FBI Hack Against 23 Child Pornography Sites
FBI Hack Against 23 Child Pornography Sites
FBI Hack Against 23 Child Pornography Sites
Case No. \
1.
I have been employed as a Special Agent ("SA") with thc Fedcral Bureau of
Against Childrcn Scction, Major Case Coordination Unit ("MCCU"). I currently investigatc federal
violations concerning child pornography and thc sexual exploitation of children and havc gaincd
cxperience through training in seminars, classes, and everyday work related to these typcs of
investigations. I havc participated in the execution of numerous warrants involving the search and
scizure of computers, computer equipment, software, and electronically stored infonnation, in
conjunction \\ith criminal investigations pertaining to child pornography the sexual exploitation of
children. I have receivcd training in the area of child pornography and child exploitation, and have
had the opportunity to observe and review numerous examples of child pornography (as defincd in
18 U.S.C. ~ 2256) in all forms of media including computer media. I am an "investigative or law
cnforcement officer" of the United States within the meaning of Section 2510(7) of Title 18, United
States Code, and am empowered by law to conduct investigations of, and to make arrcsts for,
offenses enumerated in Section 2516 of Title 18, United States Code.
2.
I make this affidavit in support of an application for a search warrant to use a network
investigative technique ("NIT") on users of Websites 1-23 as further described in this affidavit and
its attachments.!
3.
The statements contained in this affidavit are based in part on: information provided
by FBI Special Agents; written reports about this and other investigations that I have received,
directly or indirectly, from other law enforcement agents, including foreign law enforcement
agencies as described below; information gathered from the service of administrative subpoenas; the
results of physical and electronic surveillance conducted by federal agents; independent investigation
and analysis by FBI agents/analysts and computer forensic professionals; my experience, training and
background as a Special Agent with the FBI, and communication with computer forensic
professionals assisting with the design and implementation of the NIT. This affidavit includes only
those facts that I believe are necessary to establish probable cause and does not include all of the
facts uncovered during the investigation.
RELEVANT STATUTES
4.
SS 2251(d)(I)
18 U.S.C.
SS
S 2252A(g), Engaging in
2252A(a)(2)(A)
and (b)(l),
Receiving and
and 18 U.S.C.
1 The actual names of Web sites 1-23 are known to law enforcement. The sites remains active and disclosure afthe
names of the sites would potentially alert users to the fact that law enforcement action is being taken against the sites,
potentially provoking users to notifY other users of law enforcement action, flee, andlor destroy evidence.
Accordingly, for purposes of the confidentiality and integrity of the ongoing investigation involved in this matter,
specific names and other identifYing factors have been replaced with generic terms.
(a.lf 3
2252A(a)(5)(B) and (b)(2), Knowing Access or Attempted Access With Intent to View Child
Pornography.
a.
b.
18 U.S.C. ~~ 225 I(d)(I) and (e) prohibits a person from knowingly making,
printing or publishing, or causing to be made, printed or published, or conspiring
to make, print or publish, any notice or advertisement seeking or offering: (A) to
receive, exchange, buy, produce, display, distribute, or reproduce, any visual
depiction, if the production of such visual depiction involves the use of a minor
engaging in sexually explicit conduct and such visual depiction is of such
conduct, or (B) participation in any act of sexually explicit conduct by or with
any minor for the purpose of producing a visual depiction of such conduct;
c.
d.
18 U.S.C.
SS 2252A(a)(5)(B)
S 2256(8),
between two members of a bulletin board. They are accessible only by the user
who sent/received such a message, or by the bulletin board administrator.
b.
"Child erotica," as used herein, means any material relating to minors that
serves a sexual purpose for a given individual, including fantasy writings, letters,
diaries, books, sexual aids, souvenirs, toys, costumes, drawings, and images or
videos of minors that are not sexually explicit.
c.
S 2256
(any
visual depiction of sexually explicit conduct where (a) the production of the
visual depiction involved the use of a minor engaged in sexually explicit conduct,
(b) the visual depiction is a digital image, computer image, or computergenerated image that is, or is indistinguishable from, that of a minor engaged in
sexually explicit conduct, or (c) the visual depiction has been created, adapted, or
modified to appear that an identifiable minor is engaged in sexually explicit
conduct).
d.
S I030(e)(I)
as
receives requests from a user and delivers information from the server to the
user's computer via the Internet.
g.
utilities.
h.
i.
J.
k.
connections between devices on the Internet often cross state and international
borders, even when the devices communicating with each other are in the same
state.
I.
computer accesses the Internet. IP addresses are also used by computer servers,
including web 'servers, to communicate with other computers.
n.
"Minor" means any person under the age of eighteen years. See 18 U.S.C.
Ii
2256(1).
o.
p.
Ii 2256(2).
9
q.
"Visual depictions" include undeveloped film and videotape, and data stored
on computer disk or by electronic means, which is capable of conversion into a
visual image. See 18 U.S.C.
r.
S 2256(5).
6.
.The targets of the investigative technique described herein are the administrators and
users of twenty-three (23) child pornography web sites who regularly send and receive illegal child
pornography via websites that operate as "hidden services" located on the Tor network, described
below and referred to herein as Websites 1-23. Websites 1-23 are all dedicated to the advertisement
and distribution of child pornography, the discussion of matters pertinent to child sexual abuse,
including methods and tactics offenders use to abuse children, as well as methods and tactics
offenders use to avoid law enforcement detection while perpetrating online child sexual exploitation
crimes such as those described in paragraph 4 of this affidavit.
7.
"The Onion Router" or 'Tor" network. Tor was originally designed, implemented, and deployed as a
project of the U.S. Naval Research Laboratory for the primary purpose of protecting government
communications. It is now available to the public at large. Information documenting what Tor is
and how it works is provided on the publicly accessible Tor website at www.torproject.org. In order
10
to access the Tor network, a user must install Tor software either by downloading an add-on to the
user's
web browser
bundle"
available
at
www.torproject.org.2
8.
The Tor software protects users' privacy online by bouncing their communications
around a distributed network of relay computers run by volunteers all around the world, thereby
masking the user's actual IP address which could otherwise be used to identify a user. It prevents
someone attempting to monitor an Internet connection from learning what sites a user visits, prevents
the sites the user visits from learning the user's physical location, apd it lets the user access sites
which could otherwise be blocked. Because of the way Tor routes communications through other
computers, traditional IP identification techniques are not viable. When a user on the Tor network
accesses a website, for example, the IP address of a Tor "exit node," rather than the user's actual IP
address, shows up in the website's IP log. An exit node is the last computer through which a user's
communications were routed. There is no practical way to trace the user's actual IP back through
that Tor exit node IP. In that way, using the Tor network operates similarly to a proxy server.
9.
Tor also makes it possible for users to hide their locations while offering various
kinds of services, such as web publishing, forum/website hosting, or an instant messaging server.
Within the Tor network itself, entire websites can be set up as "hidden services." "Hidden services"
operate the same as regular public websites with one critical exception. The IP address for the web
server is hidden and instead is replaced with a Tor-based web address, which is a series of algorithmgenerated characters, such as "asdlk8fs9dflku7f" followed by the suffix ".onion." A user can only
2 Users may aJso access the Tor network through so-called Ugateways" on the open Internet such as uonion.tou and
"tor2web.org," however, use of those gateways does not provide users with the anonymizing benefits of the Tor
network.
II
reach these "hidden services" if the user is using the Tor client and operating in the Tor network.
And unlike an open Internet website, is not possible to determine through public lookups the IP
address of a computer hosting a Tor "hidden service." Neither law enforcement nor users can
therefore determine the location of the computer that hosts the website through those public lookups.
Finding and Accessing Websites 1-23
10.
Because Websites 1-23 are Tor hidden services, they do not reside on the traditional
or "open" Internet. A user may only access Websites )-23 through the Tor network. Even after
connecting to the Tor network, however, a user must know the web address of one of the websites in
order to access the site. Rather than a plain language address containing the name of the website
such as www.cnn.com. a Tor web address is a series of algorithm-generated characters, such as
"asdlk8fs9dflku7f' followed by the suffix ".onion." Moreover, Tor hidden services are not indexed
like websites on the traditional Internet. Accordingly, unlike on the traditional Internet, a user may
not simply perform a Google search for the name of one of the websites on Tor to obtain and click on
a link to the site. A user might obtain the web address directly from communicating with other users
of the board, or from Internet postings describing the sort of content is available on one of the
website as well as the website's location. For example, there is a Tor "hidden service" page that is
dedicated to pedophilia and child pornography. That "hidden service" contains a section with links
to Tor hidden services that contain child pornography. Nearly all of Websites 1-23, with the
exception of Web sites 8,15 and 20, are listed in that section. Accessing Websites 1-23 therefore
requires numerous affirmative steps by the user, making it extremely unlikely that any user could
simply stumble upon Websites 1-23 without understanding its purpose and content. Accordingly,
there is probable cause to believe that, for the reasons described below, any user who successfully
12
accesses Websites 1-23 has knowingly accessed with intent to view child pornography, or attempted
to do so.
Identification and Seizure of the Computer Server Hosting Websites 1-23
11.
Through investigation, the FBI identified a single computer server that hosts Websites
1-23 and dozens of other illegal Tor network child pornography websites at
Users
of Websites 1-23 and the other websites hosted on that same computer server are engaged in the
rampant and ongoing sexual exploitation of children, including the production and dissemination of
child pornography, to include newly produced images of child pornography indicative of the ongoing
sexual abuse of children.
While possession of the data will provide important evidence concerning the criminal activity that
has occurred on the server and Websites 1-23, the identities of the administrators and users of
Websites 1-23 will remain tmknown. Sometimes, non-Tor-based websites have IP address logs that
can.be used to locate and identify the board's users. In such cases, a publicly available lookup would
be performed to determine what ISP owned the target IP address, and a subpoena would be sent to
that ISP to determine the user to which the IP address was assigned at a given date and time.
However, in the case of Websites 1-23, the logs of member activity will contain only the IP
addresses of Tor "exit nodes" utilized by board users. Those IP address logs cannot be used to locate
and identify the administrators and users of Websites 1-23. Accordingly, Websites 1-23 will remain
operating at a government facility in ~e
of time in order to locate and identify the administrators and users of Websites 1-23. Such a tactic is
necessary in order to locate and apprehend offenders including users of Websites 1-23 who are
13
engaging in the continuing sexual abuse and exploitation of children, and to locate and rescue
children from the imminent harm of ongoing abuse and exploitation.
Description of Websites 1-23 and Their Content
Website 1
12.
On June 25, 2013, an FBI Special Agent operating in the District of Maryland
connected to the Internet via the Tor Browser and accessed the Tor hidden service at the URL
ereinafter referred to as "Website 1"). Website 1 is a Tor network
hidden service whose primary purpose is the production and dissemination of new child
pornography between and among producers of child pornography-i.e.,
abuse children, document that sexual abuse via photos or video, and share that documented
sexual abuse with others. Website 1 requires users to both register and upload child pornography
to the satisfaction of the site's administrators before they are allowed to access the child
pornography on the site.
13.
A review of the initial web page revealed it was a message board that contained
the name of the site and the words "Private Sharing Community." Located below the title was
the current date and time, along with the text "Welcome, Guest." A data-entry field with a
corresponding button entitled "Login" and the text, "Please login or register. Login with
usemame and password," was located below the "Welcome Guest" text.
14.
Located below the login field were three tabs entitled "Home," "Login" and
"Register." A review of the "Home" tab, which was the default tab, revealed the following
forums and corresponding topics and posts, which were visible to any user who accessed the site:
14
Forum
Topics
Posts
General Boards
Welcome to [Website 1]
I
Read this before you register.
Open Boards - Giving you our old stuff so you can have something new
Open Girls Posts
0
0
Open Boys Posts
0
0
15.
A review of the "Welcome to [Website I]" forum revealed one topic entitled
"Welcome Q&A," which contained one post with the same title. This post was made on August
22, 20 II by a user who was listed as an administrator of the board. This post contained the
following text:
refers to child pornography images or videos that the user has personally produced by
videotaping or photographing a minor that is engaged in sexually explicit conduct. Also based
on my training and experience, I believe that the reference to the term "community" in the above
quoted post is to the community of individuals who sexually exploit children online through
15
Registration on Website I is open to any user and requires only the creation of a
usemarne and password. After registering an account via the "Registration" tab and logging into
the site as a registered user, a review of the "Home" tab revealed two additional forums in the
General Boards section, as follows:
Forum
Topics
Posts
General Boards
Rules
3
3
Read this before doing anything else and stay updated!
Application Posts
2
II
Apply here for access to Member groups. Topics is only visible to topic starter
and Admins.
18.
A review of the "Rules" forum revealed it contained the following three topics:
Getting a Membership
Filehosts for your uploads & Banned Hosts READ!
Rules
19.
The first two topics were created by a user who was listed as an administrator of
the site in September of2011 and the last topic was created by a second user who was also listed
as an administrator of the site in August of 20 II. The "Getting a Membership" topic contained
one post, made by one of the administrators, which contained the following text:
OK, so you just signed up and now you wonder where all the nice stuff is?
