AO T06
Document 4
Filed 02/12/2008
Page 1 of 18
me..,
~;/135J
AHldJvil [or :)r',1[(;11
=-=-=-=-~_--:--=
W,
i
10 istrid IlELA@RE
DISTRICT 0\
In the Matter of tl18 Search of
~901.
APPLICATION AND AFFlDA VIT
FOR SEARCH WARRANT
described more particularly on Attachment A
SEALED
OH,<;;;al TItle
CASE NUMOCR
08-
=20 - M
s~y:
______________________________ being duly sworn depose and I am a(n) U. S. Immigration ilnd Customs Eniorcemen~ Age~
descriptIOn and/or locallDn)
and haver"ason to believe
that
D on the person of or 00 on the premises known as \n~Ole,
in the
_
O-
---lJ"law
_
there is now concealed a certain person or properly, namely
described in Attachment B
(de~c,jl>e the
which is
(give alleged grounds lor search ,lnd seizure under Rulc 41(b) ollhe Fedr.-'al Rule$ of Criminal PrO(:edure)
evidence of a crime and contraband
in violation of Title 18 United States Code, Seclion(s) _ 2252 and 2252A
- - - - - - - - - The facts to support the issuance of a Search Warrant are as follows:
Affidavit attached.
Continued on the attached sheet and made
a part hereof.
o
Signature of Affiant
No
David B. Yeary, U.S. Immigration Sworn to before me, and subscribed in my presence
ia1 Agent us toms Enforcement
Dale
lli~
0 ..... dXjlla
S- / )0 ~~
ludge
OUirpc
at
Wilmington, Delaware
City and St
lIn; ted Sta tes Magi strate
\ 1 .......
Honorable Leonard P. Stark
0' Illdic.i"l'
Case 1:08-mj-00020-UNA
Document 4
Filed 02/12/2008
Page 2 of 18
ATL\CIII\IENT A:
DESCRIPTION OF LOCATION TO BE SEARClIEIJ
The rcsidencc I"cated at
Dover, Delaware I 'JCJ(j I
~s an end unit three-story town home. The numbcrs ' . arc located
on a post on the left hand side of the front door of the residence, this post supports a small roof over the front door. The front of the residence lIas two windows in the basclllcnt, a bay window on the 1" noor with a red front door, c 2"" noor lias tlrrec windows with red shutlers and the roof has on the fTont of the residcnce. On the side of the [lOuse the I'" noor has one bay window and one small window with red shutlers, the 2"" 1I00r has two windows with red shutlers. The roof has two dormers facing the front of the house on . The back of the town house has
a back door that opcns onto a wooden deck with steps leading to the ground. The exterior of the Town House is tan villyl siding, with tile bascment exterior being concrete all the side and brick in the front.
Case 1:08-mj-00020-UNA
Document 4
Filed 02/12/2008
Page 3 of 18
ATTACIlMI,NT
n:
DESCIUI'TrON OF ITEMS TO BE SEARCHED FOR AND SEIZED Tllc [ollowing is a description o[ the items evidencing violations o[ Title 18, United States Code, Sections 2252 and 2252A to be searched [or and seized, pursuant to the attached search WaITanl. Tile sciwrc and search of computers and computer media wtll bc conducted in accordance with the process described in the affidavit submitted in support o[ this warrant: a. images o[ child pornography, files containing images of child pornography in any [ornl, and records or materials rclating to such images, including the images discussed in this affidavit, wherever they may be slored or found, including, but not limited to:
I.
any computer, computer system and related peripherals; tapes, cassettes,
cartridges, streaming tape, commercial software and hardware, computer disks, disk drives, monitors, computer printers, modems, tape drives, disk application programs, data disks, system disk operating systems, magnetic media Hoppy disks, hardware and software operating manuals, tape systems and hard drive and other computer-related operation equipment, digital cameras, scanners, computer photographs, Graphic Interchange fonnats and/or photographs, undeveloped photographic film, slides, and other visual depictions of such Graphic Interchange formats (including, but not limited to, JPG, GIl', Til', AVI, and MPEG), any electronic data storage devices (including, but not limited to hardware, software, diskettes, backup tapes, CD-ROMS, DVD, Flash memory devices, and other storage mediums), any input/output peripheral devices (including but not limited to passwords, data security devices and related documentation), and any
Case 1:08-mj-00020-UNA
Document 4
Filed 02/12/2008
Page 4 of 18
hardware/software manuals rebled Lo or used to visually depict child pornography, to contain inlonnation pel1aining Lo the interest in child pornogr"phy; anejlor
10
distribute,
receive, or possess child pornography, as well as information perlaeniug to an interest in cilild pornography;
II.
books and magazines containing visual depictions of minors engaged in sexually
explicit conduct, as defined in 18 U.S.c. § 2256;
III.
originals, copies, and negatives of visual depictions of minors engaged in sexually
explicit conduct, as defined in 18 U.S.c. § 2256; and
LV.
motion pictures, films, videos, and other recordings of visual dcpictions of minors
engaged in sexually explicit conduct, as dcrmcd in 18 V.S.c. § 2256; b. information or correspondence pertaining to the possession, receipt or distribution of visual depictions of minors engaged in sexually explicit conduct, as defined in 18 V.S.c. § 2256, that were transmitted or received using computer, somc other facility or mcans of interstate or foreign commerce, common carrier, or the U.S. mail including, but not limited to:
l.
envelopes, letters, and other correspondence including, but not limited to,
electronic mail, chat logs, and electronic messages, establishing posscssion, access to, or transmission through interstate or foreign commerce, including by United States mail or by computer, of visual depictions of minors engaged in sexually explicit conduct, as defined in 18 US.c. § 2256; and
11.
