Kiesel

Case 2:21-mj-00118-JHR Document 1 Filed 05/06/21 Page 1 of 1 PageID #: 5
Case 2:21-mj-00118-JHR Document 1-1 Filed 05/06/21 Page 1 of 27 PageID #: 6
IN THE UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF MAINE
IN THE MATTER OF THE SEARCH

OF 295 HILL ST BIDDEFORD, MAINE
Case No.
04005, ELECTRONIC DEVICES
LOCATED THEREIN, AND THE
CONTENTS OF GOOGLE ACCOUNT
NO. 690168850062
AFFIDAVIT IN SUPPORT OF AN APPLICATION

FOR A WARRANT TO SEARCH AND SEIZE
I, Ronald Phillips, being duly sworn, depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND
1.
am a Task Force Officer with the United States Marshals specifically designated to
the United States Marshals Violent Offender Task Force in the District of Maine, and
have been since December 2015. I have been a member of the Biddeford, Maine Police
Department since July 2014, and I have worked in law enforcement since September
2010. I am a graduate of the North Carolina Basic Law Enforcement Training
Program. In addition, I have passed the Maine Law Enforcement Full Time Exam
and have received my lateral transfer waiver from the Maine Justice Academy Board
the University of North Carolina Wilmington. I have received specialized training in
human trafficking investigations, computer and cell phone analysis for police
1
investigations, search warrant writing, drug interdiction and federal asset forfeiture,
surveillance and counter surveillance methods, and the enforcement of federal laws
under Titles 18 and 21 of the United States Code. The facts in this affidavit come
from my personal observations, my training and experience, and information
obtained from other agents and witnesses.
2. This Affidavit is submitted in support of an application under Rule 41 of
the Federal Rules of Criminal Procedure for warrants to search (1) the premises
known as 295 Hill Street, Biddeford
electronic devices located therein, and (2)
contents of Google Account No.
currently in the custody of HSI. The SUBJECT PREMISES and the SUBJECT
ACCOUNT are more particularly described in Attachments A1 and A2 respectively.
The items to be seized are described in Attachments B1 and B2.
3. For each warrant, this application seeks authority to search for and
seize evidence, fruits, and instrumentalities of violations of: Title 18, United States
Code, Sections 1470 (transfer of obscene material to a minor), 2251 (sexual
exploitation of children), 2252 (sexual exploitation of minors), and 2252A (child
pornography offenses).
4. The statements in this Affidavit are based on information provided by
federal, state, and local law enforcement; written reports; information gathered from
the service of subpoenas; the results of physical and electronic surveillance;
2
independent investigation and analysis performed both by me and by other law
enforcement officers, analysts, and computer forensic professionals; and my training
and experience.
PROBABLE CAUSE
5. I know from my participation in this investigation that on March 15,
which originated from a foreign law enforcement agency, indicating that between at
on with an undercover agent posing as
a 12 year old girl. These communications were sexual in nature. The foreign law
enforcement agency suspected that Jesse Kiesel, DOB 01/14/1973, 295 Hill St
Biddeford, Maine 04005, was the user of the Immilling Fastpaw account.
6. The Lead further advised that communications began on a social media
chat platform called Chat Ave administered in Shanghai China. On Chat Ave, Kiesel
cating via Chat Ave Kiesel advised he
was a 48-year-old man and described himself
itched to SnapChat, Kiesel confirmed
advised he worked as a special education teacher at a Middle School in the United
States.
3
7. I have reviewed records provided by SnapChat, which indicate that the
Immilling Fastpaw account was created on June 8, 2018, 10:31:23 UTC. Those
records further indicate that the email address associated with the account is
IP was listed as 108.183.170.123, and the
phone number associated with the account was listed as 717-793-1384. The display
SnapChat provided IP history which in
108.183.170.123 both dated Februarys 25, 2021.