Memberships
We have two types of membership. You apply for a membership in the
"Application Board." Your application is only visible to you and the admins - not
to other members. Applications will then be processed by the Adrnins who will
approve or disapprove.
Private Membership - For those with new, rare or private material
Application posts must contain new or rare material of a PRETEEN (Before
Puberty) Girl or Boy or it will not be accepted and you will have to resubmit. We
do NOT accept normal family photo's of nude children or children playing on the
16
beach or elsewhere. The children must at least pose in a sexual way like spreading
legs or showing pussy.
Producer Membership - For those who are active with children.
You must prove that you are the producer of the material- check the Application
Board for the requirements for the proof material. Producers have access to all
members boards.
We look forward to your Application! The Admins.
20.
members who apply for and are accepted as private members or producer members. Those
sections of the website are accordingly accessible only to members who successfully apply for
and are granted those levels of membership.
21.
A review of the "Application Posts" forum revealed the following two topics:
Rules for Application - READ THIS BEFORE YOU APPLY! (2734 views)
Example of an Application Post
(5254 views)
A review of the above two topics revealed instructions for how to submit an application and
provided a description of an example. Among other things, these topics instructed users to
submit at least a 25MB (megabyte) file with at least 25 images or two-minute video in good
quality. Producers were further instructed to submit the following:
I. The Proof Material must be at least 5 High Quality Pictures or 15 seconds of
High Quality Video.
2. A large clear Sign (letter or A4 sized paper) with the text
"(Your Nick) for [Website I)" must be visible in the ALL Proof Material. The
Sign can be hold by the Child or placed on his / her Body.
.
3. A Candle must be visible in ALL Proof Material. The Candle must be hold by
the Child or inserted into his / her Mouth, Ass or Pussy (it does not have to be lit).
4. The Proof Material must show different positions / poses of the Child? all with
the candle and sign visible.
5. The Proof Material must show must of the Childs Body. We do not accept
close-ups images only.
6. The Proof Material can not be a part of the Entry Post. lbe proof is for the
Admins only and the Entry Post for the other Producers.
17
We hope you understand that the strict requirements is for your own and the other
Producers safety. No one likes the wrong people (scarnmers) to get into the
Producers Boards.
We look forward to your application. The Admin Team.
22.
officer, who did not apply for private or producer membership because of the website's
requirement, described above, that users post specific child pornography in order to gain those
levels of membership.
23.
After registering an account via the "Registration" tab and logging into the site as
a registered user, an additional tab entitled "My Messages" was observed in the same area as the
"Home" tab. Further, a hyperlink was observed near the bottom of the home page entitled
"Personal Messages" and the text "You've got 0 messages .... Click here to view them." This
"Personal Messages" function appeared to be a feature that allowed users to send each other
private or "personal" messages.
Website 2
24.
Between June 25 and June 28, 2013, an FBI Special Agent operating in the
District of MaI)'land connected to the Internet via the Tor Browser and accessed the Tor hidden
service at the URL
2's format, commonly known as an image board, allows users to upload images to and download
images from the website, whose primaI)' purpose is the advertisement and distribution of child
pornography. The name of Website 2 includes a word that denotes an individual with a sexual
interest in children. Though registration with a username and password is available, the site's
full content may be accessed by unregistered users. Based on a review of the site, as well as my
18
training and experience, I believe that Website 2 is primarily dedicated to the advertisement and
distribution of child pornography images and videos:
25.
A review of the initial web page of Website 2 revealed the following five
hyperlinks: News; FAQ; Rules; Safety; and Links. Located on the left side of the web page was
a separate frame with "4pedo" as the title. The following hyperlinks were located in this section:
[Website 2 name]
Front Page
[Show Directories]
[Remove Frames]
Female
Girls
Girl Videos
NonNude & Models
Girl Requests
Jailbait
Studio Girls
Little Brown Fucking Machines
Magazine and Vintage
Male
Boys
Boy Vids
NonNude & Models
Boy Requests
Male Jailbait
Magazine & Vintage
Fetish
Boy & Girl
Baby & Todds
Boy Feet
Girl Feet
Scat & Pee
Pantyhose & Undies
Mise
Random
Help
Discussion
3D & Cartoon
Security
19
Fakes
Stories
Archives
Girls
Girl Requests
Non-Nude & Models
Little Brown Fuck Machines
Studio Girls
Boys
Boy Requests
26.
Based on my training and experience, I believe that the categories available on the
site are consistent with an image board dedicated to child pornography. In particular, I believe
that the term "todds" refers to toddler-aged children and the term 'jailbait" refers to sexualized
minor children. That was confirmed by a review of images available on the website, as described
below.
27.
Accessing each of the hyperlinks in the section on the left side of the web page
revealed web pages that contained the corresponding title at the top of the page. One or more
images were typically included with this title and the majority appeared to contain child
pornography (CP) or child erotica depicting prepubescent males and females. There did not
appear to be any sections for adult pornography.
28.
For example, several images in the "News" section appeared to contain child
pornography (CP) and child erotica depicting prepubescent females. One of these images, which
was posted in a section instructing users how to delete identifying information out of images in
order to avoid detection by law enforcement or other authorities, depicted a prepubescent female
with her mouth open holding what appeared to be an adult male's penis in her right hand.
29.
Located below the title on each web page were six separate data-entry fields with
20
the corresponding titles: Name, Email, Subject, Message, File, and Password (for post and file
deletion). A "Browse" button was located next to the File field. Located below the
aforementioned fields were posts made by users. A review of these posts revealed that each post
appeared to contain an image, text, or link to an external site; along with the username of the
person who made the post ("anonymous" ifno user name was provided), the date and time of the
post, text and subject line (if entered by the user), and any replies made by other users.
30.
containing CP and child erotica depicting prepubescent males, females, toddlers, and infants.
Examples of these images are as follows, beginning with the particular section where the image
was observed:
Baby & Todds: Located next to the title of this page were two images depicting
toddler females. One of the images depicts the toddler's tongue pressed against an
adult male's penis. The second image depicts what appears to be a toddler female
holding an adult male's penis in each hand.
Boys: Located at the top of the page was an image depicting a naked
prepubescent male lying in a bathtub, exposing his genitalia.
Girls: Located in the middle of the page as approximately the fifth post from the
top was an image depicting a naked female toddler lying on her back with her legs
spread apart and raised in the air, exposing her vagina and anus.
Boy & Girl: Located near the bottom of the page as approximately the ninth post
from the top was an image depicting a naked prepubescent male who appears to
be penetrating a naked prepubescent female's vagina.
Girl Requests: Located near the middle of the page as approximately the fourth
post from the top was an image depicting a naked prepubescent female lying on
her back with her legs spread apart and raised in the air, exposing her vagina and
anus.
31.
21
No private message features were located on the web page and no registration was
required to view any of the content. Accordingly, all areas of the website are accessible to any
user of the site, whether registered or not.
Website 3
33.
connected to the Internet via the Tor Browser and accessed the Tor hidden service at the URL
onion (hereinafter referred to as "Website 3"). Website 3 appeared to be a
message board website whose primary purpose is the advertisement and distribution of child
pornography. According to statistics posted on the site, Website 3 contained a total of214 posts,
197 total topics, and 2,996 total members.
34.
On the main page of the site, located to the right of the site name was the current
date and time, along with the text, "Welcome Guest. Please login or register," and two data-entry
fields with a corresponding "Login" button. Located below the aforementioned items were the
following five hyperlinks:
Horne
Help
Search
Calendar
Login
Register
35.
Located below the above hyperlinks was one forum entitled "If your [sic]
interested in joining the forums, and Private Soceity! [sic]" This forum contained 144 Posts and
142 Topics. A review of the "If your [sic] interested in joining the forums, and Private Soceity!"
22
forum revealed the majority of the topics and posts appeared to be from users requesting access.
One post entitled "Registration
Administrator
on February 29, 2012. That post advised users of the password users could use to
on the site.
Registration
access password.
After successfully
registering and
logging into the site, a section entitled "CP," which in my training and experience refers to child
pornography,
corresponding
37.
Topics
3
40
Posts
I
I
8
43
3
5
4
I
I
4
2
I
I
A review of the various topics within the above forums revealed each topic
contained a title, the author, the number of replies, the number of views, and the last post. The
last post section included the date and time of the post as well as the author.
topic, the original post appeared at the top of the page, with any corresponding
Upon accessing a
replies to the
original post included the post thread below it. Typical posts appeared to contain text, images,
thumbnail-sized
previews ofimages,
23
referred to as ".rar" files, which are used to store and distribute multiple files within a single file),
links to external sites, or replies to previous posts.
38.
and "Introductions"
forums
revealed the majority contained general information in regards to the site, instructions for how to
post, and welcome messages between users. A review of topics within the remaining forums
revealed the majority contain~d rules for posting, as well as numerous images that appeared to
depict child pornography
are as follows:
On March 6, 2013, the user "_
posted a topic entitled "Bondage" in the
forum "Fetish" that contained numerous images depicting CP and bondage of
prepubescent females. One of these depicted a naked prepubescent female lying
face down with her hands bound behind her back and her ankles bound with red
rope or string. Her legs were spread apart, exposing her vagina.
On January 27, 2013, the user'_ posted a topic entitled "some pee ..." in the
forum "Fetish" that contained numerous images depicting CP of prepubescent
females. One of these depicted a prepubescent female who was naked from the
waist down and squatting with her legs spread apart, exposing her vagina.
39.
that approximately
Approximately
40.
registering, that allowed users to send each other private messages, referred to as "personal
messages. "
Website 4
41.
Between June 26 and June 28, 2013, an FBI Special Agent operating in the
24
District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden
service at the URL
appeared to be a message board website whose primary purpose is the advertisement and
distribution of child pornography video of minor boys. The name of the site contains both the
word "boy" and a reference to video. Statistics posted on the site's home page indicated that the
site had 5,428 members, 40,503 posts and 4,868 topics.
42.
A review of the initial web page revealed that it contained the name of the site and
an image depicting the partial face of what appeared to be a prepubescent or early pubescent
male. Located below the title was the current date and time, a welcome message, various
hyperlinks (including "Home," "Help," "Search," "Login," and "Register"), and the following
text:
. News: Want to chat with other pedo's and boy lovers? Come chat with us over at
#Boys! Find out how to connect -HERE-.
43.
pedophiles - i.e., persons with a sexual interest in prepubescent children. Accessing the "HERE-" hyperlink revealed a set of instructions for how to download Internet Relay Chat (lRC)
software and configure an account. IRC software is computer software that allows users to
engage in real-time chats over the internet, similar to an instant-messaging program. If a user
chose to download and use such software, those communications would take place on a separate
computer server than the computer server on which the website operated. #Boys would then be a
particular location on the IRe software program, similar to a chat room, where multiple users
could chat with each other.
25
44.
Located below the aforementioned items were four sections containing the
following forums, with the corresponding number of topics and posts in each:
Sections
Important Information
README
Tutorials
Videos
Non/Partial-Nude Boys
Softcore Boys
Hardcore Boys
Requests
Images
Non/Partial-Nude Boys
Naked + Hardcore Boys
MJB
Requests
Other
Chat
Broken Links
45.
Topics
Posts
3
138
3
859
60
245
1006
977
499
2306
12562
3911
73
245
81
491
956
3696
958
2225
1508
41
12349
179
Based on my training and experience, I believe that the term MJB refers to "male
jailbait," which is a reference to a sexualized minor child. Each of the above forums contained
descriptions directly underneath the forum name. For example, the forum "Hardcore Boys"
contained the description, "Hardcore Boys Only! Fucking, sucking & masturbating Boys!"
Based on my training and experience, I believe that "hardcore" refers to sexual activity involving
penetrative sexual acts such as vaginal, anal and oral sex. "Softcore" refers to nudity and sexual
activity that does not include penetrative sexual acts.
46.
A review of the various topics within the "READ ME" and "Tutorials" forums
revealed, among other things, instructions for how to post, recommended sites to use to upload
files to the website, recommended software programs or security features, and questions in
regards to these items.
26
47.
A review of the various forums and topics within the "Videos," "Images" and
"Other" sections revealed, among other things, numerous image and/or video files that appeared
to contain child pornography (CP), child erotica, or text indicative of an interest in CP. Each
topic within these forums contained a title, the author, the number of replies, the number of
views, and the last post. The last post section included the date and time of the post as well as
the author.
48.
Upon accessing a topic, the original post appeared at the top of the page, with any
corresponding replies to the original post included in the post thread below it. Typical posts
appeared to contain text, images, thumbnail previews of images, compressed files (such as ".rar"
files), links to external sites, or replies to previous posts. Examples of these include:
The user '_'
posted a topic entitled "[boy + man] Scott llyo and man" to
the Videos-Hardcore Boys forum that contained a link to an external site and
multiple preview images. One of these images appeared to contain CP depicting
two naked prepubescent or early pubescent males lying on a bed. The fmger of
one of the males appeared to be penetrating the anus of the second male.
Although the original date of this post was unknown, it remained available as of
the date the site was accessed.