books, ledgers, and records bearing on the production, reproduction, receipt,
shipment, orders, requests, trades, purchascs, or transactions of any kind involving the
Case 1:08-mj-00020-UNA
Document 4
Filed 02/12/2008
Page 5 of 18
transmission through interstate or forcign commercc including by United States mail or by computer of any visual depict ion of lIlinors cngaged in sexually exp liCl t conduct, as defined in 18 USc. § 2256; c, credit card infonnation, including but not limited to bills and payment records, such as records relating to the purchases discussed in this ariidavit; d, records evidencing occupancy or ownership of the premises described above, including, but not limited to, utility and telephone bills, mail envelopes, or addressed correspondence; and c, records or other items which evidence ownership or use of computer equipment or activity found in the above residence, including, but not limited to, sales receipts, bills or records regarding procurement of1l1ternet access, records regarding accounts held with ISPs and handwritten notes,
Case 1:08-mj-00020-UNA
Document 4
Filed 02/12/2008
Page 6 of 18
IN TIlE UNITED STATES DISTRICT CO(JRT
FOR TI IE DISTRICT OF DElAWARE
IN T[lE ~1J\TnJ( 01"[[11< :-iEAIW[l OF TI [E LtESlDENCF LOCATED AT:
)
)
)
)
Case No, 08 FILED UNDER SEAL
Dover, Delaware I'llJOI
)
) )
)
i\YFlDAVIT INSUPPORT OF SEARCH WARRANT
I, David B. Ye;uy, Iwing duly sworn, depuse and state Ihe following: I. I am a Special Agent with !Jniled States
Inllnib~'auon
and Customs Enforcement
("LCE"), an investig
federal law enlcHcUllent oilie"r authorized by the Seerelary of Homeland Security to request the issuance of sealch warrants, [have been employed as a Special Agent for ICE luI' approximately five years and am currently assigned to the Resident Agent in Charge Omce in vVilrnington, Delaware. My responsibilities include conducting investigations into various types of federal crimes, including crimes involving child pornography, [ have received u'aining h'om [CE regardiug child pornogI aphy, the sexual abuse of children, the behavior of prefereutial child molesters alld how to conduct investigations of child sexual exploitation and obscenity crimes. As part of my
work on these cases and in these training courses, I have observed and reviewed numerous
examples of child pornoguphy (as that term is defined in 18 U.S.c. § 2256) in alilurms of media, including computer media, In Ihe course or Illy investigative dUlies, I [,ave also had coutact, in the form of intcn~ews and meetiugs, with prclcrential child pornographers and those involved in the
Case 1:08-mj-00020-UNA
Document 4
Filed 02/12/2008
Page 7 of 18
distriLHlliutl, sale, and possession of child pornography. /\nd I !l;l\'C assisted in lit<.' execution
1l1l111l:IUUS ~(,;lrch \rananls n~btillg to illvC'sllgatioIls ur child IHHllOb'T.lpln' Cnllh'S,
or
:2. This aJlidavil
is SUlHllincd in support 01" an application II)!' a search warr;lIl( lor lhe
residence ofJonalhon A1\'lATO, located a
, Dover, Delaware 19901 (the
"Subject Premises") 'md the computer(s) located Iherein, I"r evidence of violations ofTitk tH, United Slates CHic, Sections 2252 and 2252A ("Section 2252" and "Section 22521\"). The Subject Premises is more fully described in Allacbment A.
:1.
Because Ihis affidavit is being snbmillcd for the limited purpose of securing a search
warrant, I have not included each and every raet k.nown to me concerning this investigdtion. I have set 1')lth lacts that I believe ,ue necessary
10
establish probable cause to believe that evidence of
violations of Section 2252 and Section 2252A is presently located althe Subject Premises.
RELEVANT STATrITES 4. Tllis investigation concerns alleged vioJatiollS of Section 2252 and Section 2252A, relating to material involving the sexnal exploit;ttion of minors. 5. Sections 2252 and 2252A prohibit a person li'om, IiIfer ali?, knowingly transporting, receiving, or distributing c1lild pornograpby in interstate or foreign commerce, by any means including by computer, or lI'om possessing child pornography that has been transported in interstate or foreign commerce by any means, including by compnter.
2
Case 1:08-mj-00020-UNA
Document 4
Filed 02/12/2008
Page 8 of 18
Df:FINITIONS 6. The folltming ddiniti,,,,, apply to this Aflidavit and Auadunenl B to this Allidavit:
7. "Child pornography" means any viSual Jepicljon of sexually expliCIt conduct where (a)
the prodnction of such visual depiction involves the use of a minor engaging in sexually explicit conduct; (0) such visual depiction is a digital image, computer image, or cornputer-generateJ image that is, or is indistinl,'lJishaoie from, that of a minor engaging in sexually explicit conduct; or (c) such visual depiction has ken created, adapted, or llloditieJ to appear that;m identijiable minor is engaging in sexually explicit condnet. Sec 18 II.S.C.
~
2256(8).
8. "Visual depictions" inclnJe undeveloped libn and videotape, and data stored on
computer disk or oy electronic means, which is capable of conversion into a visual image. Sec 11\ U.S.c. § 2256(5). 9. "Minor" means any person under the age of eighteen years. See 18 U.S.c. § 2256(1). 10. "Sexually explicit conduct" means actual or simnlated (a) sexual intercourse, including genital-genital, oral-genital, anal-genital or oral-anal, whether between persons of the same or opposite sex; (b) bestiality; (c) masturbation; (d) saJistie or ma50clustic abuse; or (e) lascivious exhibition of the genitals or jluoic area of any person. See 18 U.S.c. § 2256(2). II. "Internet Sen-oce Providers" ("ISPs") are commercial organizations which provide individual and business customers a range of capabilities, such a5 access to the Internet and access to other functions inciuJing web hosting, e-mail, remote storage, and co-location of computers and other communications equipment. ISPs offer customers various means by wluch illey can access the Internet, such as (a) through the lise of a "dial-up" system whcreby the customer accesses the
3
Case 1:08-mj-00020-UNA
Document 4
Filed 02/12/2008
Page 9 of 18
Internet via a telephone line; (h) hroadband-hased access, wbereby a customer accesses the
Internet via a digital sllh:..,cribcr line ("DSL") or cable ldevisionline; (c) access lo lJw fntcrnct via
declicated circuits; or (e1) " satellite-based subscrip60n that provides Internet ;ICces'. I:>Ps typ;callv charge the cuslonwr a fee based npon the type of connection the customer chooses to employ and the volume oi data (or "bandwidth"), that the connecthln supports. Many lSI's assign each
subscriber;m accounL BalTIC (often referred to as a "user n;:uIlc"or I;screen nallle"), all e-ma.il
address and
;Ul
e-mail mailbox. The subscriber, in turn, tnJically create.s a password that allows lor
restricted acccss to the account. Therefore, by using a cOIllputer equipped with a telephone or cable Illodem, the subscriber can establish cummnnication with an lSI' over a telepbone linc or through a cable system ,\lid can then access the Internet by inputLiug his or her account name ,\lid password.
