Neiheisel Complaint 0
Neiheisel Complaint 0
I, the undersigned complainant, being duly sworn, state the following is true and correct to the best of
my knowledge and belief. On or about February 7, 2016, at Jacksonville, in the Middle District of Florida,
defendant, JASON JAMES NEIHEISEL did knowingly distribute a visual depiction using any means and
facility of interstate and foreign commerce by any means, that is, by computer via the internet, when the
production of the visual depiction involved the use of a minor engaging in sexually explicit conduct, and the
visual depiction was of such conduct, the visual depiction being specifically identified in the computer file
titled "bathtime with daddy-3yo girl ped.mpg," in violation of Title 18, United States Code, Sections
I further state that I am a Special Agent with Federal Bureau oflnvestigation, and that this
~.,..__,_____
Signature of Complainant
NICHOLAS PRIVETTE, Special Agent
Federal Bureau oflnvestigation
Sworn to before me and subscribed in my presence,
JOEL B. TOOMEY
United States Magistrate Judge
Name & Title of Judicial Officer Signature of Judicial Officer
Case 3:17-mj-01138-JBT Document 1 Filed 05/03/17 Page 2 of 11 PageID 2
AFFIDAVIT
(FBI) and have been so employed since August 2016 when I began my law
assigned to the Jacksonville, Florida Division of the FBI where I conduct a variety of
investigations in the area of violent crimes and child exploitation. Prior to this
assignment, I was employed with the United States Army for approximately 12 years
as an Infantry Officer and most recently held the position of Company Commander.
have worked with experienced Special Agents, as well as other law enforcement
investigating and assisting with cases involving crimes against children under the
sexual exploitation of children that constituted violations of Title 18, United States
Code, Sections 2252 and. 2252A, as well as Flori~a state statutes which criminalize
the possession, receipt, and transmission of child pornography, that is, visual images
victims, and I have observed experienced Special Agents do the same and serve in the
role of case agents. I am a member of the FBI Jacksonville Field Office's Child
Exploitation Task Force, which comprised of federal, state, and local law
violations of laws of the United States, and to execute search warrants and arrest
and other law enforcement officers and personnel. This affidavit is being submitted
for the limited purpose of establishing probable cause for the filing of a criminal
2
Case 3:17-mj-01138-JBT Document 1 Filed 05/03/17 Page 4 of 11 PageID 4
complaint, and I have not included each and every fact known to me concerning this
investigation. I have set forth only the facts that I believe are necessary to establish
violation of Title 18, United States Code, Section 2252(a)(2), that is, knowing
visual depiction using any means and facility of interstate and foreign commerce by
any means, that is, by computer via the internet, when the production of the visual
depiction involved the use of a minor engaging in sexually explicit conduct, and the
visual depiction was of such conduct, the visual depiction being specifically identified
in the computer file titled "bathtime with daddy-3yo girl ped.mpg", in violation of
5. On April 13, 2017, I applied for and obtained a federal search warrant
for a silver-colored Microsoft Surface computer tablet, with no visible serial number,
that was obtained from JASON JAMES NEIHEISEL at his apartment residence in
was the affiant for the affidavit in support of the application for this search warrant,
and I am familiar with the facts contained therein. A certified copy of the
3
Case 3:17-mj-01138-JBT Document 1 Filed 05/03/17 Page 5 of 11 PageID 5
application and affidavit for this search warrant is attached as Exhibit A, and the
This warrant authorized the search of the silver-colored Microsoft Surface computer
and 2252A, that is, receipt, distribution and possession of child pornography. This
search warrant was issued by United States Magistrate Judge Patricia D. Barksdale
April 11, 2017 is in<;luded within Exhibit A at paragraphs 31 and 32. Later in the
morning on April 11, 2017, NEIHEISEL called me on the FBI Jacksonville Field
"check in,, and to "see what the next step is" regarding an investigation of child
information regarding the general time frame and internet sources that he used to
find and download child pornography, NEIHEISEL did not offer more specifics
other than what was previously discussed during the in-person interview.
NEIHEISEL stated that believed that other child pornography content could be
1
Certain identifying information has been redacted from the affidavit in
support of the application for the search warrant to protect the privacy of persons
referred to therein.
4
Case 3:17-mj-01138-JBT Document 1 Filed 05/03/17 Page 6 of 11 PageID 6
found on similar websites and file sharing programs as "when I've found it before."
NEIHEISEL did not have any further questions at that time and indicated that he
wished to schedule a follow up meeting with me, but was unsure of his schedule
availability. NEIHEISEL advised me that he would review his schedule and call
me back with a suggested date and time for an in-person meeting later in the week.
Field Office main telephone number to "check in." NEIHEISEL reiterated his
desire to assist with the investigation, but he did not have any further questions for
me and did not have any additional information to offer. When I asked if
NEIHEISEL still wished to schedule a follow up meeting with me, he said that he
would like to do so. NEIHEISEL was initially unsure of his schedule availability
but advised that during lunch on Friday of the same week would probably work.