The user '.
replied to a topic entitled "<xXXx+ P101 BOMB +xXXx>"
within the Images-Hardcore Naked + Boys forum that contained numerous images
which appeared to depict CP of prepubescent males. One of these images
depicting a naked prepubescent male standing with his penis exposed and
penetrating the mouth of a second prepubescent male.
49.
After successfully registering with a usemame and password, and logging into the
site, no member lists, or additional forums or topics were observed. However, a private message
feature was available, which allows users to send each other private messages (referred to as
personal messages). A review of the site revealed several posts in which users requested to be
contacted via private messages. An example of this is as follows:
27
In August of2012, two users made multiple posts to each other stating they had
sent "PM's" to each other.
Based on my training and experience, I believe that PM refers to "private messages."
Website 5
50.
connected to the Internet via the Tor Browser and accessed the Tor hidden seIVice at the URL
The initial web page of Website 5 contained the name of the site and the phrase
"Where The [sic] Boys Are." A search field was located next to the title on the right side of the
web page. Located below the title and search field on the right side of the web page were three
hyperlinks entitled "FAQ," "Register" and "Login."
52.
Located below the aforementioned items were four sections that contained various
forums, along with the corresponding number of topics and posts, as follows:
Forum
INFORMATION
Announcements
Chat
Stories
Tutorials
Links
IMAGES
NonNude
Softcore
Topics
Posts
7
203
5
32
27
8
1582
28
180
13I
58
85
649
858
28
\..>C.-
1!t/{1
Hardcore
Male Jail-Bait
Boy-Girl
Toddlers
Fetish
3D, CGL, & Fakes
Requests
VIDEO
NonNude
Softcore
Hardcore
Male Jail-Bait
Boy-Girl
Fetish
Webcams
Requests
RECENT TOPICS
64
998
56
711
II
59
16
6
14
101
32
174
717
20
205
280
2031
411
19
113
22
9
5
40
220
78
71
33
924
920
Replies
232
AnonCapper Webcam MegaPost
8
Speed up TOR downloads?
I
Poppers
HI MY FRIENDS ..I BACK WITH MY REAL NAME
5
43
Older Tonik
53.
text, Usemame
Views
57984
1021
832
1502
5695
sections entitled
The "STATISTICS"
contained a total of 11,007 posts, 1,206 total topics, and 2005 total members.
various topics within the "INFORMATION"
A review of the
questions, issues with the site, and links to other sites. Many of the posts contained text
indicative of an interest in child pornography
29
year old (and the other similar video; or the Showerboys series? Any others that
you can't stop watching?"
54.
A review of the various topics within the "IMAGES" and "VIDEO" sections
revealed the forums within these sections contained numerous pages of topics. Each topic
contained a title, the author, the number of replies, the number of views, and the last post. The
last post section included the date and time of the post as well as the author. Upon accessing a
topic, the original post appeared at the top of the page, with any corresponding replies to the
original post included the post thread below it. Typical posts appeared to contain text, images,
thumbnail previews of images, compressed files (such as ".rar" files), links to external sites, or
replies to previous posts.
55.
images depicting CP and child erotica of prepubescent males, females, toddlers, and infants;
including those depicting anal, vaginal, or oral penetration, Examples of these are as follows:
On June 21, 2013, the user ".
'posted a topic entitled "ill MY
FRIENDS ..! BACK WITH MY REAL NAME" in the IMAGES - Toddlers forum
that contained numerous images depicting CP of a male toddler. One of these
depicted a male toddler who is naked from the waist down with his legs spread
apart, exposing his genitalia. What appears to be an adult male's penis is visible
in the image positioned in between the toddler's legs.
On June 7, 2013, the user "_'
posted a topic entitled "_'
in the Video Hardcore forum that contained multiple images 'that appeared to be still-shots of a
video. These images depicted CP of an early pubescent male and a prepubescent
male. One of the images depicts the penis of the early pubescent's penis
penetrating the mouth of the prepubescent male.
On June 8, 2013, the user "_'
posted a topic entitled "Boys wearing cum" in
the Images - Hardcore forum that that contained multiple images depicting CP of
early pubescent and prepubescent males. One of these images depicted a naked
early pubescent or prepubescent male lying on his back with his legs spread apart,
exposing his genitalia and anus,
30
56.
After successfully registering for an account with a username and password, and
logging into the site, no member lists or additional forums or topics were observed. However, a
private message feature was available after registering, allowing users to send private messages
to each other. Multiple posts were observed in which members discussed the private message
capability on the site.
Website 6
57.
connected to the Internet via the Tor Browser and accessed the Tor hidden service at the URL
onion (hereinafter referred to as "Website 6"). Website 6 appeared to be a
video sharing website whose primary purpose was the advertisement and distribution of webcam
videos of minors engaging in sexually explicit conduct.
58.
websites, including the sites referred to in this affidavit as Websites 2, 16, and 22, as well as
another Tor network child pornography website that archives child pornography videos for
download. Another link on the main page of Website 6 pertains to a "wiki" website that is
dedicated to pedophilia and the sexual exploitation of children and which contains links to
dozens of child pornography websites on the Tor network.
59.
Also located on the main web page was a login section that contained two data-
entry fields and the corresponding text "Username" and "Password," various text and a section
entitled "Random Video Roll. Click on a cam below for a more detailed preview above."
Included in this section was what appeared to be a preview image for a video, a description of the
31
video, the title, the user who posted it, the number of views, the date it was posted, and tags used
to search for the video.
60.
Located directly below this section was another section entitled "25 Latest
Videos," which contained what appeared to be preview images for videos. All of the preview
images appeared to contain CP, child erotica, or clothed images of early pubescent or
prepubescent males. Placing the mouse pointer over these videos resulted in that particular video
being included in the "Random Video Roll" section, described above.
61.
A hyperlink entitled "CLICK HERE TO VIEW ALL VIDEOS" was also included
in this section. A total of 675 videos were listed as being available. Accessing this hyperlink
revealed a web page with numerous preview images for videos, along with descriptions of the
videos, the titles, the users who posted them, the number of views, the date they were posted, and
tags used to search for the videos. At the bottom of the page were hyperlinks to 28 additional
pages that appeared to contain similar content.
62.
Located above the videos was a search feature, which allowed users to search for
videos by title, description, keywords, or the usemame that uploaded them. According to this
section, approximately 26 users had uploaded videos to the site. Nine of these users uploaded at
least 15 videos.
63.
A review of uploaded videos to this site revealed numerous preview images which
appeared to contain CP and child erotica depicting early pubescent or prepubescent males, as
well as text indicative of an interest in CPo Examples of these are as follows:
On June 26, 2013, the user ,,_,
posted a video entitled "_'
along with two preview imag~these
preview images contained 12 stillshots of what appeared to be the video. These images contained CP and child
32
'f'
optional e-mail address (which was not required to be legitimate), and logging into the site as a
"Regular" member, no additional information or content was observed. However, upon
registering for an account, a user may select the "Uploader" option, which required approval
from a site moderator. According to this section, users must describe the content they want to
upload and provide samples or contact information prior to being approved.
65.
Also accessible on the main page was a link to a web page that appeared to be a
previous version of Website 6. Numerous images that appeared to be preview still-shot images
of videos containing CP or child erotica were observed on that page.
66.
A private message feature was also available on Website 6, which allowed users
to send private messages to each other. A review of the Message Inbox of the user profile
section revealed the following text: "Notice! Be sure never to give out any personal or
identifying information on any onion or Tor site! Ever!" Accessing the ''NEW PM' hyperlink in
this area revealed a web page with a data-entry field and a drop-down box that appeared to
include all registered members to the site. Only one member's usemame could be selected per
private message.
33
Website 7
67.
Between June 26 and June 28, 2013, an FBI Special Agent operating in the
District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden
service at URL
.onion/users!
(hereinafter referred
to as "Website 7"). The site appeared to be a message board whose primary purpose was the
advertisement and distribution of child pornography. According to statistics posted on the site, it
contained 2,284 total posts, 472 total topics, 856 total images, and 345 total members.
68.
On the main page of the site located below the title was the current date and time,
a section entitled "Information" that contained one forum, and two other sections that appeared to
contain information on users and statistics. The majority of the site appeared to have been
written in the Danish language. The one available forum, Nyt fra [Website 7], contained 12
topics and 32 posts. The majority of these posts were in Danish. However, one post was entitled
"To all English users" and it contained the following text:
This forum is not for English speaking users. If you write in English your user and
all your posts will deleted on sight. So if you're Swedish, Norwegian, or Danish,
please write in your native language, we will understand. And don't try to use
google translate [sic]. It does a poor job and we can tell. The Admin tearn.
69.
.The above post was made by a user who was listed as an Administrator with an
avatar - i.e., a user-selected image that is associated with a usemarne - depicting a prepubescent
female holding what appears to be an adult male's penis.
70.
After successfully registering with a usemarne, password, and e-mail account, and
logging into the site, an additional 11 forums appeared on the board index page. These forums
(the majority were in Danish), with corresponding topics and posts, were as follows:
34
Forum
Topics
Feedback og teknisk hjaelp
15
Piger
200
Drenge
16
Sider/Links
16
Historier
34
Sikkerhed
9
Dode Posts
4
66
Generel Diskussion
Praesenter dig selv
45
At Vaere Paedofil
3
4
Offtopic
71.
Posts
43
1136
89
52
85
43
22
408
152
31
16
program that allows a user to obtain an
of the meaning
A review of the various topics within the "Piger and Drenge" (which Google
Translate translates to "girls and boys") forums revealed they each contained four sub-forums,
entitled "Non nude," "Softcore,"
"Hardcore"
and "Foresporgsler."
is "queries."
35
An internet-based
translation
forums contained a title, the author, the number of replies, the number of views, and the last post.
The last post section included the date and time of the post as well as the author.
73.
Upon accessing a topic, the original post appeared at the top of the page, with any
corresponding replies to the original post included in the post thread below it. Typical posts
appeared to contain text, images, thumbnail previews of images or videos, compressed files (such
as " .rar" files), links to external sites, or replies to previous posts.
74.
A review of topics within the "Piger and Drenge" forums and sub-forums revealed
numerous posts containing images depicting child pornography (CP) and child erotica of early
pubescent females, prepubescent females, prepubescent males, toddlers, and infants. These
images included those depicting anal, vaginal, or oral penetration. Examples of these are as
follows:
On February 3, 2013, the user .~'
posted a topic entitled "Knubbiga
flickor" to Piger-Hardcore that contained numerous images depicting CP of
prepubescent females. One of these images depicted a naked prepubescent female
lying on her back with her legs spread apart, exposing her vagina and anus. What
appeared to be the torso of a naked adult male was positioned in between her legs
and his penis was penetrating her anus.
On January 27, 2012, the user ._'
posted a topic entitled "Liten gut! blir
pult" to Drenge-Hardcore that contained numerous images depicting CP of a male
toddler or infant. One of these depicted the naked toddler or infant lying on his
back with his legs spread apart, exposing his penis and anus. What appeared to be
an adult male's penis was penetrating his anus.
75.
stories, instructions for posting, and requests. Several terms that appeared to indicate an interest
in CP were observed in many of these forums.
76.
A list of members, which was accessible after registering for an account, revealed
36
that approximately 147 users made at least two posts to one or more of the forums.
Approximately 28 of these users made at least 15 posts. Approximately 17 users were ranked as
"Contributor." The site identified by usemame an administrator and a second user identified as a
site founder.
77.
A private message feature also appeared to be available on the site, which allowed
users to send each other private messages. A review of the member list revealed what appeared
to be a private message button located next to the rankings. The private message feature
appeared on the site as "Private beskeder." Google Translate translates "beskeder" to
"messages" or "posts." An attempt to search for this term revealed at least one reference to it
made in.a post on June 20,2012, in which a user appeared to request a private message be sent.
Website 8
78.
connected to the Internet via the Tor Browser and accessed the Tor hidden service at URL
.onion (hereinafter referred to as "Website 8"). Website 8 appeared to be a
Hungarian-language message board whose primary purpose was the advertisement and
distribution of child pornography. A review of the statistics section revealed the board contained
a total of 898 posts, 200 topics and 766 users.
79.
On the main page' of the site located to the right of the title was the current date
and time, along two data-entry fields that appeared to be login fields and various text. Below the
title seven tabs and what also appeared to be two data-entry fields associated with logins.
However, all of the text on the site appeared to be Hungarian.
80.