12. "OOInain
Narnc~'
refers to the, COrnnlOTl, easy to rernernber
I1aIl1CS
associated wilh an
Internet Protocol address ("II' address"). Por example, a domain name of "'''''''.nsdoj.gov'' refers to the Internet Protocol address of 149.10 I .1.32. Domain names are typically strings of alphanumeric characters, with each level delimited by a period. Each level, read backwards - from right to left - further identilles paris of an org-dnizaLion. !':xamples orlirst-level, or top-level domains are typically: (a) ".com" for commercial org"dlliza60ns; (bl ".gov" for governmental
organLzatlons; (c)
'l. org 'l
for organizations; and (d) ".edu" for educational ol-g-d.nizations. Sccond
a~,
level domains will further iden6fy the organization,
for example, "usdoj.gov" further identifies
the United States governmental agency to be the Department of.Justice. Addit;onal levels Illay exist as needed until each domain is uniquely identifiable. Por example, "www.usdoj.gov" identifies the world wide web server located at the United States Department ol'Justice, which is
4
Case 1:08-mj-00020-UNA
Document 4
Filed 02/12/2008
Page 10 of 18
part of the IlllIted States government.
l:l. "Log Files" or "logs" arc records automatically produced by computer proh~ams to
document electrunic event..., {hal occur 011 cOlnpuLc.rs. Computer progl;ullS Gill n:"corcl a wide
range of events, including remote access, file transkrs, logon/1ol;ofr times, and system errors. Log, ;u·e often n;uncd based
OU
tl'e types of information thcy contain. For cxample, web logs contain
specifIc information about when a website was accessed by remote computers; access logs list specific information about when a computer was accessed from a remote locatlon; and Iile transfer logs list detailed in[orIuatlou concerning files tbat are remotely trallsfcrred.
14. "1 Iyperlink" refers to an item on a web page which, when selected, transfers the user
direcuy to anoUler location in a hypertext docull,enl or to SOlne otl'er web page. 15. A "website" consists of textu;J pages of information (called "web pages ") ;Uld associated graphic images. Tbe textual infollllatlon is stored in a specific k>rIllat known as Hyper-Text Mark up IA1.11guage ("HTML") and is transmiued Irom web selVers to various web clients via Hyper-Text Transport Protocol ("HTTP"). 16. "Unifimn Resource Locator" or "Universal Resource Locator" or "URI," is tbe unique address for a file Ulat is accessible on the Internet. For example, a common way to get to a website is to enter the URI, of the website's horne page lile ill the Web browser's address line. Additionally, any file wiUlin that website can be specified WiUl a URL. The URI, contains (a) the name of the protocol to be used to access the file resource; (b) a domain name Ulat identifies a specific computer on tbe Internet and (c) a "pathuanle." which is a hierarchical description Ulat specifies the locatiou of a fIle in that compllter.
5
Case 1:08-mj-00020-UNA
Document 4
Filed 02/12/2008
Page 11 of 18
17. rrhe tenns "records", "doClunenls", and "lllaterials", as llsed herein, include all
iIlfon11~ltion rccordeu in any {()rIn, visual or aural, and
by any 111(';)I1S,
whether in handrnad(' form
(including, blllllOl lilniled to, writings, drawings, paintings), photogr,tphic ("orIn (including, but lIot
. .
limited to, microfilm. microfiche, priu(s, slides, negatives, videotapes, Illotion !,ietures, photocopies), mechanical form (includiug, hut uot limited to, phonohTaph records, !,rintillg, typing) or decu·ical, e1eetrollic or
mah~,etic form
(includiug, hut not limited to, tape recordings, devices such
casselies, cOTllpact discs, elecfrouic or CO-ROMs,
dih~tal
mah~lclic storage
no!'py disket1es, hard di.,b,
video disks ("O\/Ds"). Persollal Digital AssistanL' ("[,DAs"), Multi Media Cards
("MMCs"), memory sticks, optjcal di.,ks. priutcr bulTers, smart canis, memory calculators, electronic dialers, or electrollic noteboob, as well
digital data Ilies and prilltouts or readouLs
from any magnetic, electrical or electronic storage device).
BACKGROUND REGARDING SEIZURE OF COMPUTERS
18. Based UpOIl lily knowledge, traiuing and experience, as well as the experience of other law enforcement personnel, I know that sea.rel'es and seizure.' of evidenee from compuLers commonly require agents to seizc most or all of the items that relaLe Lo U,at computer (including ha.rdware, softwa.re and lIlstructions) to be processed later by a qualilied computer expert in a laboratory or other controlled environment. That is almost always true because of the following:
19. Computer storage devices (like ha.rd drives, diskettes, tapes, laser disks, Bernoulli
drives ;md others) store the eqnivalellt of thousands of pages of information. Especially when the user wants to conceal criminal evidence, he or she may store it in random order with deceptive file names. This requires sea.rching authorities to examine all dIe stored data to determine whether it
G
Case 1:08-mj-00020-UNA
Document 4
Filed 02/12/2008
Page 12 of 18
is included in the search warr;ml. 'l'bis eXaJllination process can lake weeks or monlhs, depending
on the volulIle of the d"ta stored. and it would be illlpracticalto atlempt this kind of d"ta search
on-sitL' .
