Filing # 93739790 E-Filed 08/06/2019 02:48:07 PM G

m THE CIRCUIT COURT 0F THE SIXTH fllCIAL CIRCUIT

IN Ag FOR rmLLAs COUNTY, FLORIDA

:rszaz

"lf‘ ii

AFFIDAVIT FOR SEARCH WARRANT 62

SHd

BEFORE ME, a Judge of the Circuit Court, Sixth Judicial Circuit, in afid Eb} P&lla?
'

County, Florida, personally appeared your Affiant Nicholas Paden, Detective with thé Pinellas

'

County Sherifi’s Office, who by me was duly‘ sworn, deposed and stated that Affiant has

probable cause to believe that sectibn 827.071 and 847.0135(2), Florida Statutes, related to

Possession'of Child Pomog'aphy and Promoting the Sexual Performance by a Child certain

felony laws have been, and are being violated, in or abbut a certain premises, and the curtilage

thereof, and that evidence of, or evidence relevant to, proving the violation of those felony laws,

in the form of compute? equipment and/or data, or printed or written do.cument and/or other

related items described herein, is being. kept in or about said certain premises and the cartilage
I

thereof, in Pinellas County, Florida, being known and described as follows:

,nereafier the “Premises”).

Description of Premises:

'
.
The three story, single family home has a legal description of

>).”
(LYING IN SEC
'

The residence -is located on the

., facing the northeast. The home,

4,199 square feet of living space and 7,494 square feet of goss space, was built in 1992 with

fi'ame stucco exterior walls and a diagonal driveway connecting S running in

fiont of the home. There is a swimming pool in- the backyard.

***ELECTRONICALLY FILED 08/06/2019 02:48:07 PM: KEN BURKE CLERK OF THE CIRCUIT COURT, PINELLAS COUNTY***
 The exteriof of the residence is white beige, with bronze and dark brown trim. The roof

consists of brown tetra cotta. The home is flanked by two garages on either side of the main

residence. Eight marble steps lead fiom the driveway up t6 the double fi'ont wooden doors with
‘

fiosted glass inlays. The numbers are displayed on individual tiles affixed in a wooden

flame above the door.

'

Your Affiant has probable cause to believe the premises and/or the cartilage thereof, are

being used for the purpose of storing and/or distributing images, inovies, and/or visual depictions

of sexual conduct and/or sexual perfqrmance by a child or children, in violation of sections

827.071 and 847.0135(2), Florida Statutes, related to Possession of Child Pornography and

Promoting the Sexual Performoance by a Child, and that the premises contains evidence of, or

evidence related to proving, that said crime has been, or is being, committed.

Your Affiant, Detective Nicholas Paden, is a sworn law enforcement officer in the state

of Florida. He obtained a B.A. in History fi'om the University of Florida in 2006 and an M.A. in

National Security and International Intelligence ‘fiom the University of Kentucky in 201 1. Your

affiant completed the 790-hour St Petersburg College Law Enforcement Academy at the Allstate

Center in St Petersburg in July 2014 and that same month passed the State Exam for Law

Enforcement Officers.

Your affiant served as a patrol deputy with the Pinellas County Sherifi'sOffice fiom July

2014 until June 2017. In June 2017, yo'ur affiant was transferred to the Sexual Predator and
Offender Tracking (SPOT) Unit at the Pinellas County Sheriffs Office. As a SPOT Detective, he

has completed training courses in Interviews & Interrogations, Surveillance Operations, and

Florida Department of Law Enforcement's (FDLE) Sexual Offender Database online training, to

include Database training and Sexual Offender. Reg'stration training. Your Affiant attended the

2017 and 2018 Flon'da ICAC/CART/Offender Registration & Enforcement Symposium and

attended labs involving Dark Web Investigations, Open Source Investigations, Virtual Machines,

and Mobile Emulators.

In February 2019, your affiant was transferred to the Pincllas County Sheriff’s Office

Crimes Against Children Unit. Your Affiant is a taskforce member of the Central Florida

Internet Crimes against Childien (ICAC) Task Force. ICAC is a national organization which

provides specialized high-technology training and resources to law enforcement agencies that

investigate crimes dealing with ofiine'sexual-solicitation and sexual-exploitation of children,

including the collection and trading of images of obscene material.