A review of the last of the aforementioned seven tabs revealed what appeared to
37
'llo
be a registration page. After successfully registering with a usemamc, password, and e-mail
account; and then logging into the site, the following forums (and what appeared to be
corresponding
Soft
Fetisek
Keresek
Non Nude
Lanyok - Vide6k
Maszti
Duci
Oml
Amil
Kemenypom6
Orvosi
Pisi
Fetisek
Keresek
Non Nude
FiUk - Kepek
Maszti
Oral
Kemeny porn6
Orvosi
Pisi
Soft
Fetisek
93 Uzenet
14 ilzenet
17 tema
8 tema
290 ilzcnet
14 ilzenet
30 tema
5 tema
22 ilzenet
1 ilzcnet
8 ilzenct
16 ilzcnet
66 ilzcnet
ilzenet
6 ilzenet
112 ilzenet
12 ilzenet
54 Uzenet
6 Uzenet
3 tema
I tema
3 tema
4 tema
14 tema
tema
I tema
50 teIria
4 tema
8 tema
2 tema
45 ilzenet
1 ilzenet
4 ilzenet
2 ilzenet
15 ilzenet
12 ilzenet
6 ilzenet
5 ilzenet
32 ilzenet
3 ilzenet
14 tema
1 tema
2 tema
2 tema
3 tema
2 tema
I tema
I tema
6 tema
1 tema
o ilzenet
o tema
4 ilzenet
9 tizenet
ilzenet
ilzenet
3 ilzenet
ilzenet
2 tema
1 tema
tema
tema
1 tema
tema
38
o
o
Keresek
Non Nude
FiUk - Vide6k
Maszti
Oral
Kemenyporn6
Orvosi
Pisi
Soft
Fetisek
Keresek
Non Nude
81.
"Google Translate"
o iizenet
o iiZenet
o tema
o tema
9 iiZenet
iiZenet
iiZenet
iiZenet
ilzenet
i1zenet
ilzenet
7 ilzenet
ilzenet
4 tema
tema
tema
tema
tema
tema
tema
I tema
tema
o
o
o
o
o
o
o
o
o
o
o
o
is an internet-based
Anal
Hardcore
Medical
Peeing
Soft
Fetishes
Requests
Non Nude
39
of the meaning
Girls - Video
Masturbation
Fat
Blo\\job
Ass
Hardcore
medical
Peeing
Fetishes
theme
Post subject
Requests
Non Nude
Boys - Pictures
Masturbation
Blo\\job
Hardcore
Medical
Peeing
Soft
Fetishes
Requests
Non Nude
Boys - Video
Masturbation Oral
Hardcore
Medical
Peeing
Soft
Fetishes
Requests
Non Nude
82.
or log that displayed recent messages posted by users. A data-entry field was included in this
section for posting messages.
registered users.
83.
A review of the first four forums revealed the majority of the topics and posts
40
the number of replies, the number of views, and the last post. The last post section included the
date and time of the post as well as the author.
84.
Upon accessing a topic, the original post appeared at the top of the page, with any
corresponding
replies to the original post included the post thread below it. Typical posts
A list of members, which was accessible after registering for an account, revealed
that approximately
41
Approximately
87.
connected to the Internet via the Tor Browser and accessed the Tor hidden service at the URL
onion (hereinafter referred to as "Website 9"). Website 9 appeared to be a
bulletin board whose primary purpose is the advertisement and distribution of child pornography.
Statistics posted on the site revealed the board contained a total of 6, 152 posts, 1,274 total
topics, and 25,831 total members.
89.
The initial web page of the site contained the name of the site and advertised
videos available for purchase and preview. Located on either side of the site name was an image
that appeared to depict a naked prepubescent female with her legs spread apart, exposing her
vagina. Located below the title were four hyperlinks entitled "BOARD INDEX," "FAQ,"
"REGISTER," and "LOGIN"; along with a search feature that allowed users to search for text.
Located below the aforementioned items was a section entitled "INDEX PAGE," which
contained one forum entitled "Rules." On the right side of this section were three additional
sections entitled "MAIN MENU," "USER MENU" and "LOGIN FORM." Located below the
forum were two additional sections entitled "WHO IS ONLINE" and "STATISTICS."
90.
A review of the "Rules" forum revealed it contained two posts entitled "Access to
the site" and "Welcome," both of which were posted by the site Administrator. These posts
contained a welcome message and contact information for the administrator including a tormail
email account containing the name of the site.
42
9 I.
Registration to the site required a user to enter a username, password, and e-mail
account. After successfully registering and logging into the site, a section entitled "CP" appeared
that included the following forums, along with the corresponding number of topics and posts in
each:
Forum
FREE
- Rules
- Dialogue and discussion
- Video
- Photos
PRIVAT
- New materials
92.
Topics
Posts
1
146
606
471
1
832
2792
2349
50
177
A review of the various topics within the above forums revealed each topic
contained a title, the author, the number of replies, the number of views, and the last post. The
last post section included the date and time of the post as well as the author. Upon accessing a
topic, the original post appeared at the top of the page, with any corresponding replies to the
original post included the post thread below it. Typical posts appeared to contain text, images,
thumbnail previews of images, compressed files (such as ".rar" files), links to external sites, or
replies to previous posts.
93.
A review of the various topics within the "Rules" and "Dialogue and discussion"
forums revealed that the majority contained general information in regards to the site,
instructions for how to post, welcome messages between users, and discussions indicative of an
interest in child pornography (CP). Three additional sub-forums were also observed in the
"Dialogue and discussion" forum that appeared to contain similar material.
94.
A review of topics within the "Photos" and "Videos" revealed the majority
43
appeared to contain CP and child erotica depicting prepubescent males and females, or text
indicative of an interest in CP. Examples of these are as follows:
On June 16,2013, a user posted a topic entitled "For VIP - Asian Mom, son and
Dad" in the forum "Video" that contained a link to download a compressed ".7z"
file and a preview image. A review of the preview image revealed it contained 16
still-shot images of a video file. The majority of these images depicted two naked
adults with a naked prepubescent male. One of the images depicted the
prepubescent male sitting next to the adults with his legs spread apart, exposing
his genitalia. The left hand of one of the adults appears to be holding the
prepubescent male's penis.
On April 25, 2013, a user posted a topic entitled "2" in the forum "Video" that
contaizied links to download files and multiple preview images. A review of one
of the preview images revealed it contained 18 still-shot images of a video file.
The majority of these images appeared to contain CP depicting a naked female
toddler. One of these images depicted the female toddler sitting with her legs
spread apart, exposing her vagina. What appears to be a black marker is
penetrating her vagina.
95.
A list of members, which was accessible after registering for an account, revealed
that approximately 117 users made at least 10 posts to one or more of the forums.
Approximately 24 of these users made at least 30 posts. Two users were listed as the
Administrators.
96.
An attempt to access the ''New materials" forum revealed the following text:
"You do not have the required permissions to read topics with this forum." A VIP area of the
site appeared to be available to some but not all members of the site, which law enforcement was
not able to access at the time of the review of the site.
97.
A private message feature was also available on the site, after registering, that
allowed users to send each other private messages, referred to as "personal messages." A review
of one administrator's user profile revealed a contact section that contained a hyperlink entitled
44
"Send private message." Numerous private message requests between users were observed on
the site. An example of this is as follows:
On September 12, 2012, one of the administrators replied to the topic entitled "Pic
for PRIVATE", that contained the text (among other text): "send your own video
or other own on-topic material in a private message to (username of other
administrator] to become VIP."
Based on my training and experience, I believe that the phrase "on-topic material" refers to child
pornography.
Website 10
98.
Between June 25 and June 27, 2013, an FBI Special Agent operating in the
District ofMaryJand connected to the Internet via the Tor Browser and accessed the Tor hidden
service at the URL
I0 appeared to be a message board whose primary purpose was the advertisement and
distribution of child pornography and the discussion of matters pertinent to incest and pedophilia.
The name of the site contains a reference to incest. The initial site web page contained the name
of the site and an image depicting an adult male and female with a prepubescent female. The
title in the image included the text, "Explaining sex to your little girl." According to statistics
posted on the site, it contained 29,330 total posts, 3,800 topics and 10,397 members.
99.
Below the image on the main page of Website 10 was a hyperlink to the site's
discussion board as well as a "Links" section and "Contact" section. Among other things, the
"Links" section contained a link to the site referred to as Website 14 in this affidavit, a Tor
network hidden service dedicated to promoting pedophilia and allowing users with a sexual
interest in children to network and communicate, and a link to "(Pedo) Torchat Directory."
45
Accessing the hyperlink to the site's discussion board revealed a message board
web page with the name of the site and the same image as described on the initial web page. The
following forums and sub-forums
number of topics
Topics
Posts
17
74
17
336
51
80
27
4
270
366
189
26
204
172
4
41
1544
2723
23
232
1074
79
87
390
9798
718
429
1778
16
2
133
250
60
29
197
436
206
1324
A review of the various topics within the Site Info & News forums revealed,
among other things, that a valid e-mail address was not required to register an account.
However, a user would gain access to additional forums and topics by registering an account.
46
102.
A review of the various topics within the other forums revealed, among other
things, numerous image and/or video files that appeared to contain child pornography (CP) or
child erotica. The "Forbidden Fruit, Pics Forum" contained 13 pages of topics. Each topic
contained a title, the author, the number of replies, the number of views, and the last post. The
last post section included the date and time of the post as well as the author. Upon accessing a
topic, the original post appeared at the top of the page, with any corresponding replies to the
original post included the post thread below it. Typical posts appeared to contain text, images,
ihumbnail previews of images, compressed files (such as ".rar" files), links to external sites, or"
replies to previous posts.
I 03.
The Pics forum also contained 10 additional sub-forums, some of which were
titled "Boy Only Pics," "Girl Only Pics," "Bondage," "Preschool," and "Preteen." These forums
all contained over 700 topics and over 5,000 posts. Further, each of these forums contained
descriptions below the title; examples of which are as follows:
Boys Only Pics: Post pics of just boys here. HC, SC, nude, whatever is OK.
Preschool: This area is for pics of ages 0-5.
Preteen: This area is for pics of ages 6-I2.
104.
numerous posts containing images depicting child pornography (CP), bestiality, bondage, and
child erotica of prepubescent females, males, and toddlers; including those depicting anal,
vaginal, or oral penetration.
105.
The "Other Family Fun "andForbidden Fruit Forums" contained similar topics,
posts, threads, and files as were observed in the aforementioned Forbidden Fruit, Pics Forum.
Further, numerous images that appeared to contain CP, child erotica, or text indicative of child
47
erotica were observed in these forums. The majority of the image and video files appeared to be
contained in posts within the Pies, Vids, and Requests forums.
106.
Upon registering for an account, the following additional forums and sub-forums
Posts
39
129
30
31
42
39
109
29
94
2
I
83
45
65
17
58
A review of topics within these forums revealed they appeared to contain CP,
A list of members was also accessible after registering for an account. A review
of this list revealed that approximately 239 users made at least 15 posts to one or more of the
forums. Approximately 42 of these users made at least 100 posts. A site administrator, site
monitor, and two site moderators were identified on the site by usemame.
109.
A private message feature was also available on the site that allowed users to send
each other private messages. A review of the site revealed several posts in which users requested
48
\.;>c.
~I{'J
On June 26, 2013, an FBI Special Agent operating in the District of Maryland
connected to the Internet via the Tor Browser and accessed the Tor hidden service at URL
onio~
appeared to be a bulletin board whose primary purpose was the advertisement and distribution of
child pornography. Statistics posted on the site revealed the board contained a total of 1,754
posts, 281 total topics, and 2,165 total members.
Ill.
The initial web page ofthe site contained the name of the site and three hyperlinks
entitled "FAQ," "Register" and "Login." Located below the aforementioned items were three
sections that contained various forums, along with the corresponding number of topics and posts,
as follows:
Forum
GENERAL
THE RULES-Read me
Discussion
Feedback
MEDIA
Females
Males
Co-Ed
FETISH
Girls peeing
Girls medical
112.
Topics
Posts
62
12
231
36
142
19
28
1099
54
203
15
3
100
30
A review of the various topics within the "GENERAL" section revealed, among
other things, instructions for how to post, along with discussions in regards to software programs,
49
other sites, and issues with the site. Many of the posts contained text indicative of an interest in
child pornography (CP). An example of this is as follows:
On April IS, 2013, the user '_
posted a topic entitled "Child prostitution" in
the "Discussions" forum. The post contained the text (among other text),
"Anyone know where I can find child prostitutes?"
113.
A review of the various topics within the "MEDIA" and "FETISH" sections
revealed the forums within these sections contained numerous pages of topics. Each topic
contained a title, the author, the number of replies, the number of views, and the last post. The
last post section included the date and time of the post as well as the author. Upon accessing a
topic, the original post appeared at the top of the page, with any corresponding replies to the
original post included the post thread below it. Typical posts appeared to contain text, images,
thumbnail previews of images, compressed files (such as ".rar" files), links to external sites, or
replies to previous posts.
114.
images depicting CP and child erotica of prepubescent males, females, toddlers, and infants;
including those depicting anal, vaginal, or oral penetration. Examples of these are as follows:
On January 29,2012, the user ".'
posted a topic entitled "babyfeet," which
contained numerous images depicting CP of an infant. One of these depicted an
adult male holding an infant's leg in the air and his penis is pressed against the
bottom of the infant's foot.
On April 16,2012, the user '_'
posted a topic entitled "Random Co-ed"
in the MEDIA - Co-Ed forum that contained multiple images depicting CP of a
prepubescent female. One of these depicted the prepubescent female, who
appeared to be naked from the waist down, lying on her back with her legs spread
apart and one raised in the air, exposing her vagina. An adult male is positioned
in between her legs and his penis is penetrating her vagina
On March 17,2013, the user "_'
50
the Fetish - Girls peeing forum that contained multiple images depicting CP of a
prepubescent female. One of these images depicted a naked prepubescent female
lying on her back with her legs spread apart and raised in the air, exposing her
vagina and anus. A clear liquid substance with the appearance and consistency of
urine is visible in the image.