When asked what type of meeting (public or private) NEIHEISEL would prefer, he
was unsure and did not offer a specific location. NEIHEISEL agreed to a tentative
meeting time of 11 :00 a.m. on Friday, April 14, 2017, pending further contact to
computer tablet referred to above to the computer forensic examiners at the FBI
5
Case 3:17-mj-01138-JBT Document 1 Filed 05/03/17 Page 7 of 11 PageID 7
forensic examiner, I learned that the Microsoft Windows operating system appeared
and multimedia, that indicated that NEIHEISEL has used the tablet for personal use.
In particular, a user profile named "Jason" was present on the tablet, with various
tablet. It appears that the program was used to download the movie "Elf," and this
11, 2017.
Field Office main telephone number to "check in." NEIHEISEL reiterated his
desire to assist with the investigation, but he did not have any fmther questions for
me and did not have any additional information to offer. NEIHEISEL indicated in
substance that he was very busy and "slammed" with work that week and agreed to
6
Case 3:17-mj-01138-JBT Document 1 Filed 05/03/17 Page 8 of 11 PageID 8
tentative meeting time of 11:30 a.m. on Tuesday, April 25, 2017, at a location in the
vicinity of the St. Johns Town Center in Jacksonville, Florida. On the morning of
April 25, 2017, I called NEIHEISEL on his cellular phone, and we agreed to meet at
the Panera.Bread restaurant in the St. Johns Town Center in Jacksonville, Florida at
interview ofNEIHEISEL at Panera Bread restaurant in the St. Johns Town Center,
that he had in fact used BitTorrent to download and make child pornography videos
find child pornography and likened it to "reddit.com" of which he said, "I'm on it all
the time." In Chat Tango, users of the platform are able to send links which direct
other users to cloud-based storage or servers elsewhere which house the contents of
7
Case 3:17-mj-01138-JBT Document 1 Filed 05/03/17 Page 9 of 11 PageID 9
child pornography. Likewise, other users of Chat Tango are able to click on those
links and are taken to a particular location where child pornography images and
videos are available to view and download. NEIHEISEL recalled his downloading
of child pornography activity as, "it's kind of dumb" and added, "you download
stuff you download," and intimated that child pornography is just out there, often
with an innocuous name or title for the zip files which contain the child pornography
content.
c. Unlike the Chat Tango platform in which users are able to send
links to another Chat Tango user, NEIHEISEL confirmed that BitTorrent works
other users of BitTorrent are able to collect content which is saved in that
shown to him during the prior consensual interview on April 11, 2017 were obtained
by law enforcement from his "downloads" folder, and that law enforcement was able
to receive those child pornography videos from his "downloads" folder not because
NEIHEISEL knew that he had made the child pornography videos available for
He further understood and agreed that "anyone on the BitTorrent network can get
8
Case 3:17-mj-01138-JBT Document 1 Filed 05/03/17 Page 10 of 11 PageID 10
videos from the shared folder, but [NEIHEISEL] doesn't solicit others for it."
folder for more than one day but less than one month, and estimated it was likely he
"kept for a week" then deleted the child pornography. NEIHEISEL deleted the
child pornography videos after he "no longer needed them" and because his device
enterprise operations to coordinate the abuse of children and was also unaware of
other applications, platforms, or programs other than BitTorrent and Chat Tango
possessing any other device to access, store, or trade child pornography other than
the tablet that was already in my custody since April 11, 2017. Upon conclusion of
11. Based upon the foregoing facts, I have probable cause to believe that on
depiction using any means and facility of interstate and foreign commerce by any
means, that is, by computer via the internet, when the production of the visual
depiction involved the use of a minor engaging in sexually explicit conduct, and the
9
Case 3:17-mj-01138-JBT Document 1 Filed 05/03/17 Page 11 of 11 PageID 11
visual depiction was of such conduct, the visual depiction being specifically identified
in the computer file titled "bathtime with daddy-3yo girl ped.mpg", in violation of
~~
NICHOLAS PRIVET : : : : :
Federal Bureau of Investigation
M I? I - z
JOEL B. TOOMEY I
United States Magistrate Judge
10
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 1 of 39 PageID 12
. The basis for the search under Fed. R. Crim. P. 4l{c) is (checltone or more):
s/ evidence of a crime;
mcontraband, fruits of crime, or other items illegally possessed;
CB propeny designed for use, intended for use, or used in committing a crime;
a a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:
Code Section Offense Description
18 U.S.C. 2252 & 2252A Receipt, distribution, and possession of child pornography.
c ~* Applicant's signature
- ~ ~ i i S. Mac8eRa1d, Special Agent, FBI
Printed name and title
Sworn to be ore me and signed In my presence.