Your Affiant has specialized training which pertains to physical and sexual child abuse

investigations, Your Affiant has also investigated or assisted in the investigations of crimes

against children such as: Sexual Battery, Obscene material, Lewd or Lascivious Battery and

Molestation, and Child Abuse. Your Affiant has previously assisted with search warrants based

upon investigations involving Computer Crimes, including warrants for computers, cellphones,

other dig'tal storage devices/media, and the data contained therein. Your Affiant has conducted
numerous interviews with child victims and offenders during child physical and sexual abuse

investigations.

As a Crimes Against Children Detective, your affiant has completed trainingclasses in

How Computers Work and Storg Data, Encryption, Introduction to Previewing, Basic Cyber

Investigations: Dark Web & Open Source Intelligence, Cyberstalking, Digital Forensic Analysis:
Previewing, and Basic Digital Forensic Analysis: Acquisition.

Based on all the above described training and experience, your Affiant has developed

probable cause to believe, and does believe, that the crimes described herein arc being

committed, or were committed, at or within the Premises. -

On 07/24/201 9, your Affiant was assimed an open investigation reference a Pinellas

County resident, ontacting law enforcement afier locating suspicious

videos on an iMac Pro desktop computer (MODEL A1481, Serial Number: F5KTQOGPF694)
' '

located . The computer in question was located in the office of

,
SAMUEL BOUTROS, whom she is in the process Samuel

.on
was arrested by the Pinellas County Sheriffs Office 07/21/2019 for -

battery on

He is currently incarcerated in the Pinellas County Jail awaiting trial.

advised your affiant that the double doors to th'e office are typically

locked, but ,she has had access to the room in the past for facilitafing the cleaning and decorating
‘

of the room. On this date, pressed one of the locked -office doors open with one
hand. The door swung. easily inward, as the locking mechanism in the past had been broken by

SAMUEL during a previous incident approximately two months ago when he had locked himself

out and broke the door to gain entry. Once inside the room, began séarching the room
'

with her aunt, While around the office computer desk,

moved the computer’s mouse, Which qug the screen and provided her logged-in access to the
~

computer and its files.

Video files were located on the hard drive of the iMac. Of the 81v videos visible to

in that folder, l7 videos contained surveillance footage of

I

'

who is not .o SAMUEL. The surveillance

footage captured in her room either completely naked or in various stages ofundress. is

seen getting dressed and dancing around her room. These files were stored in the same computer

folder that contained videos of SAMUEL mastulfbating.

'

The vide'b surv'eillan'c'e system .-

has cameras throughout ,
to include

all of the children’s bedrooms. 'The camcrés are in plain view and are equipped with speakers
'

that routinely use to communicate with their children fiom anywhere

The surveillance system does not have a dedicated storage unit, meaning the capdued video is

only available for approximately 2 hours before it is erased and written over. According to

. the only way that captured video could be saved to disk would be if the user

intentionally sought it out and saved it to disk. The only surveillance videos on the computer

were of naked in her room. SAMUEL participated in an intentional act intruding upon the

' '

tights 9f by saving nude videos of SAMUEL made nudity the focus ofhis attention,

creating a reason to believe he was acting with a lewd and lascivious intent.
 .
showed law enforcement another video on the desk top that orig'nated fiom the

office. In the video, SAMUEL can be seen wearing a white T-shirt and nothing else. He

is touchingand manipulating his exposed penis. In the background, can b; seen poking her

head into the room and immediately retreating. SAMUEL continues to manipulate his penis and
-
folldws out of the room and out of sight. He appears to be smiling and speahng to her and

touching hifiself as he does so.

Interviews with the four (4) minor children . yielded no disclosures of sexual

or physical abuse. did, howéver, disclose that approximately two months ago, there was, an

incident while was opt of town. Samuel was naked in the shower and

invited to look at him. When she refused, he insisted again and told her that she was mahng

him “sad.” When quesu'oned about the video wheré was seen poking her head ifitb the

office while SAMUEL was nude fi'om the waist down and touching herself, stated that she

did riot see him in th'e' r'oom, nor did she See his nudity. She did nOt recall the incident beyond
'

looking inside the room “very fast.”

.