20. Searching computer systems ()r eriminal evidence is a highly tedmical process requiring expert skills in a properly controlled environment. The vast array of computer h,mlware and software available today requires thdt even computer experts mnst specialize in some systems and applications. Flefore a seareh is condueted, it is diflicult to know which expert shonld analyze the eomputer system and its data. A search of a compnter system is an exacting scientific procedure, which is designed to protect the integrity of Ule evidence and to recover hidden, er;bed, compressed, password-protected, and other enclyvtJ2d files. Because computer evidence is extremely vulnerable to tampering and destruction (bOUI fronl external sources and from code embedded in the system as a "booby-trap"), the controlled environment of a laboralOly is essential to its complete and accurate analysis. 21. In order to fully retrieve data from a computer system, Ute analyst needs all magnetic storage devices. as well as the central processing unit ("CPU"). In cases like ulis one, where the evidence consists partly of graphic files, the computer monitor and printer arc also essential to show the nature and quality of the graphic images U1at the system can produce. In addition. the analyst needs all assisting software (operating systems or interfaces, aud hardware drivers) and any applications software, which mal' have been used to create Ule data (wheuler stored on hard drives or on extemal media), as well as all related instructional manuals or other documentation and security devices, to understand how dnt data was created. Moreover, searching computerized infoffilation for evidence Or instrumentalities of a crime commonly requires dIe seizure of Ule
7
Case 1:08-mj-00020-UNA
Document 4
Filed 02/12/2008
Page 13 of 18
entire cOinputer's input/olJI1Hll peripheral deviccs (including rcJated doculilentation, passwords ;Uld securilY de\'ices) so lhal a qualified expert call accuratJ..'[y Ictrie\'c t.he \yslt'lll\ data ill a conlrolled cnvironillent. Peripheral devices, which allov,1 users lu cliler ~md rellle\'(' data li'ofll
stored devices, vary widely in their compatibility with other hardw,u'c 'md software. Man\' system storage devices require partjcular input/output devices iu order to reed the data on Ihe system. 22. In addition to being evidence of a crime, in cases of this sorl, there is probable cause to believe that not only the computer, but also its storage devices, the monitor, keyboard, printer,
tnOdCLll and thc other sysleul corllponenls were all used as a rncans of cOlnlIlitting offenses
involving the sexual exploitation of minors in violation of law, 'md should all be seized on that basis alone. Accordingly, permission is sought herein to seize and search com pulers and related device.1 consistent with the scope of the requested search.
BACKGROUND REGARDING THE INTERNET
23. As previously noted, your aHiant has received formal training in Ule investigation of crimes involving child pornography and d,e sexual exploitation of children. Based on this training and knowledge, and Ule experience of other law enforcement personnel involved in this investigation, I know fue following: 24. The Internet is a worldwide computer network that connecLI computers and allows communications and the transfer of data and information across state and national boundaries. A user accesses the Internet from an lSI', which connects dIem to the lnteIllcl. ln doing so, fue ISP assigns each device that accesses fue internet an IP address. Each II' address is unique. EvelY computer or device on the Internet is referenced by a unique II' address fue same
8
Case 1:08-mj-00020-UNA
Document 4
Filed 02/12/2008
Page 14 of 18
way C\'CIT It'lephOIll' lias a ulliqllC (Clq,!JOIlt' lllllllbcr. .'\11 IP ;Hldres:) is COIllposcd of f<:Hlr sets
(fihrIls kllown as "cHlcL";," r:U1g1ng ill vaJul' J"IUIJl
or
0-25.'),
~quratl'd
by dccilIlal pnillts.
,~n
exalnpk of
an II' addrcss
IS
l'J2.I('S.lO.I02. Each
DIllC;l
dnice accesses rill" ["rernel, the device liOln which
initiates access is assib'Hed
,ill [I' address.
A central authority provides each lSI' a limited block of
II' addresses for use by tilat ISI''s customers or subscribers. Most ISP's employ "dynamic" II' addressing, ti,at is, they allocate any unused II' address at ti,e time of initiation of an Internet
sesslon each tiIlle a custOJIler or suhscriber accesses the Inlernel. A dyucunic IP address is
reserved by all lSI' to be sharcd among a b'fOUP of computers over a period of nme. II' addresses might also be "static," if an lSI' assigns a user's computer a parncu[;u' I I' address which is used each time the computer accesses tile Internet. The lSI' logs tile date, time 'md duration of the Internet session lor each II' address. It call identify tile user of tilat II' address for a particular computer session from tilese records, so long as tile lSI' has retained the records dating back to that time period.
25. Photographs and other images can be used to crcatc data that can be stored in a
computer. Tllis storage can be aecomp[ished using a "scanner," which is an optical device that can recognize characters on paper ;md. by usmg specialized software, convert them to digital form. Images can also be captured from single frames of video on a computer. Alter the photograph or other image has been sc;mned into or captured by lhe computer, the computer can slore the data from the image a5 an individual "file." Such a tile is known an image lile. Computers are capable of displaying an image tile as a Ltcsimilc of the
orib~nal
image on a compuler screen.
26. The computer's capability to slore images in digital form makes it an ideal repository for c1li[d pornography. A compact disk can slore hundreds of images and thousand of pages of
9
Case 1:08-mj-00020-UNA
Document 4
Filed 02/12/2008
Page 15 of 18
lext. Thc ,ize of the e!cctronic ,torage media (collllllonly referred to as a hani drive) used in horne
COlllpllt('r~ has
grown lrernelldullsly wlthill the Jasl :-le"cral years. H:ud drives with the
llllCO[lllliOll. ~riJcse
rapanl)' or 250 gigabytes arc not
drives ran store thousand..:; of illlages at vcry
high resolution. Magnel;c storage located ill host compnters adds another dimension to the
eqllatjon. It is possilJle to llSC a video cainera to capture an ilnage, process thai ilnage in a
compllter willi a video caplure buard, alld save that image to storage all a different computer system ill allolher country. Ollce this is done, there is no readily apparent evidence at the "scene of L1le crime." Only with carefullabor
WillI Internct access, a computer user
C
transport an image file tram the Internet or
from another user's complltcr to his own computer, so that the image fi!c is stored in his computer. 'nle process of transporting an image file to one's own computer is called "downloading." The user can then display the image file on his computer screen and can choose to "save" the image on his computer and/or print out a hard copy of L1le image by using a plinter device (such as alaserjet or inkjet printer),
~R,
Importantly, computer files or remnants of such files can be recovered months or even
years after they have been downloaded onto a hard drive, deleted, or viewed via the Internet. This can occur in various ways. For example, electronic files downloaded to a hard drive can be stored for years at little to no cost. Even when such files have been deleted, LIley may be recoverable months or years later llsing readily-available forensic tools. "Then a person "deletes" a rile on a home computer, the data contained in the lile docs not actually disappear; raLller, that data remains on lhe hard drive untif it is overwritten by new data. Therefore, deleted files, or remnants
10
Case 1:08-mj-00020-UNA
Document 4
Filed 02/12/2008
Page 16 of 18
ofdclctcd files, may reside in
"fr~e
space" or "slack space" - that is, in space on thc h,u-d drive thai
10
is nol al/o,aJcd to an acti\'C file or that is left unuscd aftcr a tile has becn allocated
a
s~1
block of
storage spacc - for long pe"iods of lillle before they arc ovennittcn. In addition, a compuler's operating s)'stem may also keep a record of dele led data in a "swap" or
"r~covery" Iile.