Date:
Judge's signa1ure
City and state: Jacksonville, Florida Patricia D. Barksdale, United States Magistrate Judge
Printed name and 1i1le
Exhibit A
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 2 of 39 PageID 13
INTRODUCTION
I. I am a Special Agent (SA) with the Federal Bureau of Investigation
(FBI) and have been so employed since August 2016 when I began my law
assigned to the Jacksonville, Florida Division of the FBI where I conduct a variety of
investigations in the area of violent crimes. Prior to this assignment, I was employed
with the United States Army for approximately 12 years as an Infantry Officer and
experienced Special Agents, as well' as other law enforcement officers and personnel,
who investigate Child Exploitation offenses and other crimes against children. A
cases involving crimes against children under the auspices of the FBI's "Innocent
Images" National Initiative. In the performance ofmy duties, I have assisted in the
I
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 3 of 39 PageID 14
through either the execution of search warrants or through the. subject providing
sexual exploitation of children which constituted violations of Title 18, United States
Code, Sections 2252 and 2252A, as well as Florida state statutes which criminalize
the possession, receipt, and transmission of child pomo8faphy, that is, visual images
have observed experienced Special Agents serve in the role of case agent. I am a
member of the FBI Jacksonville Field Office's Child Exploitation Task Force,
comprised of federal, state, and local law enforcement agencies. These agencies
routinely share information involving the characteristics of child sex offenders as well
investigate and assist in the prosecution of violations of laws of the United States,
and to execute search warrants and arrest warrants issued by federal and state courts.
and other law enforceme~t officers and personnel. This affidavit is being submitted
for the limited purpose of securing a search warrant, and I have not included each
and every fact known to me concerning this investigation. I have set forth only the
facts that I believe are necessary to establish probable cause to believe evidence of a
2
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 4 of 39 PageID 15
violation of Title 18, United States Code, Section 2252 is present in the item to be
searched.
STATIITORY AUTHORITY
4. This investigation concerns alleged violations of Title 18, United States
Codet Sections
.
2252 and 2252A, relating to material involving the sexual
conversations with other experienced law enforcement officers and at least one
minors engaging in sexually explicit conduct using any means or facility of interstate
computer or mail.
minors engaging in sexually explicit conduct using any means or facility of interstate
interstate or foreign commerce. That section also makes it a federal crime for any
explicit conduct for distribution using any means or facility of interstate or foreign
knowingly access with intent to view, one or ~ore books, magazines, periodicals,
films, video tapes, or other matter, which contains one or more visual depictions of
minors engaged in sexually explicit conduct that has been mailed, or has been
from knowingly receiving or distributing any child pornography that has been mailed
4
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 6 of 39 PageID 17
with intent to view any book, magazine, periodical, film, videotape, computer disk,
or other material that contains an image of child pornography that has been mailed,
by computer, or that was produced using materials that have been mailed, or shipped
DEFINITIONS
5. The following definitions apply to this Affidavit:
sexually arousing to persons having a sexual interest in minors but that are not, in
and of themselves, illegal or that do not necessarily depict minors in sexually explicit
poses or positions.
where (a) the production of the visual depiction involved the use of a minor engaged
in sexually explicit conduct, (b) the visual depiction is a digital image, computer
minor engaged in sexually explicit conduct, or (c) the visual depiction has been
visual image, and data which is capable of conversion into a visual image that has
between persons of the same or opposite sex; (b) bestiality; (c) masturbation; (d)
sadistic or masochistic abuse; or (e) lascivious exhibition of the genitals or pubic area
of any persons. ~ 18 U.S.C. 2256(2).
6
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 8 of 39 PageID 19
which can receive, capture, collect, analy~e, create, display, convert, store, conceal,
hardware includes any data processing devices (including, but not limited to, central
processing units, internal and peripheral storage devices such as fixed disks, external
hard .drives, floppy disk drives and diskettes, and other memory storage devices);
peripheral input/output devices (including, but not limited to, keyboards, printers,
video display monitors, and related communications devices such as cables and
connections}, as well as any devices, mechanisms, or parts that can be used to restrict
access to computer hardware (including, but not limited to, physical keys and locks).
which can .be interpreted by a computer and any of its related components to direct
the way they work. Computer software is stored in electronic, magnetic, or other
herein, include all information recorded in any form, visual or aural, and by any
means, whether in handmade form (including, but not limited to, writings, drawings,
paintings), photographic form (including, but not limited to, microfilm, microfiche,
prints, slides, negatives, videotap~s, motion pictures, photocopies), mechanical form
(including, but not limited to, phonograph records, printing, typing) or electrical,
electronic or magnetic form (including, but not limited to, tape recordings, cassettes,
7
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 9 of 39 PageID 20
compact discs, electronic or magnetic storage devices such as floppy diskettes, hard
disks, CD-ROMs, digital video disks (DVDs), personal digital assistants (PDAs),
multimedia cards (MMCs), memory sticks, optical disks, printer buffers, smart cards,
files and printouts or readouts from any magnetic, electrical or electronic storage
device).