Your Affiant knows, fiom training and experience, that digital evidence is not limited to

computers. Your Affiant has been involved in numerous cams where persons with an interest in

child exploitatiofi materials can access the Internet, display images of child pornography, and

communicate with other indifiduals with the same interests using dig'tal oommunicafions

devices, to include cellular teiephones, e-mail devices, tablet computers, and persofial- dig'tal .

assistants. These devices enable Internet and digtal cellular network access, and are fi'equently

found to contain chat communications in the form of short message service (SMS) meséagw.
 Your Affiant knows, fi'om training and experience, that searches and seizures of evidence

from computers and other Internet access devices require agents to seize most, or all, electronic

items (hardware, sofiware, passwords and instructions) to_ be processed later by a qualified

digital evidence expert in a controlled environment. Digital storage media may include, but is

not limited to, floppy disks, hard drives, tapes, DVD disks, CD-ROM disks or other magletic,

optical, or mechanical storage, which can be accessed by computers and/qr other electronic

devices, to store and/or retrieve data and/or images of child pornography, which can store the

equivalent of thousands of pages of information. Users may store information and/or images in

random order with deceptive file names, which requires searching authorities to examine all the

stored data to determine whether it is included in the warrant. This sorting process renders it

impractical to attempt this kind of data search while on-sitc.

Your» Affiant knows, fiom training and experience, that searching digital evidence

systems for criminal evidence requires experience in the computer and cellular telephone field

and a properly controlled environment in order to protect the integ‘ity of the evidence and

recover any "hidden,” compressed, password-protected, and/or encrypted files. Since digital

evidence
.is
extremely vulnerable to tampen'ng or destruction (both fiom external sources and/or

fi'om destructive code imbedded in the system as a "booby trap"), a controlled environment is

essential to its complete and accurate analysis.

Your Affiant knows, fi'om training and experience, that Computers and/or other digital

communications devices contain volatile memory that contains information only while the
device is in a powered on and/or running state. Your Affiant knows that powering off the device

may result in the loss of the volatile information. Your Affiant knows that adding an external

evidence storage device will cause minor changes to the state of the computer, but will allow for

the best effort in fully capturing the state of the running evidence. Your Affiant knows that this

capture of information requires technical expertise to ensure the resulting data can be examined

by all subsequent investigators. Your-Affiant knows that this captured information may include

current and/or recent use of the computer, use of encryption, use of other communications

devices, routes of Internet and other digtal communications traffic and passwords, encryption

keys or other dynamic details relevant to use of the system.

Your Affiant knows, fiom training and experience, that in order to fully reu-ieve data

fiom a computer or other digital communications system, the analyst needs all magnetic storage

media, as well as the storage devices. In addition, the anélyst needs all the system sofiware

(operating systems or interfaces, and hardware access software or drivers) and any applications

sofiware which may have been used to create the data (whether stored on hard drives or on

extemal media), as well as documentation, items containing or displaying passwords, access

codes, usernames or other identifiers necessary to examine or operate items, sofiware or

information seized to activate specific equipment or sofiware.

Your Affiant knows, fiom training and experience, that persons trading in, receiving,

distributing, and/or possessing images involving the exploitation of children, and/or those

interested in the actual exploitation of children, ofien communicate with others through
correspondence and/or other documents (whether digital or written), which could tend to identify

the origin of the images, as well as provide evidence of a person’s interest in child pomography

and/or child exploitation.

Your Affiant knows, fiom training and experience, that files related to the exploitation of

children found on computers and other digital communications devices are usually obtained fiom

the Internet, or fiom cellular data networks using application sofiware which ofien leaves files,

logs, or file remnants which would tend to show the method of location or creation of the

images, search terms used, exchange, transfer, distribution, possession or orig'n of the files.

Your Affiant knows, fiom training and experience, that digital sofiware and/or hardware

exists that allows persons to share digital access over wired and/or wireless networks, allowing

multiple persons to appear on the Internet fi'om the same E address. The most common type of

equipment that allows for this type of access is a router. Examination of these items can reveal

information about the authorized and/or unauthorized use of Internet connection at the residence.

In the case of unauthorized access of a wireless network, the router is the instrumentality of the

crime. The router can be interro gated, and data may be retrieved that can lead to the discovery of

the computer responsible for the unauthorized access, and subsequent criminal activity.

