gross: $79.95 USD Credit Card American Ex From Email Address: To Email Address:[email protected] Item ID: 1036 Referral URL: http://www.goldexbilI.info/i wa/index. php?action=finish& id=32829&key= e8fcd287ada70788b I690cf7b266813e First Name: Gregory Last Name: HUMPHREYS Primary Email: Primary Address: Night Phone: Signup Date: September 11,2004 Last Known Web Access: March 11,2007 On November 23, 2006, Grcgory HUMPHREYS made a payment to PayPal account Bullet Proof Soft. The payment was for Desired Angels, in the amount of $79.95. The PayPal transactional logs provided the following relevant information: Date: November 23,2006 Time: 22:09:53 PST Name: Gregory HUMPHREYS Subject: Invoice # 15054 LAST LOGIN IP: 71.200.150.90 Gross: $79.95 Credit Card American Express Card From Email Address: To Email Address: [email protected]! Item ID: 1001 ReferralURL: http://sedopuaj .com/join/index.php?action=finish&id =
20
Case 1:08-mj-00021-UNA
Document 3-2
Filed 02/12/2008
Page 8 of 16
15054&key=a22d3610d49686f515a7e4e6f65a48bO First Name: Gregory Last Name: HUMPIIREYS Primary Email: Primary Address ilton, DE 19968 Night Phone' Signup Date: September 11,2004 Last Web Access: March 11,2007 On November 23,2006, Gregory HUMPHREYS made a payment to PayPal account Lencomps LTD. The payment was for Home Collection, in the amount of$99.95. The PayPal transactional logs provided the following relevant inlormation: Date: November 23,2006 Time: 22:53: I 0 PST Name: Gregory HUMPHREYS Subject: Invoice# 15064 LAST LOGIN IP: 71.200.150.90 Gross: $99.95 Credit Card American Express Card From Email Addres: To Email Address:lencompsialiuno.com Item ID: 1002 ReferralURL: http://sedopuaj.com/sb/join/index.php?action=finish&id = 15064&key=d6a20350e 7396433 770cla7999dffc29 First Name: Gregory Last Name: HUMPHREYS Primary Email' Primary Address: , Milton, DE 19968 Night Phone: Signup Date: September II, 2004 Last Web Access: March 11,2007 (Records received by this investigator in August 2008 from Yahoo's Legal Compliance Unit reflect that an account created in November of2005 in the name of Milton DE ~ is registered to a Gre 0 Humphreys ~cell phone number as
37. The subject identifier Desired Angels refers to a child exploitation member
21
Case 1:08-mj-00021-UNA
Document 3-2
Filed 02/12/2008
Page 9 of 16
restricted website known as "Desired Angels." ICE agents purchased access to this member restricted website on the following dates: 10/05/06; 11/28/06; 12112/06; 01119/07; 01/26/07. On each occasion, the transaction was either identified by the subject identifier Desired Angels or the Item ID 1001. The subject identifier Home Collection 100 I refers to a child exploitation member restricted website known as "Desired Angels." ICE agents purchased access to this member restricted website on the following dates: 08118/06; 09/07/06; 09/20/06; I0/05/06; 10/12/06; 11/01/06; 11/13/06. On each occasion, the transaction was either identified by the subject identifier Home CollectionlOOI or the Item ID 1001. The subject identifier Home Collection refers to a child exploitation member restricted website knOl'.'J1 as "Home Collection." ICE agents purchased access to this member restricted website on thefollowing dates: 11/16/06; 09/20/06; 12/26/06; 01116/07; 01/19/07; 01/23/07. On each occasion, the transaction was either identified by the subject identifier Home Collection or the Item ID 1002. The paysitc "Red Vids 2 was identified as a child pornography weosit.e through the targct PayPai accounts without an undercover purchase. 38. As indicated in paragraph 36, t.he PayPal transactional logs for Gregory
HUMPHREYS contained referring URLS of:
http://\~ww.goldexbill.info/iwalindex.php?action
=finish&id=32829&key=e8fcd287ada7078 8b 169 Oct7b266813e http://sedopuaj .comljoin/index.php?action=finish &id= 15054&key=a22d3610d49686f515a7e4e6f65a48 bO http://sedopuaj.com/sb/join/index.php?action=tinish&id =
22
Case 1:08-mj-00021-UNA
Document 3-2
Filed 02/12/2008
Page 10 of 16
15064&key=d6a20350e 73 96433 nOcla7999d ffc29