i. 11
Computer passwords and data' security devices," as used herein,
characters) usually operates a sort of digital key to "unlock" particular data security
devices. Data security hardware may include encryption devices, chips, and circuit
boards. Digitally coded data security software may include programming code that
creates test" keys or "hot" keys, which perform certain pre-set security functions
when touched. Data security software or code may also encrypt, compress, hide, or
number used by a computer to access the Internet and is associated with a physical
address. IP addresses can be dynamic, meaning that the Internet Service Provider
(ISP) assigns a unique and different number to a computer every time it accesses the
8
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 10 of 39 PageID 21
Internet. IP addresses might also be. static. if an ISP assigns a user's computer a
particular IP address which is used each time the computer accesses the Internet.
other experienced law enforcement officers and computer forensic examine~, I know
that computers and computer technology have revolutionized the way in which
individuals interested in child pornography interact with each other. In the past,
child pornography was produced using cameras and film (either still photography or
develop and reproduce the images. There were definabie costs involved with the
were somewhat bulky and required secure storage to prevent their exposure to the
public and/or law enforcement. The distribution of these wares was accomplished
7. The development of computers has radically changed the way that child
traditional camera (using ordinary film) into a computer readable format with a
device known as a scanner. Moreover, with the advent, proliferation and widespread
9
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 11 of 39 PageID 22
use of digital cameras, images and videos can now be transferred directly from a
digital camera onto a computer using a connection lmown as a USB cable or other
device I. Digital cameras have the capacity to store images and videos indefinitely,
and memory storage cards used in these cameras are capable of holding hundreds of
images and videos. A device known as a modem allows any computer to connect to
Electronic contact can be made to literally millions of computers around the world.
itself an ideal repository for child pornography. The size of the electronic storage
media, that is, the hard disk drive used in home computers has grown tremendously
within the last several years. These hard disk drives can store hundreds of thousands
IO. The World Wide Web of the Internet affords collectors of child
pornography several different venues for obtaining, viewing and trading child
Internet Portals such as Yahoo!, Hotmail, and Google, among others. The online
services allow a user to set up an account with a remote computing service that
provides email services as well as electronic storage of computer files in any variety
of formats. A user can set up an online storage account from any computer with
access to the Internet. Evidence of such online storage of child pornography is often
found on the user's computer. Even in cases where online storage is used, however,
evidence of child pornography can be found on the user's computer in most cases.
computer can be saved or stored on the computer used for these purposes. Storing
this information can be intentional, i.e., by saving an email as a file on the computer
or saving particular website locations in, for example, "bookmarked" files. Digital
information, images and videos can also be retained unintentionally, e.g., traces of
(e.g., temporary files or ISP client software, among others). Often, a computer will
and other users that have occurred over the Internet. These logs are commonly
referred to as "chat logs." Some programs allow computer users to trade images
while simultaneously engaging in electronic communications with each other. This
and experience, as well as conversations with other law enforcement officers and
11
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 13 of 39 PageID 24
computer forensic examiners, I know that these electronic "chat logs" often have
communication in transcript form, show the date and time of such communication,
and also. may show the dates and times when images of child pornography were
history files of the browser used. A forensic examiner often can recover evidence
suggesting whether a computer contains P2P software, when the computer was
sharing files, and some of the files which were uploaded or downloaded. Such
other experienced law enforcement officers, I know that searches and seizures of
from the computers and their components, or seize most or all computer items
she often stores it in random order with deceptive file names. This requires searching
authorities to examine all the stored data to determine whether it is included in the
warrant. This sorting process can take days 9r weeks, depending on the volume of
data stored, and it would be generally impossible to accomplish this kind of data
technical process requiring expert skill and a properly controlled environment. The
vast array of computer hardware and software available requires even computer
before a search which expert should analyze the system and its data. The search of a
computer system, which includes the use of data search protocols, is an exacting
scientific procedure which is designed to protect the integrity of the evidence and to
analysis.
2
Based on my training and experience, as well as conversations with
other law enforcement officers and computer forensic examiners, I know that
co~puter forensic techniques can often recover files, including images and videos of
child pornography, that have long been "delete~" from computer media by a
computer user.
13
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 15 of 39 PageID 26
children, I know that certain common characteristics are often present in individuals
who collect child pornography. I have observed and/or learned about the reliability
and trade images of child pornography. Based upon my training and expe~ience, and
conversations with other experienced agents who investigate cases involving the
sexual exploitation of children, I know that the following traits and characteristics
pornography also collect child pornography. Many individuals who collect child
children.
motion pictures, video tapes, books, slides, computer graphics or digital or other
images for their own sexual gratification. Many of these individuals also collect
child erotica, which may consist of images or text that do not meet the legal
definition of child pornography but which nonetheless fuel their deviant sexual
fantasies involving children.