Similarly,
Iiles thai have been viewcd ,ia the Internet arc automatically dmmloaded into a tempor;uT Inlernet directory or cache. The browser typically mainwins a Iixed amount of liard drive space devoted to these liles, and Ihe liles are only overwritten a.s they are replaced "ith more recently viewed Internet pages. Thus, Ihe ahility to retrieve residue of an electronic fite from a hard drive depends less on when the tile was downloaded or viewed th'm on a particular storage capacit)', and computer habits.
us~r's
operating system,
BACKGROUND OF INVESTIGATION 29. In April 200G, Immigration and Customs Enforcement's Cyber Crimes Center, Child Exploitation Section ("ICE/C3/CES") initiated an investigation into a criminal organization operating or controlling numerous commercial child exploiwtion websites. The investigation began witll the identification or onc snch website known as "Home Collection," which was located at http://membcrs.homecollecLus. 30. As set forth more particularly below, /he investigation soon rcvealed tllat the organization was operating in excess of 200 commercial child exploitation websites, access to which was restricted to those who paid to become "members" of the sites ("member-restricted websites"). The organization solicited customers to pay for access to tlrese member-restricted websites through the use of a number or "advertising websites." When a customer visited these advertising
II
Case 1:08-mj-00020-UNA
Document 4
Filed 02/12/2008
Page 17 of 18
\vcbsitcs, he or she was offered. IllOl1thly access lo a 1l1Clllber-restricled wchsilc ror a fee or between $79.95 alld $9~).~).r, per Il1onl.h. 'The Of/:f
aI.
From April 2006 through August 2007, ICE/C:\ICES conducted over 175 undercover
transactions at the advertising websites assuciated with this investigation, which in luru provided access to approximately 40 different member-restricted wehsites cuut:ainlllg child pornogTaphy. Each one of the undercover purchases fullowed one uf ti,e two pallerns listed below: Pattern One:
l. The ICE agent accessed a specific advertising website.
2. When the ICE agent clicked on an icon indicating that he or she wished to obtain access to a member-restricted website, the agent was redirected to an "iWest" payment website. That website required that the agent enter personal identifying infonnation, including an c-mail account and credit card infoffi1ation. In addition, the "iWest" payment website identified the specific member-restricted website that the customer was purchasing access to, through the use of a "website identifier" - a name associated with the particular website. 3. Aller the agent completed the required infonnation and clicked "submit," the agent was redirected to a second web page indicating that the payment was currently being processed. The website also stated that the agent should cheek the e-mail account the agent had typed into the iWest website and that the agent would receive an e-mail at that address providing further information on how to complete their purchase. 4. The ICE agent next received an e-mail at the e-mail address he or she had typed into the iWest payment website, which contained payment completion instructions. This e-mail
According to its website, located at http://www.l'ayl'aLcolll, PayPal is a comp,lily tilat enables any individual or business witil an e-mail address to securely, easily and Quickly send and receive payments online, using a credit card or bank account information. It is becoming an inexpensive way lor merchants to accept credit cards in their on-line storefronts instead of using a traditional payment gateway. PayPal identifies its accounts by tile name of the e-mail address{es} that a PayPal account holder provides to PayPal when registering for the account.
12
Case 1:08-mj-00020-UNA
Document 4
Filed 02/12/2008
Page 18 of 18
included a hyperlink to a PayPal account and it instructed the agent to access that account in order to complete the tl'ansaction. 5. The ICE agent completcd the transaction by again cntcring personal identifyiug infonnation into the PayPal website and ultimately by making a pa}1llent to the owner of the PayPal account via credit card transaction. After completing thc transaction via the PayPal account, thc ICE agent received a receipt from PayPal, which contained an "ItcmlProduct number." 6. The ICE agent then received an e-mail from the organization, which provided the agent with the URL for the member-restricted website the agent had gained access to, as well as password and login infonnation to enable the agent to access the site. Pattern Two: 7. The ICE agent accessed a specific advertising website. 8. When the ICE agent clicked on an icon indicating that he or she wished to obtain access to a member-restricted website, the agent was redirected to an "iWest" payment website. That website required that the agent enter personal identifying information, including an e-mail account and credit card infonnation. In addition, the "iWest" payment website identified the specific member-restricted website that the customer was purchasing access to, through the use of a "website identifier" - a name associated with the particular website. 9. After the agent completed the required infonnation and clicked "submit," the agent was redirected to a second web page that indicated that the payment was currently being processed. The web page also contained a button the agent had to click to complete the payment. 10. The agent clicked the button and was redirected to a secure PayPal payment web page. II. The ICE agent completed the transaction by again entering personal identifying infonnation into the PayPal website and ultimately by making a payment to the owner of the PayPal account via credit card transaction. After completing the transaetion via the PayPal account, the ICE agent reecived a receipt from PayPal, which contained an "ItemIProduct number."
13
Case 1:08-mj-00020-UNA
Document 4-2
Filed 02/12/2008
Page 1 of 15
12. The ICE agent then received an e-mail from the organization, which provided the agent with the URL for the member-restricted website the agent had gained acccss to, as well as password and login information to enable the agent to acccsS the site.