115.
After successfully registering for an account with a username and password, and
logging into the site, no additional forums or topics were observed. However, a list of members
was accessible and a review of this list revealed that approximately 23 users made at least five
posts to one or more of the forums. Approximately eight of these users made at least 15 posts.
116.
The site appeared to have a private messaging feature; however, when this feature
Between June 25 and June 27, 2013, an FBI Special Agent operating in the
District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden
service at URL
appeared to be a video sharing website whose primary purpose was the advertisement and
distribution of webcam videos of minors engaging in sexually explicit conduct. According to
statistics posted on the site, as of June 27,2013, the site had 1,869 members, 12,689 posts and
2,825 threads. Access to child pornography posted on Website 12 was available only to users
who posted child pornography to the satisfaction of the site administrator.
118.
The initial web page contained name of the site and an image depicting what
51
female.
was the current date and time, along with three hyperlinks entitled "Search,"
"Help."
The text "Hello There, Guest!" and the hyperlinks "Login" and "Register" were also
located under the title. The "Member List" and "Search" links were not accessible.
119.
and "Information."
corresponding
120.
21,2011,
Posts
I
4
A review of the "Your First Post" forum revealed one post that was made on May
which, among other things, this post contained the following text:
You get access after your first post!
- This is a board for Cams (webcam caps, youtube vids, etc) only. Don't try to get
access with other stuff!
- This is an english speaking board.
- Your first post must be an underage girllboy (13 or younger) and must contain
nudity.
- Your first file(s) must be at least 20mb in size.
- You need to use RAR or 7z archives with passwords. Don't forget to encrypt
filenames.
- Your password must contain your usemame and the name of the board ([Website
12]).
- Please create for every girl a seperate thread.
- Use hosters you don't need JavaScript (like http://tishare.comf).
- Use imagehosters you don't need JavaScript (like http://fastpic.ruI).
- Use a good title for a new thread.
121.
A review of the "Rules" forum revealed it contained four topics and four posts.
All four posts were made by one user who was listed as an Administrator
depicting a partially naked prepubescent
with an avatar
52
the trusted and VIP arca?" was made on April 19, 2013, and contained the following text:
How to get access to the trusted and VIP area?
-I still have to work on the board and the next weeks there could be still some
changes!
Trusted Member
For non-cappers/YouTubers
- You must have been active for one year. After one year, please send me (Indica)
aPM.
- You should not post bullshit only.
- Your warning level should be not too high.
For capperslY ouTubers
- Sometimes you will be invited. 1don't have more information at this time. Sorry.
- You should mark your posts with your own caps and YouTube videos.
- Your warning level should be not too high.
V.J.P. Member
For non-capperslY ouTubers
- You are not able to join the V.J.P. usergroup.
For capperslY ouTubers
- You will be invited by the V.J.P. Members.
122.
Based on my training and experience, 1believe that "capping" is a term that refers
to capturing and recording live streaming video. "Cappers" are persons who engage in such
behavior. Capturing and recording live streaming video of minors engaging in sexually explicit
conduct is a common way that offenders produce child pornography for consumption and
distribution.
123.
A review of the remaining three posts revealed they contained instructions for
how to post, what to do if access to certain areas is tenninated, and which file-hosting sites or
programs to use.
124.
referenced in two of the posts made by the administrator, one of which was described above.
The second post referring to a "PM" was in the post entitled "List with some
53
After successfully registering to the site with a username and password and then
logging into the site, no further information was available or accessible. The law enforcement
officer was not able to view the section so the site accessible to users after their first post, or the
VIP areas, due to the requirement of the posting of child pornography.
Website 13
126.
Between June 25 and June 27, 2013, an FBI Special Agent operating in the
District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden
service at URL
the initial site web page revealed that it contained the title of the site and image depicting what
appeared to be partially naked early pubescent female. The following text was located below the
title:
"Join our movement! We are building the new world paradise! Make friends on
the first social network dedicated to u 18 erotica. . .. Share your knowledge on
u18 erotica with others on our WIKl. Discuss with others on our Forum."
Based on my training and experience, I believe that the term "u 18" refers to children under the
age ofl8.
127.
Three hyperlinks for a social network, wiki and forum directed users to other
sections of the web page. The WIKl hyperlink directed users to a web page that contained a
description of the site and appeared to only contain text. The Forum and social network
hyperlinks directed users to a message board web page that contained the same title as the
Website 13. Statistics posted on Website 13 revealed that the site contained 11,174 posts, 5,876
54
\?c..
~1(1
A review of the main forum web page revealed one forum entitled "Tourist
This forum contained one topic entitled "About Us" and one post with the same
register.
129.
Registration
users began to like u 18 erotica, and favorite topics. After successfully registering and logging
into the site, the following
Forum
[Website 13]
Erotica
Education
Religion
Travel & Sightseeing, Cities & Nature
Politics
Health, Wellness, Fitness, Beauty
130.
Topics
95
5608
72
Posts
381
10335
282
2
4
3
1
1
A review of the various topics within the "Erotica" forum revealed it contained
Each topic contained a title, the author, the number of replies, the
number of views, and the last post. The last post section included the date and time of the post as
well as the author.
Upon accessing a topic, the original post appeared at the top of the page, with
any corresponding
replies to the original post included the post thread below it. Typical posts
55
images depicting CP, bestiality, bondage, and child erotica of early pubescent females,
prepubescent
females, and toddlers; including those depicting anal, vaginal, or oral penetration.
A review of the remaining six forums revealed numerous topics, posts, and
threads that contained various instructions, links to external sites, requests for information,
technical details, and text indicative of an interest in CPo
133.
A list of members, which was accessible after registering for an account, revealed
that approximately
Approximately
"VIP."
A private message feature was also available on the site that allowed users to send
56
On July 10, 2010, the administrator posted, "If you are a producer oful8 erotica
please contact the admin directly via private message. You can become a resident
instantly and for lifetime."
On December 29,2012, the administrator posted, "If anybody can provide
information but does not want to post, please contact me via private message."
Website 14
135.
Between July I and July 2, 2013, an FBI Special Agent operating in the District of
Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden service at
the U~.onion
appeared to be a bulletin board dedicated to the promotion and discussion of pedophilia and the
sexual abuse of children. The site name contained a reference to pedophilia. Statistics posted on
the site indicate it has 1,497 members, 67,992 posts and 4,340 topics.
136.
The initial site web page revealed it was a message board web page that contained
the title of the site and five hyperlinks entitled "HOME," "SEARCH," "CHAT," "LOGIN," and
"REGISTER." Located below the aforementioned items were three sections that contained the
following forums, along with the corresponding topics and posts:
Forum
Topics
Posts
THE COMMUNITY CENTRE
- THE NOTICE BOARD
109
1412
- INTRODUCTIONS
1053
10339
- MYSTIQUE'S MONTHLY REVIEW
II
586
- THE PSC COMMUNITY AWARDS
I
10
DISCUSSION, PERSONAL EXPERIENCE, AND ADVICE
- PEDO CHAT
766
13090
- PERSONAL SUPPORT
141
2690
- CHILD LOVE SUPPORT
181
3602
- PEDO LITERATURE
85
1792
- CONSERVATIVE PAEDOPHILIA
25
654
- OFF TOPIC
243
4350
SECURITY, GUIDES, AND INFORMATION
57
4234040
502
3795
Located at the bottom of the web page was an additional section that contained information on
recent posts, users online, and forum statistics. That section listed the top sections of and
threadslpostings on Website 14 as follows:
TOP 10 BOARDS
Pedo Chat
Introductions
Off Topic
Paedophilia Security (abbr)
Links
Child Love Support
Personal Support
Pedo Literature
The Notice Board
Prostitution and Sex Tourism
13,108
10,345
4,352
4,052
3,810
3,608
2,701
1,800
1,415
769
334
280
213
198
192
175
155
151
144
142
73,773
58,232
34,606
23,025
21,722
21,227
19,238
17,040
58
16,813
167,91
A review of the various forums revealed that each topic appeared to contain title,
the author, the number of replies, the number of views, and the last post. The last post section
included the date and time of the post as well as the author. Upon accessing a topic, the original
post appeared at the top of the page, with any corresponding replies to the original post included
the post thread below it. Typical posts appeared to contain text, links to external sites, or replies
to previous posts.
138.
A further review revealed that a large number of posts appeared to contain text
indicative of an interest in child pornography (CP) and child erotica. Examples of these are as
follows [spelling and grammar as in original]:
On February 8, 20 I2, a user posted a topic entitled "PEDOS IN PRISON - YOUR
JAILIPRISON EXPERIENCES" in the "Pedo Chat" forum. As identified above,
this post had over 23,000 views and ISS replies. Among other text, this post
contained the following text:
"On the previous PSC, we had an entire thread dedicated to paedophiles
that had been caught in the past and that had served hard time for their
actions. They talked about what it was like for them, the prison structure,
how they were treated, what they lost, how they rebuilt their lives after
serving their time and much more. I would like to rebuild this thread, so if
you have been to jailor prison for CP related matters, please post detailed
accounts of your experiences if you feel that you can share them."
On May 10,2012, a user posted a topic entitled "NEED HELP WITH I I YEAR
OLD GIRL WHO SEEMS INTERESTED BUT CAUTIOUS" in the "Child Love
Support" forum. This post contained described the user's desire to "get a littler
more out of our relationship, just some touching or licking" from his friend's 11
year old daughter. The post sought advice on how to "test the waters." As
identified above, this post had over 34,000 views and 334 replies.
On May 28, 2013, a user posted a topic entitled "HELP WITH 3YO COUSIN" in
the "Child Love Support" forum. This post contained the following partial text,
59
among others: "So I'm starting on my child love with a young cousin, who is 3."
This post had approximately 465 views and numerous replies.
On June 17,2013, a user posted a topic entitled "[TRUE] MY GIRLS AND LIT
JUST STARTED LAST NIGHT" in the "Pedo Literature" forum. This post had
approximately 3,159 views and five pages of replies. Among other things, this
post contained the following text:
"Like I said I've been happily married for 9 years now. We have 2
beautiful daughters ages 8 and 6. My oldest is developing a bit faster than I
thought she would. In the last few months she's changed from a chubby
little girl to starting to lose baby fat and developing little bumps on her
chest. I've looked at little girls my entire life and had never acted on any
even if! have had the opportunity. Now that my daughter (we'll call her
Ashley) is showing signs of starting to mature, I've had the urge to feel and
touch. I hadn't given in to it until last night."
On May 31, 2013, a user posted the topic "USE DRUG ADDICT
STREETWALKERS TO FIND WILLING LITTLE GIRLS?" in the "Prostitution
and Sex Tourism" sub-forum of the "Guides" forum. This post had
approximately 536 views and numerous replies. Among other things, this post
contained the following text:
"When chatting on Torchat I got a tip from a fellow pedo that he uses to
search for drug addict streetwalkers or mothers in the citys to get into
contact with little girls. Has anybody experience with this or any tipps?"
On March 17,2013, a user posted the topic "WHY, WHY, WHY, DO I GET
TURNED ON BY HURTCORE?" in the "Personal Support" forum. This post
had approximately 1,117 views and numerous replies. Among other things, this
post contained the following text:
"I totally support having a loving and consensual relationship with a child.
It's the reason I am a member of these forums. Most of the time, I fantasize
about happy and giggling little girls. Actually, I fantasize about having a
loving wife who likes to join in pleasuring a little girl with me. I don't have
any moral objections to things like this. However, I was feeling a bit
frisky on OPV A and was looking at some toddler/really young stuff. I
downloaded a compilation video that I didn't realize contained a lot of
forced/crying content. I am really fucking ashamed that it really, really
aroused me. I've sense delved into worse things that Babyj and I feel so
ashamed every time I do it."
60
Upon registering for the site with a username, password, and age preference, and
logging into the site, a user was allowed to post in the "Introductions" forum. Users were then
required to post background details about themselves before being approved for full membership.
Upon being approved for full membership, users were then able to post in the other forums. No
additional forums or topics were observed after registering.
140.
A review of the "Registration Agreement" revealed that seven users were part of
61
141.
A private message feature was also available on the site that allowed users to send
each other private messages, referred to as "personal messages." A review of the "Registration
Agreement" revealed the following text (among others):
Private Messages
We have a PM system here, which our members are welcome to use to
communicate in private with each-other once you have made 25 or more posts on
the public board. You may use PM's to develop friendships, and talk about more
personal or intimate things that you might not want to post openly in public on the
main boards. Please respect our PM system, imd do not abuse it's privileges by
using it to solicit trading, or to spam, disrespect, abuse or otherwise annoy any of
our members. Should you find that you receive any PersonalJPrivate Messages
you are unhappy with, please report such abuses by sending a PM of your own to
any of our Staff Team, and we will deal with your issues.
Website 15
142.
Between June 26 and June 28, 2013, an FBI Special Agent operating in the
District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden
service at the ~onion
appeared to be a closed-access bulletin board whose primary purpose was the advertisement and
distribution of child pornography. According to statistics posted on the site, the site contained a
total of3,218 posts, 1,009 topics, 268 total images, and 215 total members.