14
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 16 of 39 PageID 27
like minded individuals, either in person or on the Internet, to share information and
trade depictions of child pornography and child erotica as a means of gaining status,
trust, acceptance, and support. This contact also helps these individuals to
rationalize and validate their deviant sexual interest in children and associated
communicate with each other include, but are not limited to, P2P, email, email
groups, bulletin boards, Internet Relay Chat Rooms (IRC), newsgroups, instant
magazines, newspapers and other writings (which may be written by the collector),
in hard copy or digital medium, on the subject of sexual activities with children as a
way of understanding their own feelings toward children, justifying those feelings
and finding comfort for their illicit behavior and desires. Such individuals often do
not destroy these materials because of the psychological support that they provide.
publications and on the Internet that they have similar sexual interests. These
profit. These names may be maintained in the original medium from which they
15
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 17 of 39 PageID 28
dispose of their sexually explicit materials and may go to great lengths to conceal and
protect them from discovery, theft, or damage. These individuals view their sexually
with other like-minded individuals over the Internet. As such, they tend to maintain
or "hoard" their visual depictions of child pornography for long periods of time in
the privacy and security of their homes or other secure locations. These individuals
may protect their illicit materials by passwords, encryption, and other security
measures; save it on movable media such as CDs, DVDs, flash memory, thumb
drives, and removable hard drives, which can be very sinall msize, including as
small as a postage stamp, and easily secreted; or send it to third party image storage
conversations with other experienced law enforcement officers who conduct child
distribute child pornography by computer using the Internet often maintain and/or
officers, I know that individuals who collect and trade child pornography often do
not willfully dispose of their child pornography collections, even after contact with
16
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 18 of 39 PageID 29
subject had his residence searched pursuant to a federal search warrant and his
computer and digital storage media seized by the FBI. The search of his computer
and other computer storage media revealed the subject knowingly possessed several
thousand images of child pornography. The subject retained an attorney and both
were made aware of the ongoing investigation into the subject's commission of
federal child pornography offenses. Approximately two months later, the subject
was arrested on federal child pornography possession charges. After the subject's
arrest, the FBI obtained a laptop computer owned by the subject's employer but
possessed and used by the subject both before and after the execution of the search
that the subject had downloaded, possessed and viewed images of child pornography .
numerous times after the execution of the search warrant and before his arrest. Based
enforcement officers and computer forensic examiners, I also know that, with the
networks and other platforms through which individuals may trade child
pornography, some individuals also have been found to download, view, and then
deleted child pornography, often can be located on these individuals' computers and
17
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 19 of 39 PageID 30
digital devices through the use of forensic tools. Furthermore, even in instances in
available to Internet users through the use of special software. The software is
designed to allow users to trade digital files through a worldwide network that is
Computers that are part of this network are referred to as "peers" or "clients." There
are several different software applications that can be used to access these networks,
but these applications operate in essentially the same manner. To access the P2P
networks, a user first obtains the P2P software, which can be downloaded from the
Internet. This software is used exclusively for the purpose of sharing digital files over
the internet.
17. The BitTorrent network is a very popular and publicly available P2P file
18
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 20 of 39 PageID 31
Torrent client program, the Vuze client program, and the BitComet client program,
among others.
18. During the installation of typical BitTorrent network client programs,
various settings are established that configure the host computer to share files via
automatic uploading. Typically, as users download files or pieces of files from other
peers/clients on the BitTorrent network, these other peers/ clients on the network are
able to download the files or pieces of files from them, a process which maximizes
the download speeds for all users on the network. The reassembly of pieces of files is
accomplished by the use of hash values, which are described more fully below. Once
a user has completed the download of an entire file or files, the user can also
continue to share the file with individuals on the BitTorrent network who are
attempting to download all pieces of the file or files. A host computer that has all the
pieces of a file available for uploading to the internet is termed a seeder." Using the
11
BitTorrent protocol, several basic computers, such as home computers, can replace
19. Files or sets of files are shared on the BitTorrent network through the
use of "Torrents." A Torrent is typically a small file that describes the file(s) to be
shared. It is important to note that "Torrent" files do not contain the actual file(s) to
be shared, but rather contain information about the file(s) to be shared. This
information includes the "info hash,,, which is a SHA-I hash value ofthe set of data
describing the file(s) referenced in the Torrent. The term SHA-I is a shorthand term
for the hash value calculated by the Secure Hash Algorithm. The Secure Hash
19
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 21 of 39 PageID 32
Technology (NIST), along with the National Security Agency (NSA), as a means of
identifying files using a digital "fingerprint" that consists of a unique series of letters
and numbers. The United States has adopted the SHA-I hash algorithm described
used of the existing SHA-1 hash functions, and is employed in several widely used
applications and protocols. A file pr~cessed by this SHA-I operation results in the
signatures provide a certainty exceeding 99. 99% that two or more files with the same
SHA-I signature are identical copies of the same file regardless of their file names.
The data contained in the Torrent information includes the SHA-I hash value of
each file piece in the Torrent, the file size(s), and the file name{s). This "info hash"
20. Itl order to locate Torrent files of interest and download the files that
they describe, a typical user will use keyword searches on Torrent-indexing websites,
websites do not actually host the content {files) described in and by the Torrent files,
only the Torrent files themselves or a link that contains that SHA-1 hash value of the
Torrent or the files being shared. Once a Torrent file is located on the website that
meets a user's keyword search criteria, the user will download the Torrent file to
their computer. The BitTorrent network client program on the user's computer will
20
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 22 of 39 PageID 33
then process that Torrent file to help facilitate finding other peers/clients on the
network that have all or part of the fi.le(s) referenced in the Torrent file.