The referring URL indicates the website the customer was viewing immediately prior to connecting to the PayPal payment page. This information identifies the specific website redirecting a customer to a PayPal payment page. NCMEC was able to verifY that the URL's listed in this paragraph contained child exploitation images. 39. Home Collection lOOllDesired Angels: The member restricted website associated with the subject identifiers Home Collection 1001 and Desired Angels is known as "Desired Angels." The member restricted website contained the following sections: "Main Page;" "Photos;" "Video;" "Software;" "Msg Board;" and "Support." There were approximately 9,076 images files in the "Photos" section and approximately 119 video files. Several of the images depicted lascivious displays of the female minors' genitalia. The female minors were displayed in sexually suggestive manners. The images were submitted to NCMEC, but NCMEC was unable to match any of the images with known victims. The following image descriptions provide a sample of the content of the member restricted website: Image 0013 (http://desired.lolhosl.com/members/photos/pearl-0036/00 13.jpg) This image displays a nude prepubescent female minor sitting on the floor. Her left arm is to her side, bent at the elbow with her left hand resting on her left thigh. Her right arm is extended in front of her. Her left leg appears to be bent at the knee, perpendicular to the floor. Her right leg appears to be bent at the knee and almost parallel to the floor. Her legs are spread apart and there is a clear display of her vagina. Image 0085 (http://desired.lolhosl.com/members/photos/old-2004-10litas-0023/0085 j pg)
Case 1:08-mj-00021-UNA
Document 3-2
Filed 02/12/2008
Page 11 of 16
This image displays a close up shot ofa nude prepubescent female minor's vagina. There are approximately 102 images of the same prepubescent femal~nor in the listed gallery. The majority of the images depict the female minor at the beach removing her bathing suit. This image focuses on her vagina. The shot appears to have been taken from in front of the female minor while she is lying on her right side. Her legs are spread apart and there is a clear display of her vagina. Image 0063 (http://desired.lolhost.com!members/pholos/ls-magazine-OOO3/0063.jpg) This image displays two nude prepubescent female minors lying on the ground in what appears to be a wooded area. The female minor on the left is on her knees facing away from the camera. She is bent at the waist and her legs are spread apart so that he vagina is clearly displayed. The female minor on the right is lying on her back and left elbow facing the camera. Her right arm is bent at the elbow. She appears to be holding a piece of lood that is partially obstructing her face. Her left leg is bent at the knee resting on the ground. Her right leg is bent at the knee, perpendicular to the ground. Her legs are spread apart and there is a clear display of her vagina. 40. Home ColiectionlHome Collection 1002: The member restricted website associated with the subject identifiers Home Collection and Home Collection 1002 is known as "Home
Collection CP Archive." The member restricted website contained the following sections: "News;"
"Photos;" "Videos;" and "Software," There were numerous galleries contained within the "Video"
section. The "Photos" section contained one gallery with approximately 19 images. Several of the
images depicted lascivious displays of the female minors' genitalia. The video files depicted female
minors engaged in sexually explicit conduct with adult males. The images were not submitted to
NCMEC. The following image descriptions provide a sample of the content of/he member restricted
website:
Image 014
(http://homecollection,freeawh.com!members) (photos/relro/imageO 14)
This image displays a prepubescent female minor in what appears to be a shower. The female minor
is urinating onto the shower floor. There is a clear display of her vagina.
Video b7
(http://homecollection.freeawh,com/members) (videos/0002/b7)
24
Case 1:08-mj-00021-UNA
Document 3-2
Filed 02/12/2008
Page 12 of 16
This video dcpicts a nude prepubescent female minor cngagcd in oral copulation with an adult male. The video is approximately 30 seconds in length. The fcmale minor is lying On the adult male's stomach with her right arm by the adult male's side. It appears that she has onc leg over each of thc adult male's shoulders. Video b14 (http://homccollection.freeawh.com/members) (videos/0004/b 14)
This video depicts a nude prepubescent female minor engaged in sexual intercourse with a nude
adult male. The video is approximately 46 seconds in lcngth. The video begins with the adult male
attempting to push his penis into the female minor's vagina while the female minor is lying on her
back. The next screens show the adult male sitting on a couch with the female minor straddling his
legs. He is holding the female minor and his penis is partially in thc female minor's vagina.