8. I have reviewed records provided by Google relating to Google Account
No. 690168850062, which show that the name associated with the account is listed
as Immilling Fastpaw. The email address associated with that account is listed as
on September 28, 2010. The recovery
telephone number is 717-793-1384. Google provided IP history which included
approximately five pages of time stamped login/logouts. The most frequently used IP
address 108.183.170.123. For the date range provided in the records, this IP address
was used frequently between July 19, 2020 thru March 25, 2021.
9. I am informed by officers of the Biddeford Police Department that Jesse
Kiesel is a current employee at the Biddeford Middle School, 25 Tiger Way Biddeford,
Maine 04005. An open source search of Jesse Kiesel produced a LinkedIn account
with the name Jesse Kiesel and the job title Ed Tech II - Biddeford Middle School.
4
10. On about May 4, 2021, I learned that the Newburyport Police
Department in Massachusetts had conducted an undercover investigation into online
solicitation and enticement of children and had communicated directly with Kiesel. I
am informed by Newburyport police officers that the communications occurred
between April 16 and April 21, 2021. During the communication, which actually
occurred between Kiesel and an undercover officer posing as a 13-year-old girl, Kiesel
sent, among other things, a video depicting his genitals.
11. On May 4, 2021, I met with Detective Sgt. Aaron Wojtkowski at the
Newburyport Police Department, who informed me that he is an affiliate member of
the Massachusetts Internet Crimes Against Children Taskforce (ICAC) as well as a
part-time Task Force Officer (TFO) with the Federal Bureau of Investigations Child
Exploitation and Human Trafficking Task Force. During that meeting, I reviewed
and discussed an incident report prepared by Det. Sgt. Wotjkowski. As a result of
that meeting and my review, I learned the following, among other things:
a. On about April 16, 2021, Det. Sgt. Worjkowski began
communicating on a social media chat platform Chat Avenue posing as a 13-year-old
later identify as Jesse Kiesel. Communication eventually transitioned from Chat
Avenue to Google Hangouts. The conversation between the target user and the UC
Account was sexual in nature.
5
b. While communicating on Chat Avenue, the target user asked the
years old, and asked if he cared. The target user responded the he liked the age of
the UC Account. The target user indicated that the user of the UC Account was
er wrote that he was from Maine and that he was 48 years
old. During the course of the communications, the target user began asking questions
pertaining to the sexual history of the user of the UC Account, and asked whether
the user of the UC Account wished to engage in sexual contact.
c. Once the communication transitioned to Google Hangouts, the
target user, using the Google email addres
that turned off the conversation history, which would result in the deletion of certain
messages. The target user suggested he did so in order to hide these messages from
his wife.
d. During the communications, the target user sent photographs to
the UC Account that he indicated were pictures of himself,1 and requested images of
the UC Account persona.
e. On about April 23, 2021, the target user sent instructions on how
the UC Account persona should masturbate, informed the UC Account that he was
1 I have compared the pictures sent by the target user to the UC Account to the
photograph on file with Maine BMV for Jesse Kiesel, and I have concluded that that
these photographs depict the same individual.
6
touching himself, and offered to show the UC Account persona what he was doing.
He then sent one digital image and one video (18 seconds long) depicting his erect
penis to the UC Account.
f. On about April 29, 2021, Det. Sgt. Worjkowski executed a search
warrant on Google for the SUBJECT A
email: [email protected]. It was at that point that Det. Sgt. Wojtkowski
contacted the Biddeford Police Department because he learned from the return the
recovery email address associated with the SUBJECT ACCOUNT was
[email protected], which Det. Sgt. Wotjkowski knew to be associated with
the Biddeford public schools.
12. I have reviewed public records indica
295 Hill Street, Biddeford, Maine, 04005, including public records maintained by the
City of Biddeford assessor.2 I have also reviewed records maintained by the Maine
Bureau of Motor Vehicles showing that Jesse Kiesel, date of birth January 14, 1973,
listing his residence as the SUBJECT
PREMISES. BMV records further reflect that Kiesel owns a 2012 grey Honda Civic
bearing Maine registration number 5564WQ, registered to the SUBJECT
PREMISES.3
2 that Leslie Kiesel, believed to be the

wife of Jesse Kiesel, is the co-owner of the SUBJECT PREMISES.