IDENTIFICATION OF CERTAIN PAYPAL ACCOUNTS AND
CERTAIN MEMBER-RESTRICTED WEBSITES
32. As indicatcd abovc, this criminal organization utilizes multiple PayPal accounts to process customer payments for thc monthly subscription fecs required to gain access to its child exploitation member-rcstricted websites. PayPal maintains transactional records for each such PayPal account. During its investigation, ICE/C3/CES obtained the transactional records for the particular PayPal accounts the organization used to facilitatc customcr payments for access to the member-restricted websites. The transactional records include at least the following items for each such transaction: the date of purchase, the time of purchase, the name of the customer, the subject of purchase, the amount of the purchase, the customer's IP address, the customer's e-mail address, the seller's e-mail address, an "Item !D" number and the customer's full billing address. The subject ofthe purchase refers to the notation in the "Subject" column in the PayPal transactional records listed below. 33. Thc PayPal accounts that ICE agents utilized to make the undercover transactions
described above are as follows (listed by the business name that accompanied the accollllt, the primary e-mail address that was associated with the account and any alternate e-mail addresses associated with the account):
Business Name Primary E-mail Address Alternate E-mail Addresses
Proof Soft
[email protected]
[email protected]
14
Case 1:08-mj-00020-UNA
Document 4-2
Filed 02/12/2008
Page 2 of 15
bsbso ft8 (v,vahoo. com Lencomps LTD Proof Soft Belfast LTD 7akiyv:!h 777(I/lvahoo .com a chakin0Jyahoo.com belfast! tdialj uno.com calv(ivphoenixorder.com [email protected] [email protected] MMcCary340 l@charteLnet Financia [email protected] [email protected] lencomps(Q)juno.com
Belfast LTD Financial Services
[email protected] belfast [email protected]
Proof Soft Bullet Proof Soft
pallone21 ialgmail.com rrpav(rohotmai I.com
[email protected] [email protected]
~
,
Bullet Proof Soft
PReyes 11 0 I(alhotmai Lcom
bs [email protected] bsofteawhlaJ,yahoo.com phillip reyes200 [email protected] [email protected] freeawh(GJ,yahoo.com oldervera@gmaiLcom [email protected] a [email protected] a [email protected] jufire@hotmaiLcom [email protected] a soft [email protected] al softrnlaJ,yahoo.com al soft [email protected] Carlos [email protected]
Bullct Proof Soft
mr. corax(ro gmai l. corn
Bullet Proof Soft Lencomps LTD Jfire Financial
hsh22tlash(GJ,yahoo.com [email protected] [email protected]
S Market
[email protected]
CS S'ven Enterprise
belfast [email protected]
34.
As discussed in paragraph 31, ICE agents have conducted over 175 undercover
15
Case 1:08-mj-00020-UNA
Document 4-2
Filed 02/12/2008
Page 3 of 15
transactions during the course of this investigation. The undercover transactions have identified a group of PayPal accounts that are beiug uscd to facilitate customer payments to specific child exploitation member-restricted websites. Those specific member-restricted websites could be identified in the PayPaltransactional records by looking to the descriptiou in the "Subject" column - the name associated with the particular child pomography website that the customer was purchasiug access to. The names ill this Subject column- referencing particular member restricted websites - matched the names of the "website identifiers" that ICE agents received after they had entered their personal identifYing information into the iWest payment system, during the instances in their investigation whcn the agents paid to access the member-restricted websites.
In addition to description in the Subject column, for each specific member-restricted website, the
criminal organization assigned a unique ItemlD number. These Item ill numbers also appeared in the PayPal transactional records. Those Item ID numbers corresponding to particular member restricted websites matched the "Item/Product Numbers" contained in the receipt that ICE agents received from PayPal, after those agents had paid to access the member-restricted websites during their investigation. Toward the end of November 2006, the criminal organization stopped using the listed descriptions in the Subject column to identify the specific member-restricted websites that were associated with each purchase. Therefore, for customer purchases before that point in November 2006, PayPal transactional records included both a description in the Subject column listing the particular member-restricted website that a customer was paying to access, as well as an Item ill
16
Case 1:08-mj-00020-UNA
Document 4-2
Filed 02/12/2008
Page 4 of 15
number corrcsponding to that same website. For purchases after this point in Novembcr 2IJ06, only the Item
n) number associated with the member-restricted wehsitc will be present in the
PayPal transactional records. The following descriptions were either extracted t"om the Subject column from the PayPal transactional records or from the wcbsite identifier provided to ICE agents on the iWest payment system. They were then matched with the Itcm ID number that was associated with that same website during the ICE undercover transactions:
Subject Description Home Collection 1000/Sexy Angels Home Collection 100 I!Desired Angels Home Collection 1002 SiekCR Package v5.06 Build 3638 DarkRO XP Tools v2.04 Underage Horne Angel Collection I 006/Lolita Play
Angel Collection 1007
Hem ID Number 1000 1001 1002 1003 1004 1005 1006 1007 1010 1012
Angel Collection 1010 HL PaekagelHardlovers RH Collection FD2 Collections GOL-2 Collections EXTRA Collections LOH Collections
1Ol3
1014 1016 1017 1018
17
Case 1:08-mj-00020-UNA
Document 4-2
Filed 02/12/2008
Page 5 of 15
L
LOPAR Collections NYlvlST Collections Secret Collections
Lo Editions 3/4 Collections
BD Hot Collections
BD-Photo Collections
Lust Collections
Red Vids I
Red Vids 2
Secret Content 2
Shadow Corn
Chamling
Gentle Angels
Video Nymphets
Lo Video-2 Collections Pretty X-2 Collections
Under Info-2 Collections
Lo Editions 7/8 Collections
BDM 1-4 Collections
Phang Collections
Spycarn Lolitas
Boys SayGo
LS Pics v1.0
=t=
1019 1020
1021
1026
1029
1030
1034
1035
1036
1037
1038
1047
1049
1121
1126
1128
1129
1132
1135
1138
1144
1156
1158
·
18
Case 1:08-mj-00020-UNA
Document 4-2
Filed 02/12/2008
Page 6 of 15
Video Shop CO 1 Video Shop CO2 Video Shop C03 Video Shop C04 Video Shop CDS Kidz Index Kinder Schutz Web Lolitas Mixed CPCity Extreme Material Excited Angles CP Home Video Pedoland-Kidz Porn
Kidz Index
-
1159 1160 1161 1162 1163 1177 1183 1193 1202 1215 1218 1222 1224 1227
-
THE SUBJECT OF THIS SEARCH WARRANT
35. Analysis ofthe transactional records obtained from PayPal provided the name and billing address of various customers that purchased access to at least one of the identified child pornography member-restricted websites, including the subject of this search warrant, Jonathon AMATO. 36. On January 03,2007, Jonathon AMATO made a payment to PayPal account Financial Services. The payment was for RH Collection, in thc amount of$94.95. Thc PayPal
19
Case 1:08-mj-00020-UNA
Document 4-2
Filed 02/12/2008
Page 7 of 15
transactional logs provided thc [allowing relevant inl(lrmation: Date: January 03,2007
Time: 13:27:55 PST
Namc: Jonathon AMATO
Subject: Invoice # 30598
Other II': 71.200.27.10
Gross: $94.95
From Email Address . ..