143.
The initial web page revealed a web page that contained an image of an onion in
the upper-left corner of the page. The text "Looking for the forum CLICK ME! Come in We're
OPEN" was in front of the onion image. The background wallpaper of the page contained
approximately 117 computer-animated images. All the images depicted what I recognized, based
on my training and experience, to be the "ChildLover logo"; an image which depicts a butterfly
with pink and purple wings that is a symbol used by pedophiles to indicate a non-gender
62
Accessing the "CLICK ME" hyperlink revealed a message board web page with
the name of Website 15. Located directly to the left of the title were six images which appeared
to depict child pornography
Examples
63
Located below the above text was one forum entitled, "ARE YOU A GUEST?
THEN CLICK HERE FOR MORE INFO!" Accessing the "ARE YOU A GUEST? THEN
CLICK HERE FOR MORE INFO!" forum revealed the following topics:
Topic
NEW MEMBER OF THE ADMIN TEAM!
ATTN NEWLY REGISTERED MEMBERS!
Board Maintance
REGARDING EMAILS - PLEASE READ!
PERSONAL PICTURES OF "YOURSELF"
Board tweaks, h02's and other board updates
IF THIS IS YOUR FIRST VISIT - READ THIS IMPORTANT INFO!!
147.
one post made by the site administrator who joined on May 27, 2012 and had made 564 posts,
including 79 images. This post contained the following text:
If your account has been activated recently, then this information applies to you!
Firstly, apologies for any delay in activating your account due to adrnin
availability .
64
You should be aware by now (it's plastered all over the place!) that a requirement
of registration here is that you post within 30 DAYS of activation or we delete
your account. by "posting" we mean a picture set or video etc. If your account
name is BLACK then this applies to you.
The more you post, at the admin's descretion, your colour will gradually change,
signifying more board priviledges such as access to mini chat, gallery albums, and
our hidden section, AREA 51!
Once your colour has changed to anything but black, your account is safe!
We do this to make the board fair for everyone and to stop people coming here to
simply download material on the board.
Please note that anyone who has a BLACK name will have their account reviewed
on 15TH JUNE 2013
If you have not posted by that date, your account will be deleted.
YOU HAVE BEEN WARNED!
If you upload RAR or ZIP collections etc to an outside server, please use ajap one
such as ayame (see the links page) and NOT one which makes you jump through
hoops with silly captcha's etc and gets deleted within 24hours!
Should you upload anything and it does get deleted by the server for any reason
(ayame tend NEVER to delete stuffi), then please ensure you re-up it to avoid
broken links!
Also when uploading sets etc, please ensure you post a preview pic so that people
know what it is - helpful tutorials are available in "How do I do that?"
Please be friendly - we all try to be - and if you have any issues, please PM any
member of the admin team and above all... enjoy yourself! ;)
148.
A review of the "IF THIS IS YOUR FIRST VISIT - READ THIS IMPORTANT
INFO!!" topic revealed one post made by the administrator on May 27, 2013, and contained the
following text [spelling and grammar as in original):
Firstly welcome to [Website 15]!
You may be thinking this place looks a bit blank - it has been deliberately set up
that way to stop idiots and dickheads.
If you wish to sign up, then you need to be recommended by someone who is a
"REGISTERED MEMBER" or above, and you will be expected to post within
FOURTEEN DAYS.
If you do not post within that period to confirm your membership, then BOTH
YOU & THE PERSON WHO RECOMMENDED YOU will be deleted from the
board ... YOU HAVE BEEN WARNED!!
You need to register with a VALID email address.
You can sign up for TORMAIL here: http:!
onion! :-bd
Your username should be non offensive and should be a "proper" name. Random
65
to the board, details on other boards, and an announcement for a new member oCthe Admin
Team.
150.
No furthcr contcnt was accessible on the wcb page due to the rcquircmcnt that
new users be rccommended for mcmbcrship by an existing mcmbcr. Bascd on my training and
experience, I belicvc that such a requiremcnt, in conjunction with requircmcnts that users
periodically upload child pornography to the site. is a common method by users and
66
connected to the Internet via the Tor Browser and accessed the Tor hidden service at URL
onion (hereinafter referred to as "Website 16"). Website 16 appeared to be a
video sharing website whose primary purpose was the advertisement and distribution of web cam
videos of minors engaging in sexually explicit conduct.
153.
The initial web page contained the name of the site and multiple images
containing what appeared to be child pornography (CP) and child erotica depicting early
pubescent or prepubescent males. Also on the initial web page were numerous links to other
child pornography websites, including Websites 2, 4-6, and 22.
154.
Located below the image was a section entitled "Featured Cams" that contained
three sets of images that appeared to be still-shots of video files. Each still-shot contained 16
images depicting prepubescent or early pubescent males. Located below the aforementioned
images was a section that contained the following text:
Thanks for 413,133 site hits and 1370 comments on 138 cams! If you like my
cams then please leave a comment below the download links, it'll keep me
motivated to upload even more :).
155.
Located below this text were multiple video files. Each file contained the date
and time it was posted, the title of the file, the number of comments made by other users, the
number of times the file had been viewed, an image containing still-shots of the video, and a
hyperlink entitled "Download & Comment." At the bottom of the web page was an additional
67
Located on the right side of the web page was another section that included the
text: "[Website 16] I make feeeet cams ...like boys and girls, ages 0-15. Chat with me on IRC if
you like (Guide in the links section below)."
157.
A review of the images containing still-shots of the videos uploaded to this site
revealed they appeared to contain CP and child erotica depicting early prepubescent and
prepubescent males and females. Examples of these are as follows:
On June 4, 2013, a user posted a video entitled"
" and an image containing 12 still-shot images of
the video. These still-shot images depicted what appeared to be a naked early
pubescent or early pubescent male, including close-ups of his genitalia.
On May 30, 2013, a user posted a video entitled"
All videos and images on the site appeared to have been uploaded by one user
No chat or private message features were located on the web page and no
registration was required. All sections of the site were accessible to any user of the site.
Website 17
160.
Between June 26 and June 28, 2013, an FBI Special Agent operating in the
District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden
.onio~(hereinafter
referred to as "Website
17"). Website 17 appeared to be a bulletin board whose primary purpose was the advertisement
and distribution of child pornography. Statistics posted on the site revealed the board contained a
68
total of5,678 posts, 1,729 total topics, and 24,670 total members.
161.
The initial web page was a message board web page with three hyperlinks entitled
"Register," "Login," and "Search," along with a Login section with two data-entty fields and the
corresponding text, Usemame and Password. Located below the aforementioned items was one
forum entitled "README." A review of the "README" forum revealed it contained three
posts, all of which were made by site administrator on January 20, 2010. The "RULES" post
contained the following text:
-Don't post boys, gay porn!
-Don't post girls 16+! This is not a mature site!
-don't post 3D, 10licon, comics, drawings, etc... only real stuff!
Thank you!
The "ABOUT THE VIP AREA" post contained the following text:
Best posts here! The best posters gain access to the VIP.
We have a Private Area too. Only for producers. PM me if you are interested.
New stuff here! torchat:
The REGISTRATION" post contained the following text:
You don't have to give a valid e-mail account. It works without that. After the
registration, you are the member of the Registered Users group. To stay active
member: -post pictures, videos or archives at least 2 Mb in the first 24 hour. - min
I post/month
162.
and e-mail account. After successfully registering and logging into the site, the following forums
and sub-forums were observed, along with the corresponding number of topics and posts in each:
Forum
Posts
Discussions
Competition
VIP
Topics
1476
80
Posts
4628
250
19
2
not accessible
69
Forum
163.
not accessible
A review of the various topics within the "Posts" forum revealed it contained 60
pages of topics. Each topic contained a title, the author, the number of replies, the number of
views, and the last post. The last post section included the date and time of the post as well as
the author. Upon accessing a topic, the original post appeared at the top of the page, with any
corresponding replies to the original post included the post thread below it. Typical posts
appeared to contain text, images, thumbnail previews ofirnages, compressed files (such as ".rar"
files), links to external sites, or replies to previous posts.
164.
A review oftopics within the "Posts" revealed numerous posts containing images
depicting CP and child erotica of early pubescent females, prepubescent females and toddlers;
including those. depicting anal, vaginal, or oral penetration. Examples of these are as follows:
On June 22, 2013, the user ,_,
posted a topic entitled"
5yo", which contained numerous images depicting CP of a prepubescent female.
One of these depicted the prepubescent female squatting with her legs bent and
spread apart, exposing her vagina and anus.
On June 7, 2013, the user '_'
posted a topic entitled "Re: 3 sisters",
which contained numerous images depicting CP of prepubescent females. One of
these depicted a prepubescent female with her mouth open and what appeared to
be an adult male's penis penetrating her mouth.
165.
A review of the remaining two forums revealed numerous topics, posts, and
threads that contained text indicative of an interest in CP, images which appeared to depict CP
and child erotica of prepubescent females, and requests for site monitors.
166.
A list of members, which was accessible after registering for an account, revealed
that approximately 114 users made at least 10 posts to one or more of the forums.
Approximately 26 of these users made at least 30 posts.
70
167.
A private message feature was also available on the site that allowed users to send
each other private messages. A review of the site revealed several posts in which users requested
to be contacted via private messages (including the aforementioned post made by "admin"). An
example of this is as follows:
On August 25, 20 II, in response to CP images posted by another user, the a user
posted, "message me to trade private x".
Websites 18 and 19
168.
Between June 25 and June 28, 2013, an FBI Special Agent operating in the
District of Maryland connected to the Internet via the Tor Browser and accessed the Tor hidden
service at URL
appeared to be a bulletin board whose primary purpose was the advertisement and distribution of
child pornography. Statistics posted on Website 18 revealed the board contained a total of
70,648 posts, 14,900 total topics, and 945 total members. Website 18 also appeared to be
connected to another Tor hidden service hereinafter referred to as Website 19, as described
below.
169.
The initial web page of Website 18 contained the title of the site and a computer-
animated image depicting two prepubescent children. Located below the title was the current
date and time, along with two hyper links entitled "FAQ" and "Login."
aforementioned items was one section that contained the following forums, along with the
corresponding number of topics and posts:
-Forum
READ BEFORE YOU REGISTER
If your login does not work
Cookies are now needed to access this board
71
Topics
o
o
o
Posts
o
o
o
A review of the first three forums revealed they did not contain any content. A
review of the "[Website 18 abbreviation] Tutorials" forum revealed it contained, among other
things, instructions for how to post, how to upload files, how to generate preview images, and
how to encrypt data.
171.
onio~
hereinafter
referred to as Website 19. Website 19 appeared to be a bulletin board whose primary purpose
was the advertisement and distribution of child pornography. It shared the same name as
Website 18 but for the designation "Open Board." Statistics posted on Website 19 revealed the
board contained a total of 8,408 posts, 3,165 total topics, and 5,201 total members. The initial
web page of Website 19 contained the title "[Website 18] Open Board" and a computer-animated
image depicting a prepubescent child. Located below the title was the current date and time,
along with three hyperlinks entitled "FAQ," "Register," and "Login."
172.
Located below the aforementioned items on Website 19 were four sections that
contained the following forums, along with the corresponding number of topics and posts:
Forum
GENERAL INFO
RULES
Guest Discussion Board
[Website 18 abbreviation] Tutorials
GIRLS
Girls - Hardcore Pics
Girls - Hardcore Vids
Girls - NonNude PicsNids
72
Topics
Posts
86
3
212
19
28
114
1554
6
363
4145
10
126
1162
0
19
60
1785
487
0
0
4664
A review of topics within the "GENERAL INFO" section revealed, among other
things, instructions for how to post, along with discussions in regards to software programs, other
sites, technological questions, issues with the site, and links to other sites. Many of the posts
contained text indicative of an interest in child pornography (CP).
174.
Two of the topics within the "RULES" forum were posted by a user who was
listed as the Site Admin. The topic "[Website 18 abbreviation] Rules and Information - Please
Read" contained one post, which included the following text (among other' text):
If you write PMs to admins/mods, please always write to all admins (in one pm in
"to" field, not cc or bee.), this way you'll get a faster reply/reaction, one admin
will reply and put other admins in bee.
The rest of the posting listed the name of one site administrator, seven co-administrators, and two
global moderators.
175.
The topic "Activity Rules" also contained one post, which included the following
text:
Why do you have to contribute?
Now that you are a member of [Website 18], you should be aware that [Website
18 abbreviation] is neither a public board nor a private one. The best definition is
moderated board. When you move to a new neighborhood, you have to get along
with the residents and their rules, but that doesn't mean you're living in a private
73
zone. Simply put, the residents have an unspoken contract between them which
helps to facilitate a peaceful and profitable life together.
This is the case here at [Website 18].ln order to attain the highest benefit and
security for our members, we have specific activity rules for each membership
level that must be followed in order to keep our community active and vibrant.
What does count as a contribution and what does not?
COUNT as contribution:
Set(s) of pictures and/or videos displaying child/teen (pubescent) modeling,
child/teen (pubescent) nudity, softcore or hardcore erotica.