3 BMV records further show that Leslie Kiesel is the co-owner of the 2012 Honda
Civic.
7
13. On about May 4, 2021, officers from the Biddeford Police Department
conducted surveillance at the SUBJECT PREMISES. At that time, officers observed
Kiesel arriving at the residence and entering the home.
CHILD PORNOGRAPHY, COMPUTERS, AND THE INTERNET
14. Based on my training and experience, I know the following:
a. Computers and digital technology are the primary way in which
individuals interested in child pornography interact with each other. Computers
basically serve four functions in connection with child pornography: production,
communication, distribution, and storage.
b. Digital cameras and smartphones with cameras save
photographs or videos as a digital file that can be directly transferred to a computer
by connecting the camera or smartphone to the computer, using a cable or via wireless
camera or smartphone may be stored on a removable memory card in the camera or
smartphone. These memory cards are often large enough to store thousands of high-
resolution photographs or videos.
c. A device known as a modem allows any computer to connect to
another computer through the use of telephone, cable, or wireless connection. Mobile
devices such as smartphones and tablet computers may also connect to other
computers via wireless connections. Electronic contact can be made to literally
millions of computers around the world. Child pornography can therefore be easily,
8
inexpensively and anonymously (through electronic communications) produced,
distributed, and received by anyone with access to a computer or smartphone.
d.
computer itself an ideal repository for child pornography. Electronic storage media
of various types-to include computer hard drives, external hard drives, CDs, DVDs,
h are very small devices that are plugged
into a port on the computer, can store thousands of images or videos at very high
resolution. It is extremely easy for an individual to take a photo or a video with a
digital camera or camera-bearing smartphone, upload that photo or video to a
computer, and then copy it (or any other files on the computer) to any one of those
media storage devices. Some media storage devices can easily be concealed and
hones and/or mobile phones are also often
e. The Internet affords individuals several different venues for
obtaining, viewing, and trading child pornography in a relatively secure and
anonymous fashion.
f. Individuals also use online resources to retrieve and store child
pornography. Some online services allow a user to set up an account with a remote
computing service that may provide email services and/or electronic storage of
computer files in any variety of formats. A user can set up an online storage account
from any computer or smartphone with
9
access to the Internet. Even in cases where online storage is used, however, evidence
of child pornography can be found on the
media in most cases.
g. A growing phenomenon related to smartphones and other mobile
computing devices is the use of mobile applic
consist of software downloaded onto mobile devices that enable users to perform a
chat, sharing digital files, reading a book,
receive, store, distribute, and advertise child pornography, to interact directly with
other like-minded offenders or with potential minor victims, and to access cloud-
storage services where child pornography may be stored.
h. As is the case with most digital technology, communications by
way of computer can be saved or stored on the computer used for these purposes.
Storing this information can be intentional (i.e., by saving an email as a file on the
l information, such as the traces of the
path of an electronic communication, may also be automatically stored in many places
(e.g., temporary files or ISP client software, among others). In addition to electronic
activities generally leave traces or
s of the browser used. Such information
is often maintained indefinitely until overwritten by other data.
10
ONLINE CHILD ENTICEMENT
15. Based on my training and experience with child enticement
investigations, and the training and experience of other law enforcement officers with
whom I have had discussions, I know there are certain characteristics common to
individuals who access child sexual abuse and child exploitation material via the
Internet or by developing inappropriate relationships with children online.
a. Such individuals may receive sexual gratification, stimulation,
and satisfaction from contact with children, or from fantasies they may have viewing
children engaged in sexual activity or in sexually suggestive poses, such as in person,
in photographs, or other visual media, or from literature describing such activity.
b. Such individuals may collect sexually explicit or suggestive
materials in a variety of media, including photographs, magazines, motion pictures,
videotapes, books, slides and/or drawings or other visual media. Individuals who
have a sexual interest in children or images of children oftentimes use these
materials for their own sexual arousal and gratification. Further, they may use these
materials to lower the inhibitions of children they are attempting to seduce, to arouse
the selected child partner, or to demonstrate the desired sexual acts.
c. Such individuals almost always possess and maintain child
pornographic material in the privacy and security of their home or some other secure
location. Individuals who have a sexual interest in children or images of children
typically retain those materials and child erotica for many years.