Your Affiant knows, fiom training and experience, that computers and/or other digital

devices used to access the Internet usually contain files, logs, or file remnants which would tend
to show ownership and/or use of the device, as well as ownership and/or use of Internet service

accounts used for the Internet and/or cellular data network access.

Your Affiant knqws fiom training and experience, that digtal crime scenes usually

include items or digital information that would tend to establish ownership and/or use of digital

devices, and Internet access equipment and ownership or use of any Internet service, or digital

cellular service accounts to participate in the exchange, receipt, possession, collection and/or

distribution of child pomogaphy,

Your Affiant knows, fiom training and experience, that persons with an interest in the

exploitation of children fi'equently have trophies fi'om victims, items for the grooming of

children, as well as collections of clothing and/or toys related to the exploitation of children.

Your Affiant knows, fi'om training and experience, that search warrants of residences

involved in computer and/or dig‘tally related criminal activity usually produce items that tend to

establish ownership and/or use of dig'tal devices and ownership and/or use of any Internet

service accounts accessed to obtain child pornography to include credit card bills, telephone

bills, correspondence, and/or other identification documents.

Your Affiant knows, fi'om training and experience, that search warrants of residences

usually reveal items that tend to show dominion and/or control of the property searched, to

10‘
include utility bills, telephone bills, correspondence, rental agreements, and/or other

identification documents.

Based upon your Affiant’s knowledge, experience, and training in child exploitation and

child pornography investigations, there are certain characteristics common to many individuals

involved in the receipt and/or collection of child pornography. Collectors of child pomogaphy

ofien possess and maintain “hard copies“ of child pornogaphic material including, but not

limited to, pictures, films, video tapes, magazines, negatives, photographs, correspondence,

mailing lists, books, tape recordings, etc., in the privacy and security of their hoxfie and/or some

other secure location.

Child pomogaphy collectors typically retain pictures, films, .photogaphs, negatives,

magazines, correspondence, books, tape recordings, mailing lists, child erotica, and/or video

tapes for many years. With the advent of technology, collectors of digital child pornogaphy

oflqn maintain their digital and/or electronic collections in a fprmat that is safe, secure and

private, such as a computer and/or back-up storage discs, or other forms of data storage devices.

These collections are rarely, if ever, destroyed, and are kept close by, usually at the collector's

residence, to enable the collector to view the collection, which to them is highly valued.

Child pornography collectors may also correspond with, and/or meet others to share

information and/or materials. They rarely destroy correspondence fiom other child pornography

disu'ibutors/collectors, ofientimcs conceal such correspondence as they do their sexually explicit

11
material, and may maintain lists of names, addresses, and/or telephone numbers of individuals

with whom they have been in contact with, and who share the same interests in child

pornography.

Collectors of child pohografihy prefer not to be without their child pornography for any

prolonged time period. This behavior has been documented by law enforcement officers'

involved in the investigation of child pornography throughout the world.

Based on your Affiant’s review of the available evidence, namely SAMUEL BOUTROS
.

using his office computer to store surveillance videos capturing naked, coupled with the

saved office video of SAMUEL manipulating his exposed penis in the vicinity of ,
as

well as statement referencing SAMUEL’s behavior in the shower, your Affiant has reason

t0 believe that there may be evidence of possible lewd or lascivious acts involving or that

the computer user is collecting child pomog‘aphy and is saving the cbllection like a “Child

Pomogaphy Collector.”

The above information has led your Affiant to believe that probable cause exists to search _

for the items listed below. There is evidence of exploitation of children by means of the

possession and/or receipt and/or distribution of child pornogaphy, in violation of Flon'da Statute

827.071, and this evidence is concealed in the residence at

to wit: “the Premises.”

12
 Your Affiant hereby requests the Court’s permission to seize the following items, and to

conduct on and off-site search and analysis, and/or to request the assistance with the search and

analysis from an off-site computer forensic analyst, of the following items (hereinafier the

“Property”), which are evidence of, or evidence relevant to proving, the felony crimes stated

herein:

l. Computer hardware, to include any and all computer equipment used to collect,
analyze, create, display, convert, store, conceal, and/or transmit electronic, magletic,
optical, and/or similar computer impulses and/or data. Hardware includes, but is not
limited to, any data-processing devices, such as central processing units, cellular devices,
”
personal computers, to include "laptop" or "notebook" or “tablet” or “pocke computers;
internaland peripheral storage devices, such as fixed disks, external hard disks, floppy
disk drives and diskettes, tape. drives and tapes, optical storage devices, and other
electronic media devices.