41. On June 25, 2007, a WHOIS (commercial website identifier) inquiry on IP address 71.200.150.90 was conducted and was found to be issued to a subscriber with Comcast Cable Communications. On July 9, 2007, a SUbpoena was issued directing Comcast Cable Communications to supply subscriber information as well as Internet connection access logs for the person assigned/using the IP address 71.200.150.90. A response from Comcast Cable Communications was received on July 25, 2007, which indicated that although no infonnation could be provided relative to the suspect transaction dates listed in paragraph 36 (request past the 180 day retention period of the requested infonnation), the below-listed account subscriber information was confirmed: Gregory HUMPHREYS
_ _ _ Milton, DE 19968
~/1912003
Disconnected on 04/19/2007
Phone:
42. On February 5, 2008, a subpoena was issued to which requested American Express to provide monthly statements for the period January 2006 - November 2007 for credit c a r d s _ owned and suspected to have been used by Gregory HUMPHREYS to purchase access to the above-indicated sites. (Only card #
25
Case 1:08-mj-00021-UNA
Document 3-2
Filed 02/12/2008
Page 13 of 16
which was indicated as the "primary" mode of payment on each transaction, was suspected to have been used to purchase access to the indicated sights. However, information regarding card
#_
It
~as also subpoenaed, as it wa, indicated as a "back-up" mode ofpayrnent in the
event that the primary could not be debited). Pursuant to this request, payments for thc transactions listed in paragraph 36 were confirmed for American Express Credit Card: should be noted that, although both cards were reported stolen on March 14, 2007, no fraud was reported for the "primary" payment card , and all of the suspect transactions
were executed prior to March 14,2007, with over 20 transactions made after the last suspect transaction and the date the card was reported stolen. 43. On or about January 28,2008, representatives of the United States Postal Service informed ICE agents that Gregory HUMPHREYS is currently receiving mail a Milton, DE 19968. 44. On or about January 28, 2008, representatives of the United States Air Force Office of Special Investigations (OSI) at Dover AFB confirmed that Gregory HUMPHREYS is an active member of the United States Air Force, stationed at Dover AFB. The following information regarding Gregory HUMPHREYS was confirmed by OSI Special Agent Amber ARMBRUSTER: HUMPHREYS, Gregory Last Known Address: Milton, DE 19968
45. Surveillance of the residence has not placed any persons entering or exiting the residence. A check with the Delaware Department of Motor Vehicles indicated Gregory HUMPHREYS is the registered owner of a 1998 BM\V bearing Delaware plate~ and '12000
26
Case 1:08-mj-00021-UNA
Document 3-2
Filed 02/12/2008
Page 14 of 16
Nissan I'ronticr bearing Delaware plate#_t
Milton, DE. Although
these vehicles have not been observed at lIUMPHREYS' registered address, they have been observed across the street at girlfriend. 46. Bascd on my previous investigative experience related to child pornography investigatiuns, including investigations of subjects who subscribed to websites offcring access to child pornography, I havc learned that individuals who subscribe to such websites are oftcn individuals who have a sexual interest in children and in images of children, and who download images and videos of child pornography. Based upon my knowledge, experience, and training in child pornography investigations, and the training and experience of other law enforcement officers with whom I have had discussions, there are certain characteristics common (0 individuals involved in the receipt and collection of child pornography: a. Individuals who have a sexual interest in children or images of children may receive which is suspected to be the residence of a
sexual gratification, stimulation, and satisfaction from contact with children; or from fantasies they may have viewing children engaged in sexual activity or in sexually suggestive poses, such as in person, in photographs, or other visual media; or from literature describing such activity. b. Individuals who have a sexual interest in children or images of children may collect
sexually explicit or suggestive materials involving children in a variety of media, including photographs, magazines, motion pictures, videotapes, books, slides and/or drawings or other visual media. Individuals who have a sexual interest in children or images of children oftentimes use these materials for their own sexual arousal and gratification. Further, they may use these materials to
27
Case 1:08-mj-00021-UNA
Document 3-2
Filed 02/12/2008
Page 15 of 16
lower the inhibitions of children they are attempting to seduce, to arouse the selected child partner, or to demonstrate the desired sexual acts. c. Individuals who have a sexual interest in children or images of children almost always
possess and maintain their "hard copies" of child pornographic material, that is, their pictures, films, video tapes, magazines, negatives, photographs, correspondence, mailing lists, books, tape recordings, etc., in the privacy and security of their home or some other secure location. These individuals usually place high value on such materials because of the difficulty, and legal and social danger, associated with acquiring them. As a result, it is not uncommon for them to retain child pornography for long periods of time, even for years. Collectors of child pornography images often discard those images only while "culling" their collections to improve their overall quality. d. Likewise, individuals who have a sexual interest in children or images of children
often maintain their collections that are in a digital or electronic format in a safe, secure and private environment, such as a computer and surrounding area. These collections are often maintained for several years and are kept close by, usually at the collector's residence, to enable the individual to view the collection, which the individual values highly. e. Individuals who have a sexual interest in children or images of children also may
correspond with and/or meet others to share information and materials; rarely destroy correspondence from other child pornography distributors/collectors; conceal such correspondence as they do their sexually explicit material; and often maintain lists of names, addresses, and telephone numbers of individuals with whom they have been in contact and who share the same interests in child pornography.
28
Case 1:08-mj-00021-UNA
Document 3-2
Filed 02/12/2008
Page 16 of 16
f
Individuals who have a sexual interest in children or images of children prefer not to
be without their child pornography for any prolonged time period. This behavior has been documented by law enforcement officers involved in the investigation of child pornography throughollt the world. CONCLUSION 47. Based on the aforementioned factual infonnation, I respectfully submit that there is probable cause to believe that Gregory HUMPHREYS has engaged in criminal violations of 18 U.S.C. §§ 2252 and 2252A, including the possession and/or receipt of child pornography, and that evidence, fruits, and instrumentalities of criminal violations of 18 U.S.C. §§ 2252 and 2252A may be located at the residence described in Attachment A. 48. I, therefore, respectfully request that attached warrant be issued authorizing the search and seizure of the items listed in Attachment B.
Davi Special Agent U.S. Immigration
Customs Enforcement
SUBSCRIBED '!!pd SWORN before me this _~_ day of
rfl{,.-v '1'--------,
/ 200/ ~
~~~
r2s:/
The Honorable Leonard P. Stark United States Magistrate Judge
29
United States Free Forms
Canada Free Forms
United Kingdom Free Forms
Australia Free Forms