11
d. Likewise, such individuals often maintain their child
pornography images in a digital or electronic format in a safe, secure and private
environment, such as a computer and surrounding area. These child pornography
images are often maintained for several years and are kept close by, usually at the
4 or, at times, on their person, or
in cloud-based online storage, to enable the individual to view the child pornography
images, which are valued highly. Some of these individuals also have been found to
download, view, and then delete child pornography on their computers or digital
devices on a cyclical and repetitive basis.
e. Importantly, evidence of such activity, including deleted child
pornography, often can be located on these
through the use of forensic tools. Indeed, the very nature of electronic storage means
that evidence of the crime is often still discoverable for extended periods of time even
f. Such individuals also may correspond with and/or meet others to
share information and materials, rarely destroy correspondence from other child
pornography distributors/possessors, conceal such correspondence as they do their
sexually explicit material, and often maintain contact information (e.g. online
4 Based on my training and experience, I know that possessors of child

pornography often keep their pornography on their smart cellular phones, and that
people tend to keep their cellular phones on their person or otherwise in proximity to
them, including in their vehicle.
12
messaging accounts, email addresses, etc.) of individuals with whom they have been
in contact and who share the same interests in child pornography.
g. Such individuals prefer not to be without their child pornography
for any prolonged period. This behavior has been documented by law enforcement
officers involved in child pornography investigations across the world.
h. Even if such individuals use a portable device (such as a mobile
phone) to access the Internet and child pornography, it is more likely than not that
evidence of this access will be
16. Based on all of the information set forth herein, I believe that Kiesel
shares certain characteristics common to individuals with an interest in child
pornography as well as individuals who access child sexual abuse and child
exploitation material via the Internet. I further believe that Kiesel, who displayed
persistent and focused sexual interest in children, will continue to seek out pedophilic
stimuli for sexual arousal either by seeking opportunities for sexual engagement with
children or through visually arousing stimuli such as those depicted in child
exploitation material.
COMPUTERS, ELECTRONIC STORAGE, AND FORENSIC ANALYSIS
17. As described above, this application seeks permission to search for
records that might be found on the SUBJECT PREMISES, in whatever form they are
found. One form in which the records might
hard drive or other storage media. Thus, we seek authority to search and seize
13
electronic storage media and electronically stored information found on the
SUBJECT PREMISES under Rule 41(e)(2)(B).
18. I submit that if a computer or storage medium is found on the SUBJECT
PREMISES, there is probable cause to believe those records referenced above will be
stored on that computer or storage medium, for at least the following reasons:
a. Deleted files, or remnants of deleted files, may reside in free space or
medium that is not currently being used
before they are overwritten. In addition, a
b. Based on my training and experience, I know that computer files or
remnants of such files can be recovered months or even years after they have been
downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic
files downloaded to a storage medium can be stored for years at little or no cost. Even
when files have been deleted, they can be recovered months or years later using
forensic tools. This is so
data contained in the file does not actually disappear; rather, that data remains on
the storage medium until it is overwritten by new data.
c. Wholly apart from user-generated
computer has been used, what it has been used for, and who has used it. To give a
14
few examples, this forensic evidence can take the form of operating system
configurations, artifacts from operating system or application operation, file system
do not erase or delete this evidence, because special software is typically required for
that task. However, it is technically possible to delete this information.
d. Similarly, files that have been viewed via the Internet are sometimes
automatically downloaded into a tempora
19. As further described in Attachment B1, this application seeks
permission to locate not only computer files that might serve as direct evidence of the
crimes described on the warrant, but also for forensic electronic evidence that
establishes how computers were used, the purpose of their use, who used them, and
when. There is probable cause to believe that this forensic electronic evidence will be
on any storage medium at the SUBJECT PREMISES because:
a. Data on the storage medium can provide evidence of a file that
was once on the storage medium but has since been deleted or edited, or of a deleted
portion of a file (such as a paragraph that has been deleted from a word processing
file). Virtual memory paging systems can leave traces of information on the storage
medium that show what tasks and processes were recently active. Web browsers,
email programs, and chat programs store configuration information on the storage
medium that can reveal information such as online nicknames and passwords.