Nudism/naturism.
Webcarn captures.
Working backdoors and passwords of on-topic sites (if they don't require
JavaScript or Flash).
Helping the community with tutorials, re-uploads and filling requests of all of the
above.
NOT COUNT as contribution:
Late teen nudity/erotica/porn (Jailbait who passed puberty and look like adults:
:f: 14 years old for girls and :f: 15 years old for boys).
Adult nudity/erotica/porn. This includes fake jailbait porn (young looking women
that act like teenagers but are obviously 18+) Comics, drawings, lolicon.
3D porn.
Artistic performances. This includes: stories, songs, wallpapers and photoshopped
photographies (fakes).
Links to other on-topic sites (imageboards, torsites, etc.).
News.
Feedback. It surely makes this place much better and encourages members to post
more material, but users can't simply stay as members by thanking everyone
without uploading something themselves.
Rules
Main rules:
All members are required to contribute at least once every 30 days. Each
member's 30-day contribution period restarts on the day of their last valid
contribution.
To qualify for a VIP upgrade, the total of all your contributions must be at least 4
GB and you must have been a member for at least one month.
If you are demoted from VIP to Full member or from Full member to New Reg
due to inactivity, the total of your contributions will be reset to 0 and you will
have to wait at least a month before you can request VIP status again.
To qualify for a SVIP upgrade, you must have been a member for at least 6
months.
Depending on the history and circumstances of the member, the admin staff may
choose to be more flexible when applying these rules.
74
If you are going to be away from the board long enough to keep you from
fulfilling your contribution requirement (illness, real life problems, etc.), please
notify all administrators via Private Message. You will not be demoted during this
time unless you continue to log in regularly.
New Regs.:
New Regs must submit an application post and have it approved by admin staff in
order to become a Full Member and gain access to the [Website 18 abbreviation]
Member Board.
If the New Reg does not submit an application post for approval within 20 days of
registering, their account will be deleted.
Full Members:
All Full Members are required to contribute at least once every 30 days. The first
30-day contribution period begins on the day of promotion to Full Member.
If a Full Member fails to make a contribution during their allotted contribution
period, their account will be demoted to New Reg without prior warning and they
will be required to submit a new application post on the [Website 18 abbreviation]
Open Board in order to regain full access.
VIP Members:
All VIP Members are required to contribute at least once every 30 days, in any
section of the board.
If a VIP Member fails to make a contribution during their allotted contribution
period, they will receive a warning via Private Message requesting a new
contribution be made within the next 7 days. If the VIP Member fails to make a
contribution during that 7-day period, they will be demoted to Full Member. Note:
VIP Members who have not made at least one contribution since becoming a VIP
Member will not be given this extra 7-day period to contribute and will be
demoted to Full Member without prior warning.
Those VIP Members who receive warnings for two consecutive contribution
periods and then fail to make a contribution during the third consecutive
contribution period will be demoted to Full Member without prior warning.
SVIP Members:
All SVIP Members are required to contribute at least once every 30 days, in any
section of the board.
If a SVIP Member fails to make a contribution during their allotted contribution
period, they will receive a warning via Private Message requesting a new
contribution be made within the next 7 days. If the SVIP Member fails to make a
contribution during that 7-day period, the admin staff will evaluate the member's
history and current status to decide whether or not the member should be demoted
to VIP Member.
Those SVIP Members who receive warnings for two consecutive contribution
periods and then fail to make a contribution during the third consecutive
contribution period may be demoted to VIP Member without prior warning.
75
176.
A review of the' various topics within the "GIRLS" and "BOYS" sections revealed
the forums within these sections contained numerous pages of topics. Each topic contained a
title, the author, the number of replies, the number of views, and the last post. The last post
section included the date and time of the post as well as the author. Upon accessing a topic, the
original post appeared at the top of the page, with any corresponding replies to the original post
included the post thread below it. Typical posts appeared to contain text, images, thumbnail
previews of images, compressed files (such as ".rar"), links to external sites, or replies to
previous posts.
177.
images depicting CP and child erotica of prepubescent males, females, and toddlers; including
those depicting anal, vaginal, or oral penetration. Examples of these are as follows:
On June 24, 2013, a user posted a topic entitled "APP in the
Girls-Hardcore Pies forum that contained numerous images depicting CP of a
female toddler. One of these depicted a naked prepubescent female toddler sitting
on the floor with her legs spread apart and bent at the knees, exposing her vagina.
-_in
After successfully registering for an account with a usemame and password, and
logging into the site, no member lists or additional forums or topics were observed.
179.
A private message feature was available after registering, allowing users to send
private messages to each other. Multiple posts were observed in which members discussed the
private message capability. An example of this was referenced above in the aforementioned post
76
by the administrator.
Website 20
180.
On June 25, 2013, an FBI Special Agent operating in the District of Maryland
connected to the Internet via the Tor Browser and accessed the Tor hidden service at the URL
onion (hereinafter referred to as "Website 20"). Website 20 is of a format
commonly known as an image board, which allows users to upload images to and download
images from the website, whose primary purpose is the advertisement and distribution of child
pornography. According to statistics posted on the site, the site contained 3,317 registered
members, 5,354 images that were uploaded, and 40 galleries uploaded with 2,362 images.
181.
The initial web page contained the following eight hyperlinks at the top of the
web page:
Home
Gallery
Directory
Login
Register
Service
FAQ
TOS
The center of the web page contained the text "Add Files" and ten separate fields, each with
corresponding "Browse" and "Add" buttons. Below these fields were two checkboxes providing
options to resize the uploaded image(s) or "make the images Private?"
182.
Located below the aforementioned text, at the bottom of the web page, were the
77
Top Rated
Random
A review of the eight hyperlinks at the top of the web page revealed the following:
Link
Description
Home
Gallery
Directory
Login
Register
Service
FAQ
TOS
A review of the four hyperlinks at the bottom of the web page revealed the following:
Link
New
Popular
Top Rated
Random
Description
Contained 174 pages of uploaded images, with approximately 30
images on each page. A review of selected pages revealed images
that appeared to depict CP and child erotica of prepubescent and
early pubescent females.
Contained 174 pages of uploaded images, with approximately 30
images on each page. A review of selected pages revealed images
that appeared to depict CP and child erotica of prepubescent and
early pubescent females.
Contained 174 pages of uploaded images, with approximately 30
images on each page. A review of selected pages revealed images
that appeared to depict CP and child erotica of prepubescent and
. early pubescent females.
Contained one page of uploaded images with 30 images on the
page. These images appeared to contain CP and child erotica
depicting prepubescent or early pubescent females.
Each of the above images appeared to contain the date and time of uploading, as well as the total
78
nwnber of views.
183.
No chat features were located on the web page and no registration was required.
connected to the Internet via the Tor Browser and accessed the Tor hidden service at the URL
onion (hereinafter referred to as "Website 21"). Website 21 appeared to be a
bulletin board whose primary purpose was the advertisement and distribution of child
pornography. Statistics posted on the site revealed the site had 7,712 members, 22,230 posts, and
2, I92 topics.
185.
The first web page showed a standard bulletin board format with the following
Topics
649
3048
549
2464
2350
408
198
73
443
70
212
143
43
20
Foreign Languages
German
Dutch
Russian
Spanish
French
1274
349
374
734
115
33
186.
44
19
55
7
The section titled "Recent Posts" showed the seven (7) most recent posts
79
occurring on 07/02/2013 from approximately 05:16:30 pm to 06:04:34 pm, with the current date
time at the top of the page showing as 07/02/2013, 06:41: 19 pm.
187.
information was provided at the bottom of the post. Guidance entailed contacting the listed staff
or utilization of a particular tormail.org email in conjunction with a PGP encryption key. Based
on my training and experience, I believe that a PGP encryption key may be used to passwordprotect the contents of an email so that the contents are available only to the intended sender and
recipient.
189.
The second fixed topic concerned the re-Iocation of posts/topics by site staff and
some suggestions on how to locate the post/topic if are-direct was not left by the staff member
relocating the post/topic. The thread was started on 03/24/2013.
190.
Under General Discussion, a list of topics included: "As I like to kill a girl or
boy?" which concerned different ways individuals would like to kill a young boy or girl, and
"[h]ow deep can you get your dick in your preteen girl?" which concerned penetration by adult
males of pre-pubescent females either vaginally orally.
191.
80
network website locations on a separate website. Accessing the first link showed
a proof sheet, that is, a series of still images created from a video, which shows an
adult female forcing an infant female to perform oral sex on her and exposing the
infant's genital area in a lewd and lascivious fashion. Review of the downloaded
video confirmed the content matched images in the proof sheet. The topic itself is
four (4) web pages in length. Numerous posters posted messages on that topic
while utilizing avatars that contained child exploitation material.
Under Beastiality was the following topic/post:
~ucks
dog - post started on 04/20/2013. The initial post provided a link to a
non-Tor internet site and a password. The link was unable to be downloaded at the
time of the undercover session. A second link was provided on 06/14/2013 by
another user. Accessing the second link revealed a proof sheet from a video
depicting a pre-pubescent female forced to perform oral sex on a male dog.
192.
An account was created by an FBI Special Agent and utilized to access the
website. After logging into the site, sending and receiving of private messages became available,
as well as creating/replying to topics/posts. Additionally, the following sections and areas
became visible:
Spotlight
Attention New Members! - 1602 redirects
Discussion
Practical Child Education Sex Tourism & Prostitution -
294 posts
189 posts
22 topics
23 topics
371 posts
1412 posts
808 posts
525 posts
31 posts
89 topics
177 topics
80 topics
78 topics
9 topics
Boy ImagesMale Babies & ToddlersMale Jailbait Male AdultGirl Images Female Babies & Toddlers -
2735 posts
530 posts
103 posts
38 posts
3303 posts
718 posts
237 topics
53 topics
13 topics
7 topics
236 topics
60 topics
81
323 posts
100 posts
214 posts
24 topics
9 topics
13 topics
82
a thumbnail image of a clothed female child with her hands and feet tied and duct
tape over her mouth and the comment "You can do so much with them, if they are
tied up!"
New to me, his is so cute, waiting to be destroyed. This thread was started on
06/20/2013 and provided four (4) thumbnails of a pre-pubescent male partially
clothed. Comments by users indicated various sexual acts they would like to
perform on the child.
Under Boy ImageslMaie Jailbait was the following topic/post:
Coffee coloured boy having fun with a pervert. This thread was started on
04/03/2013 and provided 14 thumbnail images of a minor male forced to perform
oral sex on and anally penetrated by an adult male.
Under Girl Images was the following topic/post:
rape and torcher babyssssss. This thread was started on 06/20/2013 and provided
numerous thumbnail images of infants/toddlers bound, anally/vaginally penetrated
with objects/male penis, and lewd and lascivious display of genitals. This topic
contained nine (9) pages of replies and additional posts at the time it was
reviewed.
Under Girl ImageslFemaie Babies & Toddlers was the following topic/post:
This thread was started on 06/30/2013 and provided a
thumbnail image linking to a proof sheet depicting an infant female vertically
suspended by her ankles with duct tape over her mouth. A nude adult female can
be seen in the images touching the infant female's genitals and displaying them in
a lewd and lascivious manner.
Under Girl ImageslFemale Jailbait was the following topic/post:
Niplles begging to be abused. This thread was started on 05/04/2013 and
provided a thumbnail and link to larger image of an identified underage female
with her genitals displayed in a lewd and lascivious fashion and an object inserted
into her vagina. A second user provided a second thumbnail and link to larger
image of the same underage female bound by her ankles and wrists while her
genitals are displayed in a lewd and lascivious manner.
Under Mixed Gender & Misc. Images was the following topic/post:
dark skinned toddy. This thread was started on 05/04/2013 and provided
83
thumbnails and links to larger images of underage males engaged in oral sex with
adult males. Additional replies and posts by other board members/guests provided
additional thumbnails and links to larger images.
Website 22
193.
connected to the Internet via thc Tor Browser and accessed the Tor hidden service at the URL
onion (hereinafter referred to as "Website 22"). Website 22 is a Tor hidden
service with the primary purpose to be the advertisement and distribution of files containing child
exploitation material. As of 07/12/2013, the site reports that there are almost 1.4 million files
that have been uploaded and are accessible by individuals who visit the hidden service. It is not
required to register with the site to either post/view content or participate in forum discussions.
However, for the forum section of the site, a registered account allows an individual to send and
receive private messages between users. There are no pre-requisites are requirements to create an
account.
194.
The home page of the hidden service itself displays thumbnails of either images or
videos that have recently been uploaded, along with files that individuals have marked as being a
favorite. One file displayed, identified by file number_jpg,
with his genital area displayed as the focal point of the image. Another file, identified by file
number_.jpg,
male. This file appears to be a series of still shots taken from a video. At the top-right of the
home page are links to areas identified as "Girls," "All," and "Boys" along with age ranges from
box to fmd files associated with a particular word/age/sex. The results of this type of search are
84
provided in a thumbnail format and based on either words "tagged" onto an image or words
located in set-names associated with certain groups of related files. Selecting images or sets then
allows the user to download/view individual files with an option to download all files associated
with a particular result.