21. For example, a person interested in obtaining child pornographic
conduct a keyword search using a term such as "preteen sex" or "pthc" (pre-teen
hardcore). Based on the results of the keyword search, the user would then select a
Typically, the BitTorrent client program will then process the Torrent file. Using
BitTortent network protocols, peers/ clients are located that have recently reported
they have the file(s) or parts of the file(s) referenced in the Torrent file and that these
file(s) are available for sharing. The user can then download the fi.le(s) directly from
the computer(s) shari~g them. Typically, once the BitTorrent network client has
downloaded part of a file(s), it may immediately begin sharing the file(s) with other
users on the network. The downloaded file(s) are then stored in an area or folder
downloaded file(s), including the Torrent file, will remain in that location until
22. Law enforcement can search the BitTorrent p.etwork in order to locate
individuals sharing child pornography images, which have been previously identified
as such based on their SHA-I values. Law enforcement uses BitTorrent network
client programs which allow for single-source downloads from a computer at a single
IP address, meaning that an entire file(s) is downloaded only from a computer at a
21
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 23 of 39 PageID 34
single IP address as opposed to obtaining the file from multiple peers/ clients on the
BitTorrent network. This procedure allows for the detection and investigation of
investigator's BitTorrent client program and the suspect client program they are
querying and/or downloading a file from. This information includes (1) the suspect
client's IP address; (2) a confirmation from the suspect client that they have pieces of
the file(s) being requested, in whole or in part, and that the pieces of the file(s) is
being reported as shared from the suspect client program; and (3) the BitTorrent
network client program and version being used by the suspect computer. Law
law enforcement agencies around the country. Many of these agencies are
associated with the Internet Crimes against Children (ICAC) Task Force
Program. The ICAC Task Force Program uses law enforcement tools to track IP
addresses suspected (based on SHA! values and file names) of trading child
pornography. P2P investigative methodology has led to the issuance and execution
of search warrants around the country resulting in the arrest and conviction of
whom were also involved in contact sexual offenses against child victims.
22
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 24 of 39 PageID 35
other experienced law enforcement officers and personnel, I know that cooperating
police agencies pool their information to assist in identifying criminal conduct and to
global information available about a suspect that resides within their geographic area
of jurisdiction. Given the global scope of the Internet, this information is valuable
when trying to establish the location of a suspect. Investigators from around the
world gather and log information, which can be used by an investigator to establish
Microsoft Surface computer tablet, with no visible serial number, that was seized
Jonathan MacDonald. This item is currently stored and secured in the FBI
Jacksonville Field Office located at 6061 Gate Parkway, Jacksonville, Florida 32256.
27. The FBI is inve~tigating Neiheisel as a suspect for using this Microsoft
Surface tablet to commit violations of Title 18, United States Code, Sections 2252
and 2252A, which prohibit mailing, transportation, shipment, receipt, possession and
access with intent to view, in interstate or foreign commerce by any means, including
23.
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 25 of 39 PageID 36
by computer, any child pornography, that is, visual depictions of one or more minors
information, some of which was set forth in written documentation that I have
reviewed. Along with my review of this information, I have also had conversations
with SA MacDonald and SA Beccaccio regarding the origins and activities related to
following to be true:
operation to identify persons using the BitToi'rent P2P network on the Internet to
receive, traffic in, share and/ or distribute images and videos depicting child
pornography. I know that TFO Watson has received training in the operation and
use of the BitTorrent P2P network, as well as certain law enforcement techniques
used to investigate users on this network. TFO Watson was investigating host
computers located in Florida that were actively sharing child pornography on the
BitTorrent network. Through the use of specialized law enforcement software, TFO
Watson was able to determine that a host computer using IP address 76.106.190.147
24
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 26 of 39 PageID 37
and February 7, 2016 at 03:56 EST, a law enforcement computer used and controlled
downloaded 1,575 pieces of a total of 7,702 pieces of a video collection from the host
confirmed that this host computer possessed 7,653 pieces. Included in these 1,575
pieces were approximately 56 viewable videos, of which two particular videos with
the title "bathtime with daddy-3yo girl ped.mpg" and a title with several foreign
characters and the words 11 R@yg0Id 11 , "Lolita", and "Bed Sex", are further described
Special Agents and other personnel, and my review ofTFO Watson's investigative
reports, including the log file report of the undercover session which was submitted
and thorough review of all historic information and investigative activity related to
Communications.