To Email Address:[email protected]
Item ID: 1013
Referral URL:
--_
http://www.2007realllard.eom/ioin/index.php?action~finish&ID~30598&key
~235ecbb5fb07b5503ed9afd
First Name: Jonathon
Last Name: AMATO
Primary Email:
Primary Address:
Night Phone:
Signup Date: November 09,2003
Last Web Access: February 03,2007
On December 22, 2006, Jonathon AMATO made a payment to PayPal account Financial Services, The payment was for RH Collection, in the amount of$94,95. The PayPal transactional logs provided the tDlIowing relevant intDrrnation: Date: December 22, 2006
Time: 6:04:43 PST
Name: Jonathon AMATO
Subject: Invoice # 25941
LAST LOGIN ll': 71.200.27.10
Gross: $94.95 From Email Address To Email Address:[email protected] Item !D: 1013 Refen'al URL: http://pedoland.biz/signup/index. php?aetion=finish&id=25941 &key= 7 ac035caOegea 6029c2e2d36d9fa7285 First Name: Jonathon Last Name: AMATO Primary Email
20
Case 1:08-mj-00020-UNA
Document 4-2
Filed 02/12/2008
Page 8 of 15
Primary Address:
Nighl Phone'
Signup Date: November 09,2003
Last Web Access: February OJ. 2007
On September 1R, 2006, Jonathon AMATO made a payment to PayPal accounl Fiuancial Services. The payment was for Home Collcetion 1000, in the amount 01'$79.95. The PayPal transactional logs provided the following relevant infonnalion: Date: September 18, 2006 Time: 17:16:32 PST Name: Jonathon AMATO LAST LOGIN IP: 71.200.27.10 Gross: $79.95 From Email Address To Email Address:[email protected] Item 10: 1000 Referral URL: None First Name: Jonathon Last Name: AMATO Primary Email Primary Address:
i
·
-
Night Phone: Signup Date: November 09, 2003
Last Web Access: February 03,2007
37. As stated in paragraph 34, ICE agents have conducted over 175 undercover transactions during the course ofthis investigation. In conducting these undercover transactions, ICE agents have identified specific subject identifiers and Item Ids that are associated with child exploitation member restricted websites. The subject identifier RH Collection refers to a child exploitation member restricted website known as "Real Hard II." ICE agents purchased access to this member restricted website on the following dates: 11/8/06; 12/1/06; 12/12106; 12/12106; and on 01/19/07. On each occasion, the transaction was either identified by the subject identifier RH
21
Case 1:08-mj-00020-UNA
Document 4-2
Filed 02/12/2008
Page 9 of 15
Collection or the Item ill 10 13. The subject identifier Home Collection 1000 refers to a child exploitation member restricted website known as" Sexy Angels." ICE Jgents pLLrchased access to this member restricted website on the following dates: 8/29106 and 10/05/06. Oil each occasion, the transaction was either identified by the subject identifier Home Collection 1000 or the Item ID 1000. 38. As indicated in paragraph 36, the PayPal transactional logs for Jonathon AMATO contained referring URLS of: http://'Nww.2007realhard.com/join/index.php?action=linish&ID=30598&kev=235 ccbb5fb07b5503ed9afd and http://pedoland.bizlsignup/index.php?action=tinish&id =25941 &kev= 7 ac035eaOe9ca6029c2e2d36d 9fa7285. The referring URL indicates the website the customer was viewing immediately prior to connecting to the PayPal payment page. This information identifies the specific website redirecting a customer to a PayPal payment page. NCMEC was able to verify that the URL listed in this paragraph contained child exploitation images. 39. Real Hard 2/RH Collection: The member restricted website associated with the subject identifier Real Hard 2 and RH Collection is known as "Real Hard 11." The member restricted website contained the following sections: "Home;" "Updates;" "Hardcore;" "Softeore;" "Video;" "Site Support;" and "Logou!." There were numerous galleries contained within the "Hardcore," "Softcore," and "Video" sections. A partial capture of the member restricted website was obtained to include the entire subdirectory "Video." The "Video" subdirectory contained eight video files and the following folders: "Boys;" "Long;" "Preteen Action;" and "Small."
22
Case 1:08-mj-00020-UNA
Document 4-2
Filed 02/12/2008
Page 10 of 15
There were a total of 44 video files in the "Video" subdirectory. The Video files depicted prepubescent female minors engaging in sexually explicit acls. The video files were not submitted to NeMEc. The following descriptions provide a sample of the content in the member restricted website: Video Hot-Blowjob (https://69.50.183.226:10010) (/VideolHot-blowjob.mpg) This video files depicts scenes of a nude prepubescent female minor engaged in oral sex with an adult male. The video starts with the female minor lying between the legs of an adult male on a bed. The female moves to the side of the male continuing oral sex on the adult male. At approx 4:35 minutes the adult male ejaculates into the females mouth. This video is approximately 5: 15 in length. Video Small (https: 1169.50.183.226: 100 I 0) (/Video/SmalllII.mpg) This video files depicts scenes of a nude prepubescent female minor engaged in sexually explicit conduct with an adult male. The video sows a nude female minor on top of an adult male lying on a bed. The adult male is inserting the tip of his penis into the vagina ofthe female.
40. Home Collection WOO/Sexy Angels:_The member restricted website associated with the subject identifiers Home Collection 1000 and "Sexy Angels" is known as "Sexy Angels." The member restricted website contained the following sections: "News;" "Photos;" "Videos;" "Software;" "Message Board;" and "Cancel or Rebill." There were approximately 9,442 images files in the "Photos" section and approximately 186 video files. Several of the images depicted lascivious displays ofthe female minors' genitalia. The female minors were displayed in sexually suggestive marmers. The images were submitted to NCMEC, but NCMEC was unable to match any of the images with known victims. The following image descriptions provide a sample ofthe content of the
23
Case 1:08-mj-00020-UNA
Document 4-2
Filed 02/12/2008
Page 11 of 15
member restricted website:
Image 0096
(http://sexyangels.freeawh.com/members/photos/old-2004-10Iitas-022/image0096)
This image displays a close up shot of a nude prepubescent female minor's vagina. There are
approxinwtely 102 images of the same prepubescent female minor in the listed gallery. The
majority of the images depict the female minor at the beach removing her bathing suit. This
image focuses on her vagina. The female minor appears to be standing, bent slightly at the
waist. The image clearly displays the female minor's anus and vagina.
Image 0059
(http://sexyangels.freeawh.comlmembers/photos/ls-magazine-0004/0059.jpg)
This image displays two nude prepubescent female minors lying on a bed. The closer
female minor is lying with her head resting on the other female minor's vagina. They are
both lying on their backs. The closer female minor has her left arm behind the left leg of
the second female minor and her right hand pointing towards her own vagina. Both of her
legs are bent at the knee and her feet are touching. There is a clear display of her vagina
and breasts. The second female minor is also lying on her back; her head slight off the bed.