2. Computer input and output devices to include, but not limited to, keyboards, mice,
scanners, printers, monitors, network communication devices, modems, and external or
connected devices used for accessing computer storage media.

3. Computer storage media and the digital content, to include, but not limited to, floppy
disks, hard drives,VHS tapes, tapes, USB flash drives, MP3/iPod players, SD cards,
DVD disks, CD—ROM disks or other magnetic, optical, or mechanical storage which can
be accessed by computers to store and/or retrieve data and/or images of child
pornography.

4. Computer sofiware and application sofiware installation and operation media.

5. Computer sofiware, hardware and/or of Internet

digital contents related to the sharing
access over wired or wireless networks, allowing multiple persons to appear on the
Internet fi'om the same IP address.

6. Manuals and/or other documents, whether digital or written, which describe operation
of items and/or software seized.

7. Items containing and/or displaying passwords, access codes, usemames and/or other
identifiers necessary to examine and/or operate items, sofiware and/or information seized.

8. Correspondenbe and/or other documents, whether digital or written, pertaining to the

possession, receipt origin and/or distribution of images involving the sexual exploitation
of children.

13
 9. Correspondence or other documents, whether digital or written, exhibiting an interest
in the sexual exploitation of children.

10. Items that would tend to establish ownership and/or use of computers and ownership
and/or use of any Internet service accounts accessed to obtain child pornography to
include credit card bills, telephone bills, correspondence and/or other identification
documents.

11. Items that would tend to show dominion and/or control of the property searched, to
include utility bills, telephone bills, correspondence, rental agreements and/or other
identification documents.

12. Data maintained on the computer, and/or computer related storage devices such as
floppy diskettes, tape backups, computer printouts, and “zip” drive diskettes; in
panicular, data in the fonn of images and/or videos and any accompanying text
associated with those images, and/or log files recording the transmission of images as

'
they relate to violations of Florida law, cited herein, related to po'ssession and/or
distribution of child pomog‘aphy. Users may store information and/or images in random
order with deceptive file names, which requires searching authon'ties to examine all the
stored data to determine whether included in the wan'ant. This sorting process makes
it is

it impractical to attempt this kind of data search on-site.

13. Files and/or data on the computer that show the _suspect’s ownership, possession
and/or control at time of the offense.

14. Any and all sofiware that may be utilized to create, receive, distribute, store, and/or
modify the evidence sought, and all sofiware that may be used to communicate and/or
store online communications.

15. Encrypted, deleted and/or unallocated files on electronic media that contain any of the
information listed in previous paragaphs.

16. Notations, files and/or documentation containing passwords and/or codes necessary to
unlock computer files and/or to access the computer or storage media.

Your Affiant is aware that the recovery of data by a computer forensic analyst takes

significant time. Similar to the way in which the recovery of narcotics must be forensically

evaluated in a lab, digtal evidence must also undergo an analysis process. For this reason, the

“return” inVCntory will contain a list of only the tangible items recovered fi'om the Premises.

14
Unless otherwise ordered by the Court, the return will not include evidence later examined by a

forensic analyst.

WHEREFORE, your Affiant prays that a Search Warrant be issued according to the laws

commanding all and singular the Sheriff and/or Deputy Sheriffs of Pinellas Comfy, Special Agents

of the Florida Department of Law Enforcement, and Special Agents of the United States

Department of Homeland Security, United States Secret Service Electronic Crimes Taskforce, or

any of their duly constituted officers and either in the daytime or the nighttime, and on any day of

the week including Sunday, with the proper and necessary assistance, including forensic computer

analyst experts to search the herein described premises and curtilage thereof, and any persons

thereon, reasonably suspected of being involved in the illegal activity which is the subject of this

warrant, and seize as evidence the above—described items in order that the evidence may be procured

to be used in the prosecution of such person or persons found to be involved in the illegal activity as

alleged.

M4 WJL
Detective Nicholas Paden,
#S‘m?
AFFIANT

Sworn to and subscribed before me

this AHA“ day of July, 2019.

CIR UIT JUDGEZ

PINELLAS CO ,
FLORIDA

15