25
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 27 of 39 PageID 38
subscnoer and billing information for the account associated with IP address
76.106.190.147 for the dates and times of December 6, 2015 at 03:35 EST, December
that I have reviewed. The subscriber information for the IP address 76.106.190.147
during the dates and times listed above resolved back to account number
Jacksonville, Florida- The email addresses associated with this account were
Drivers and Vehicle Information Database (DAVID) for persons holding a State of
26
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 28 of 39 PageID 39
Jacksonville, Floridallla This query also revealed that a gray 2014 Dodge utility
vehicle with Florida license plate 60NFX was currently registered to Neiheisel.
complex and observed that a vehicle matching the description above was parked in
the vicinity of building 4. The vehicle was a dark gray Dodge Durango with Florida
license plate 60NFX. I walked into building 4 and confirmed that apartment number
28.b. that TFO Watson caused to be downloaded from the host computer connected
EST and February 7, 2016 at 03:56 EST. Included in the 1,575 pieces, as mentioned
in paragraph 28.b/, are two videos with the title "bathtime with daddy-3yo girl
ped.mpg" (hereafter Video I), and a title with several foreign characters and the
27
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 29 of 39 PageID 40
words "R@ygold,,, "Lolita,,, and "Bed Sexn (hereafter video 2). The contents of
believe that Video 1 (more fully described below) depicts at least one minor engaged
therefore constitutes child pornography pursuant to Title 18, United States Code,
Section 2256. As described herein, the SHA-1 values for this video are contained on
pornography. These SHA-1 values are catalogued by the Internet Crimes Against
and February 7, 2016 at 03:56 EST, that was being offered for sharing on the date
duration, of which the entirety was downloaded directly from a host computer at IP
address 76.106.190.147. I have reviewed this video. This video depicts what appears
to be a 3 to 4 year-old female seen naked in a bathtub. The video has sound and a
man can be heard speaking to this minor child, who is standing naked in the bathtub
28
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 30 of 39 PageID 41
and spreading open her genitals. A male asks the female girl, "Can you rub it?" as
she is spreading open her genitals. At 1:56, this prepubescent child is then seen with
her hands on an adult male's erect penis. At 2: 10, this child places this erect penis in
her mouth. The male is seen with his hand on the back of this child's head, pulling
her head and mouth onto his erect penis. The activity continues through the end of
the video.
(2) Based on my training and experience, as well as
believe that Video 2 depicts at least one minor engaged in sexually explicit conduct
pornography pursuant to Title 18, United States Code, Section 2256. As described
herein, the SHA-I values for this video are contained on the list of those known or
designated as a FOI depicting images of child pornography. These SHA-I values are
catalogued by the Internet Crimes Against Children Task Force (ICAC). Video 2,
between February 6, 2016 at 03:51 EST and February 7, 2016 at 03:56 EST, that was
being offered for sharing on the date and times listed below, is described as follows:
29
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 31 of 39 PageID 42
host computer at IP address 76.106.190.147. I have reviewed this video. This video
adult male. At 1:47, this prepu~escent girl is lying on the bed with. no pants on and
exposing her genitals. Then the girl begins to masturbate. At 5:00, the girl is again
shown performing oral sex on an adult male. The activity continues through the end
of the video.
Florida - and observed the same vehicle listed above in paragraph 30;b. parked
the residence. Moments later, Neiheisel emerged from a different room and joined
us. After being advised of our identity and the general nature of the investigation,
Neiheisel agreed to speak with us in his residence and provided the following
information:
30
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 32 of 39 PageID 43
hallways, and they do not socialize together. During the time Neiheisel a n d .
lived in the apartment, they had occasional visitors of family and friends, none of
whom stayed longer than four or five days. Neiheisel an~have never had any
other roommate.
Neiheisel's name, and the wireless service is password protected. Ne~eisel set up
the password protected network with-a router he had from before. Neiheisel has a
solid understanding of information technology and knew his home network was
They do provide the password to the network to family and friends who visit;
laptop and a personal Microsoft Surface tablet. The work laptop was sitting on the
couch next to Neiheisel, and the Surface tablet was in a different room that Neiheisel
the coffee table in front of me and SA MacDonald where the interview was taking
place. Both devices are password protected, and the work laptop has an RSA
SecurelD token as part of its security. He has owned the Surface tablet since before
as "Elf' which he watches on flights to Cincinnati. He was familiar with file sharing
31
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 33 of 39 PageID 44
programs including Limewire and BitTorrent but was unsure if he had BitTorrent
currently installed on his Surface tablet. Neiheisel picked up the Surface tablet,
pushed a few keys, and advised that the BitTorrent program was not on the Surface
tablet. SA MacDonald and I were unable to observe the screen of the Surface tablet
last did so within the past two months. Neiheisel knows child pornography is illegal
and has viewed and downloaded child pornography with his Surface tablet. I
from the IP.address at Neiheisel's apartment. Neiheisel read some of the file titles
and recognized ther as ones he downloaded. He also knew the terms "PTHC" and
"YO" as child pornography related terms but did "not want to say" what they stood
for. SA MacDonald and I asked for clarification, and Neiheisel stated he was "not
clarified that he gets his child pornography through a chat room called "Chat
Tango." Neiheisel did not need to use search terms to find child pornography
because the chat room he accessed had users who provided various links that took
daddy-3yo girl ped.mpg" (previously described above as Video 1), which depicted a
32
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 34 of 39 PageID 45
recognized the video as one he downloaded and viewed but denied masturbating to
the video. Neiheisel downloaded that particular video within the past week and
confirmed he used the Surface tablet that was sitting on the coffee table to download
containing several foreign characters and the words "R@ygold", "Lolita", and "Bed
Sex" (as previously described above as Video 2), which depicted a prepubescent
female child being sexually abused by an adult male. Neiheisel also recognized the
video as one that he had downloaded and viewed and confirmed he used the Surface
tablet that was sitting on the coffee table to download and view the video.