Both of her legs are bent at the knee and her feet are also touching. Her legs are raised in
the air and each hand is grasping one of her legs at her shin.
Image 0027
(http://sexyangels.freeawh.com/members/photos/ls-models-0004/0027.jpg)
This image displays a close up shot of a nude prepubescent fcmale minor's anus and vagina.
The female minor has her butt and legs in the air; with her legs spread clearly displaying her
anus and vagina.
41. On June 25, 2007, a WHOIS (commercial website identifier) inquiry on IP address 71.200.27.10 was conducted and was found to be issued to a subscriber with Comcast Cable Communications. On July 9, 2007, a subpoena was issued directing Comcast Cable
Communications to supply subscriber information as well as Internet connection access logs for the person assigned/using the IP addrcss 71.200.27.10. A response from Comcast Cable Communications was received on July25, 2007, which indicated that although no information could
24
Case 1:08-mj-00020-UNA
Document 4-2
Filed 02/12/2008
Page 12 of 15
bc provided relative 10 tile suspcct transaction datcs lislcJ in paragrapil3G (request past the 180 Jay rcte\l,tion period oftbe requcskd in[orrnation), tbc below-listed accollnt subscriber inflmnalion was
r<
conlirmcd: Jonathon AMATO
_ _ Dover, Delaware 19901.
~/28/2006 Account status Activ
Email lD
42. On or about January 28, 2008, representatives of tbe United States Postal Service infonneJ ICE agents that Jonathon AMATO is cUITenlly receiving mail a _Dover, Delaware 19901. 43. On February 5, 2008 a rcsponse from a subpoena issued received. The subpoena requcstcd information on account nllmber
which was transferred to account numbe account numbe on August 30,2007, and on
10
Capital One was
. The billing statement for account number
for the period of 09/16/06 through 10/0612006 shows a transaction in the
amount of$79.95 charged to Pay Pal *LENCOMPSLTD4029357733CA on 09/1912006. The billing statement for account numbe~forthe period of 12/18/2006 through 0110412007 shows a transaction in the amount of$94.95 charged to Pay Pal BELFASTLTD4029357733CA on 12/2312006. The billing statement for account number for the period of 0111812007 through 02/07/2007 shows a transaction in
the amount of$79.95 charged to Pay PaIBULLETPROOf4029357733CA OIl 02/0112007.
25
Case 1:08-mj-00020-UNA
Document 4-2
Filed 02/12/2008
Page 13 of 15
44. On July 10,200],;1 rcsponse from a suhpoena i,,"cd to America Online Inc. (AOL) was rcceived. AOL records indicatc that screen namc 1are registered 10 Jonathon Amato. This ;'CCOllL11 is currently ;1ctive and was created on OG/!6/2001. The address and phoL1e numher iufom1ation that was provided when the accoullt was created is phone
45. Surveillance of the
Dover, Delaware 1990 I, on Febmary J,
2008, was conducted. A red Chevrolet Corvette bearing Delaware license plat~was parked in front a Dover, Delaware. A check with the Delaware Department
of Motor Vehicles indicated the liccnse plate is assigned to a 2002 Chevrolet Corvette. The owner of record of the 2002 Corvctte is Jonathon AMATO, , Dover,
Delaware. A check with the Delaware Departmcnt of Motor Vehicles also indicated that a 1998 Chevrolet pickup tmck is rcgistered to Jonathon AMATO, this vehicle was L10t present at the address. 46. On or about January 28,2008, representatives of the United Statcs Air Force Office ofSpecia! Investigations (OS!) at Dover AFB confirmed that Jonathon AMATO is an active member of the United States Air Force, stationed at Dover AFB. The following information regarding Jonathon AMATO was confinned by OSI Special Agent Amber ARMBRUSTER: AMATO, Jonathan
, - , D o v e r , D E 19901
47. Based on my previous investigative experience related to child pornography
26
Case 1:08-mj-00020-UNA
Document 4-2
Filed 02/12/2008
Page 14 of 15
invcstigations, including invcstigations of subjects who subscribed to websites offcring access to child pornography, [ havc learned that individuals who subscribc to such websites are often individuals who have a sexual interest in children and in images of children, and who download images and videos of child pornography. Based upon my knowledge, experience, and training in child pornography investigations, and thc training and experience of other law enforcement officers with whom [ have had discussions, there are certain characteristics common to individuals involved in the receipt and collection of child pornography: a. Individuals who have a sexual interest in children or images of children may
receive sexual gratification, stimulation, and satisfaction from contact with children; or from fantasies they may have viewing children engaged in sexual activity or in sexually suggestive poses, such as in person, in photographs, or other visual media; or from literature describing such activity. b. Individuals who have a sexual interest in children or images of children may
collect sexually explicit or suggestive materials involving children in a variety of media, including photographs, magazines, motion pictures, videotapes, books, slides and/or drawings or other visual media. Individuals who have a sexual interest in children or images of children oftentimes use these materials for their own sexual arousal and gratification. Further, they may use these materials to lower the inhibitions of children they are attempting to seduce, to arouse the selected child partner, or to demonstrate the desired sexual acts. c. Individuals who have a sexual interest in children or images of children almost
always possess and maintain their "hard copies" of child pornographic material, that is, their
27
Case 1:08-mj-00020-UNA
Document 4-2
Filed 02/12/2008
Page 15 of 15
throughout the world.
CONCLUSION 48. Based on the aforementioned factual information, I respectfully submit that there is probable cause to believe that Jonathan AMATO has cngaged in criminal violations of 18 U.S.c. §§ 2252 and 2252A, including the possession and/or receipt of child pornography, and that evidence, fruits, and instrumentalitics of criminal violations of 18 U.S.c. §§ 2252 and 2252A may be located at the residence described in Attachment A. 49. I, therefore, respectfully request that attached warrant be issued authorizing the search and seizure of the items listed in Attachment B.
& Customs Enforcement
SUBSCRIBED fl~WORN I'nl before me this ~~ day of ~ ~
---c-
, 2008
The HonoraJj}e Leonard P. Stark United States Magistrate Judge
ip J(, (k;
29
United States Free Forms
Canada Free Forms
United Kingdom Free Forms
Australia Free Forms