195.
Individuals visiting the site can upload files either singularly or in groups, either
as individual files or part of an archive file. Once uploaded, these files can be viewed and/or
downloaded by anyone accessing the hidden service.
196.
The site's forum section, which includes 16 language specific areas, did not itself
appear to contain any child exploitation material, but did provide an area for discussion on
various topics such as computer security, "Morality of Pedophilia," "Website Ideas,
Improvements & Bugs" among others. There are 16 language specific areas in the forum as well.
Website 23
197.
connected to the Internet via the Tor Browser and accessed the Tor hidden service at the URL
onion (hereinafter referred to as "Website 23"). Website 23 is a Tor hidden
service, primarily in the Russian language, with the primary function to be the advertisement,
distribution and production of files containing child exploitation material. As of July IS, 2013,
the site reports that there are over 14,000 posts, 612 topics, and over 16,000 members. Other
information visible on the initial page includes recently registered members, current number of
site visitors accessing the site, and most users ever online (44 users on 01/13/2012).
198.
The main home page of Website 23 depicts the name of the site in the English
language and, below the name of the website, the word "preteen" in English. Next to the site
85
All links on the initial page are written in Russian. Links visible were translated
via Google Translate to FAQ, registration, and entrance (interpreted as Log-In). Accessing the
FAQ link opened a page with numerous entries in the Russian language. No content or other
information related to members or postings is visible until an individual creates and registers a
user account with the bulletin board. During the registration process, a user provides a username,
password and e-mail address. Additionally, a Russian-based e-mail account was visible which
was associated with a link for "Board Administrator." Once registered, a private message feature
became available, although one could not see a list of members. In addition, after registering and
logging onto the bulletin board the following topics became visible:
Rules 4 topics 13 posts
Hi II topics 2,303 posts
200.
Accessing the "Rules" section revealed a topic posting titled "[h]ow to post,"
which was started on 08/14/2011 by the board administrator, which contained information related
to posting images/videos on the site. Information in the post covered locations to host the file
and/or a preview of the file, password format (passwords were required to contain a user's
nickname and the website name), instructions to change the name of the files to something
"offiopic," and that any posts not conforming to these rules would be deleted. Based upon my
training and experience, I believe that changing filenames to something "off topic" means
altering filenames so that it is not obvious the file contains child pornography or erotica.
201.
Also within the "Rules" section was a posting titled "[!Jor registration and see
posts," started on 08/14/2011 by the board administrator. Information contained in the post
86
Also within the "Rules" section was a posting titled "HOW to get VIP," started on
08/29/20 II by the board administrator. That posting contained detailed instructions on how to
become a VIP member based on access to "exclusive material." Members with "exclusive
material" were instructed to contact the administrator via "PM," which based upon my training .
and experience I understand to mean private message, for additional details and instructions
about how to "transition to VIP." Five (5) additional posts by the board administrator showed
examples of child exploitation material depicting underage or pre-pubescent females. Each
image contained a reference to the website name written on either a sign held by/adjacent to the
underage female or written on her body. Additionally, some images contained what appeared to
be usemames of users who are currently listed as members of this particular bulletin board.
203.
Also within the "Rules" section was a posting titled "[h]ow to download from
cash-file," started on 08/14/2011 by the board Administrator. That posting appeared to relate to
utilizing a third party hosting site - i.e., a website other than Website 23 where child exploitation
material could be stored for download by board users. As of 07/15/2013, neither the primary
URL nor the secondary site listed in subsequent posts appeared to be active or accessible.
204.
Accessing the "Hi" section showed the most recent post in the "For greetings" thread
occurred on 07/15/2013 by a registered member. Some, though not all, of the avatars observed in
this thread associated with postings by site members appeared to be child exploitation material.
THE NETWORK INVESTIGATIVE
205.
TECHNIQUE
87
other law enforcement officers and computer forensic professionals involved in this investigation,
and based upon all of the facts set forth herein, to my knowledge a network investigative technique
such as the one applied for herein is the only presently available investigative technique with a
reasonable likelihood of securing the evidence necessary to prove beyond a reasonable doubt the
actual location and identity of those administrators and users of Websites 1-23 described in
Attachment A who are engaging in the federal offenses enumerated in paragraph 4. Due to the
unique nature of the Tor network and the method by which the network protects the anonymity of its
users by routing communications through multiple other computers or "nodes," as described herein,
other investigative procedures that are usually employed in criminal investigations of this type have
been tried and have failed or reasonably appear to be unlikely to succeed if they are tried.
206.
concluded that using a network investigative technique may help FBI agents locate the users of the
child pornography Websites 1-23. Accordingly, I request authority to use the NIT, which will be
deployed on Websites 1-23 while Websites 1-23 operate in the District of Maryland, to investigate:
(1) any user or administrator who logs into any of Websites 1-23 by entering a usernarne and
password; (2) any user who accesses any section of any of Web sites 1-23 where child pornography
may be accessed; and (3) any user who uploads a file to any of Web sites 1-23.
207.
computer downloads that content and uses it to display web pages on the user's computer. Under the
NIT authorized by this warrant, the website, which will be located in ~e
District
of Maryland, would augment that content with some additional computer instructions. When a
computer successfully downloads those instructions from the website located in the District of
88
Maryland, the instructions are designed to cause the "activating" computer to deliver certain
information to a computer controlled by or known to the government. That information is described
with particularity on the warrant (in Attachment B of this affidavit), and the warrant authorizes
obtaining no other information. The NIT will not deny the user ofthe "activating" computer access
to any data or functionality of that computer.
208.
The NIT will reveal to the government environmental variables and certain registry-
type information that may assist in identifYing the computer, its location, and the user of the
computer, as to which there is probable cause to believe they are evidence of violations of the
statutes cited in paragraph 4. In particular, the NIT will reveal to the government no information
other than the following items, which are also described in Attachment B:
The "activating" computer's ~ctual IP address, and the date and time that the
NIT determines what that IP address is;
A unique identifier (e.g., a series of numbers, letters, and/or special
characters) to distinguish the data from that of other "activating" computers.
That unique identifier ",ill be sent with and collected by the NIT;
The type of operating system running on the computer, including type (e.g.,
Windows), version (e.g., Windows 7), and architecture (e.g., x 86);
Information about whether the NIT has already been delivered to the
"activating" computer;
The "activating" computer's Host Name. A Host Name is a name that is
assigned to a device connected to a computer network that is used to identifY
89
such as
allows
for proper
routing
of
evidence of the crimes under investigation, including information that may help to identifY the
"activating" computer and its user. The actual IP address of a computer that accesses Websites 1-23
can be associated with an Internet service provider ("ISP") and a particular ISP customer. The
unique identifier and information about whether the NIT has already been delivered to an
"activating" computer will distinguish the data from that of other "activating" computers. The type
of operating system running on the computer, the computer's Host Name, and the computer's MAC
address can help to distinguish the user's computer from other computers located at a user's
premises.
210.
During the up to thirty day period that the NIT is deployed on Websites 1-23 which
will be located in the District of Maryland, each time that any user or administrator logs into any of
90
Websites 1-23 by entering a usemame and password, or accesses any sections of any of Web sites 123 where child pornography may be accessed, or uploads a file to any of Websites 1-23, the NIT
authorized by this warrant will attempt to cause the user's computer to send the above-described
information to a computer controlled by or known to the government that is also located in the
District of Maryland.
2 I I.
In the normal course of the operation of a web site, a user sends "request data" to the
web site in order to access that site. While Websites 1-23 operate at a government facility, such
request data associated with a user's actions on Websites 1-23 wiII be collected. That data collection
is not a fimction of the NIT. Such request data can be paired with data collected by the NIT,
however, in order to attempt to identify a particular user and to determine that particular user's
actions on Websites 1-23.
Rule 41()(3) allows for the delay of any notice required by the rule if authorized by
statute. 18 U.S.C.
S 3 103a(b) (I)
and (3) allows for any notice to be delayed if "the Court finds
reasonable grounds to believe that providing immediate notification of the execution of the warrant
may have an adverse result (as defined in 18 U.S.C.
S 2705)
the giving of such notice within a reasonable period not to exceed 30 days after the date of its
execution, or on a later date certain if the facts of the case j ustify a longer period of delay." Because
there are legitimate law enforcement interests that justify the unannounced use of a NIT, I ask this
Court to authorize the proposed use of the NIT without the prior announcement of its use.
Announcing the use of the NIT could cause the users or administrators of Websites I-23 to undertake
91
other measures to conceal their identity, or abandon the use of Web sites 1-23 completely, thereby
defeating the purpose of the search.
213.
The government submits that notice of the use of the NIT, as otherwise required by
Federal Rule of Criminal Procedure 41(t), would risk destruction of, or tampering with, evidence,
such as files stored on the computers of individuals accessing Websites 1-23. It would, therefore,
seriously jeopardize the success of the investigation into this conspiracy and impede efforts to learn
the identity of the individuals that participate in this conspiracy, and colleet evidence of, and property
used in committing, the crimes (an adverse result under 18 U.S.C. 93103a(b)(l) and 18 U.S.C. 9
2705).
214.
Furthermore, the investigation has not yet identified an appropriate person to whom
such notice can be given. Thus, the government requests authorization, under 18 U.S.C. 93103a, to
delay any notice otherwise required by Federal Rule of Criminal Procedure 41(t), until 30 days after
any individual accessing Websites 1-23 has been identified to a sufficient degree as to provide
notice, unless the Court finds good cause for further delayed disclosure.
215.
The government further submits that, to the extent that use of the NIT can be
92
Rule 41 (e )(2) requires that the warrant command FBI "to execute the warrant within a
daytime, unless the judge for good cause expressly authorizes execution at another time." After the
server hosting Websites
government
custody.
Accordingly, the
For the reasons above and further, because users of Web sites 1-23 communicate
on
the board at various hours of the day, including outside the time period between 6:00 a.m. and 10:00
p.m., and because the timing of the user's communication
the user chooses to access the board, rather than by law enforcement,
to be employed at any time a user's computer accesses Web sites 1-23, even if that occurs outside the
hours of 6:00 a.m. and 10:00 p.m. Further, I seek permission to review information
transmitted to a
computer controlled by or known to the government, as a result of the NIT, at whatever time of day
or night the information
218.
is received.
The government
Accordingly,
1-23. Variations
in configuration,
of the computers
to continue to
93
219.
The Government may, if necessary, seek further authorization from the Court to
employ the NIT on Web sites 1-23 beyond the 30-day period authorized by this warrant.
SEARCH AUTHORIZATION REOUESTS
220.
b.
c.
that the government may receive and read, at any time of day or night, within 30
days from the date the Court authorizes of use of the NIT, the information that
the NIT causes to be sent to .the computer controlled by or known to the
government;
d.
94
I further request that this application and the related documents be filed under seal.
CONCLUSION
222.
experience and training, I have probable cause to believe there exists evidence, fruits, and
instrumentalities of criminal activity related to the sexual exploitation of children on computers that
access Websites 1-23, in violation of 18 U.S.C. 992251 and 2252A.
223.
Based on the information described above, there is probable cause to believe that the
Based on the information described above, there is probable cause to believe that
employing a NIT on Websites 1-23, to collect information described in Attachment B, will result in
the FBI obtaining the evidence and instrumentalities of the child exploitation crimes described
above.
The United States considers this technique to be covered by law enforcement privilege. Should the Court wish to
issue any written opinion regarding any aspect of this reques~ the United States requests notice and an opportunity to
be heard with respect to the issue of law enforcement privilege.
3
95
Special Agent
96
ATTACHMENT
A-PAGE
1 OF2
Locations to be Searched
This warrant authorizes the use of a network investigative technique ("NIT') to be deployed
on the computer server described below, obtaining information described in Attachment B from the
activating computers described below.
The computer server is the server operating the Tor network child pornography websites
referred to herein as Websites 1-23, as identified by their respective Tor URLs in the following chart,
which will be located at a government facility in the District of Maryland.
The activating computers are those of: (I) any user or administrator
Websites 1-23 by entering a username and password; (2) any user who accesses any section of any of
Websites 1-23 where child pornography may be accessed; and (3) any user who uploads a file to any
of Web sites 1-23.
The government will not employ this network investigative technique after 30 days after this
warrant is authorized, without further authorization.
97
ATTACHMENT A-PAGE2
Locations to be Searched
Website #
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
98
OF2
ATTACHMENT
Information
to be Seized
the "activating" computer's actual IP address, and the date and time that the NIT detennines
what that IP address is;
2.
a unique identifier (e.g., a series of numbers, letters, and/or special characters) to distinguish
data from that of other "activating" computers, that will be sent with and collected by the NIT;
3.
the type of operating system running on the computer, including type (e.g., Windows),
version (e.g., Windows 7), and architecture (e.g., x 86);
4.
information about whether the NIT has already been delivered to the "activating" computer;
5.
6.,
SS 2251(d)(I)
S 2252A(g),
2252A(a)(2)(A) and (b)(1), Receipt and Distribution of, and Conspiracy to Receive and Distribute Child
Pornography; and/or 18 U.S.C.
S 2252A(a)(5)(B)
99