the privacy of his bedroom. No one else knows about his child pornography
found on the Surface tablet saying "there shouldn't be" any child pornography saved
on the tablet.
the past, he has organized and categorized his child pornography videos. Neiheisel
noted that he downloaded child pornography to "see if I can find it" and indicated he
is able to find other "files like that you'll find" in reference to the ones shown to him
by me and SA MacDonald. Neiheisel also noted that he enjoyed the "thrill of the
33
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 35 of 39 PageID 46
hunt,, to see what kind of child pornography files he could find, such as the age range
was advised that he did not have to provide consent. Neiheisel stated that he was
interested in cooperating with me and SA MacDonald but did not feel comfortable
providing consent at the time. Neiheisel did provide the password to the Surface
tablet as "strange777,, and told me and SA MacDonald that he needed to leave for
work.
32. Upon conclusion of the consensual interyiew, SA MacDonald and I
advised Neiheisel that we were securing the Surface tablet based on his statements
about it being used to download child pornography. As stated above, this Surface
tablet was within our plain view and Neiheisel had referred to it as set forth above. I
provided Neiheisel with a FD-597 Receipt for Property Received form, describing
the item, which Neiheisel and I both signed. Neiheisel believed that SA MacDonald
and I had treated him fairly, and he understood the importance of our investigation.
CONCLUSION
33. Based on the foregoing, I have probable cause to believe that fruits,
Sections 2252 and 2252A, including images and/ or videos of ~hild pornography, are
currently contained in the item listed and described above, that is, the silver-colored
Microsoft Surface computer tablet, with no visible serial number, that was seized
34
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 36 of 39 PageID 47
Court authorizing the search and forensic examination of the item listed in
PATRICIA . BARKSDALE
United States Magistrate Judge
35
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 37 of 39 PageID 48
ATTACHMENTB
LIST OF ITEMS TO BE SEIZED AND SEARCHED
1. Any and all computer software, including programs to run operating
systems, applications, such as word processing, graphics, and communications
programs, including, but not limited to, P2P software, that may be or are used to:
visually depict child pornography or child erotica, display-or access information
pertaining to a sexual interest in child pornography; display or access information
pertaining to sexual activity with children; or produce, distribute, possess or receive
child pornography, child erotica, or information pertaining to an interest in child
pornography or child erotica.
3: In any format and medium, all originals, files, and copies of images
and/or videos depicting child pornography as defined in 18 U.S.C. Section 2256(8),
visual depictions of minors engaged in sexually explicit conduct as defined in 18
.U.S.C. Section 2256(2), or child erotica.
4. Any and all diaries or address books containing names or lists of names
and addresses of individuals who have been contacted by use of the device or by
other means for the purpose of distributing or receiving child pornography as defined
in 18 U.S.C. Section 2256(8) or visual depictions of minors engaged in sexually
explicit conduct as defined in 18 U.S.C. Section 2256(2).
9. Any and all records, documents, invoices and materials, in any format
or medium (including, but not limited to, e-mail messages, chat logs and electronic
messages, and other digital data files) that concern any accounts with an Internet
Service Provider.
10. Any and all records, documents, invoices and materials, in any format
or medium (including, but not limited to, e-mail messages, chat logs and electronic
messages, and other digital data files) that concern online storage or other remote
computer storage, including, but not limited to, software used to access such online
storage or remote computer storage, user logs or archived data that show connection
. to such online storage or remote computer storage, and user logins and passwords for
such online storage or remote computer storage.
12. Any and all diaries, notes, e-mail messages, chat logs and electronic
messages,other digital data files reflecting personal contact with minors, sexual
activity with minors, and/or any other activities with minors visually depicted while
engaged in sexually explicit conduct, as defined in 18 U.S.C. Section 2256(2).
2
Case 3:17-mj-01138-JBT Document 1-1 Filed 05/03/17 Page 39 of 39 PageID 50
ATTACHMENT A
ITEM TO BE SEARCHED
The item to be searched is described as follows:
The above-described item was seized from NEIHEISEL during his consensual
interview on April 11, 2017, and is currently secured in the Jacksonville Division of
the Federal Bureau of Investigation, 6061 Gate Parkway, Jacksonville, Florida
32256.