Operating systems can record additional information, such as the attachment of
15
peripherals, the attachment of USB flash storage devices or other external storage
media, and the times the computer was in use. Computer file systems can record
information about the dates files were created and the sequence in which they were
created, although this information can later be falsified.
b. Information stored within a computer and other electronic
storage media may provide crucial evidence
under investigation, thus enabling the United States to
establish and prove each element or alternatively, to exclude the innocent from
further suspicion. In my training and experience, information stored within a
computer or storage media (e.g., registry information, communications, images and
movies, transactional information, records of session times and durations, Internet
history, and anti-virus, spyware, and malware detection programs) can indicate who
has used or controlled the computer or storage media.
warrant at a residence. The existence or absence of anti-virus, spyware, and malware
detection programs may indicate whether the computer was remotely accessed, thus
inculpating or exculpating the computer owner. Further, computer and storage
media activity can indicate how and when the computer or storage media was
accessed or used. For example, computers typically contain information that logs
computer user account session times and durations, computer activity associated
with user accounts, electronic storage media that connected with the computer, and
16
the IP addresses through which the computer accessed networks and the Internet.
Such information allows investigators to understand the chronological context of
computer or electronic storage media access, use, and events relating to the crime
under investigation. Additionally, some information stored within a computer or
electronic storage media may provide crucial evidence relating to the physical
location of other evidence and the suspect. For example, images stored on a computer
may both show a particular location and have geolocation information incorporated
into its file data. Such file data typically also contains information indicating when
the file or image was created. The existence of such image files, along with external
device connection logs, may also indicate the presence of additional electronic storage
media (e.g., a digital camera or cellular phone with an incorporated camera). The
geographic and timeline information described herein may either inculpate or
exculpate the computer user. Last, information stored within a computer may
offense under investigation. For example, information within the computer may
e.g., Internet searches
indicating criminal planning), or consciousness of guilt (e.g.
program to destroy evidence on the computer or password protecting/encrypting such
evidence in an effort to conceal it from law enforcement).
17
c. A person with appropriate familiarity with how a computer works
can, after examining this forensic evidence in its proper context, draw conclusions
about how computers were used, the purpose of their use, who used them, and when.
d. The process of identifying the exact files, blocks, registry entries,
logs, or other forms of forensic evidence on a storage medium that are necessary to
draw an accurate conclusion is a dynamic process. While it is possible to specify in
advance the records to be sought, computer evidence is not always data that can be
merely reviewed by a review team and passed along to investigators. Whether data
stored on a computer is evidence may depend on other information stored on the
computer and the application of knowledge about how a computer behaves.
Therefore, contextual information necessary to understand other evidence also falls
within the scope of the warrant.
e. Further, in finding evidence of how a computer was used, the
purpose of its use, who used it, and when, sometimes it is necessary to establish that
a particular thing is not present on a storage medium. For example, the presence or
absence of counter-forensic programs or anti-virus programs (and associated data)
f. I know that when an individual uses a computer to obtain or
computer will generally serve both as an
instrumentality for committing the crime, and also as a storage medium for evidence
of the crime. The computer is an instrumentality of the crime because it is used as a
18
means of committing the criminal offense. The computer is also likely to be a storage
medium for evidence of crime. From my training and experience, I believe that a
computer used to commit a crime of this type may contain: data that is evidence of
how the computer was used; data that was sent or received; notes as to how the
criminal conduct was achieved; records of Internet discussions about the crime; and
other records that indicate the nature of the offense.
20. Based upon my training and experience and information relayed to me
by agents and others involved in the forensic examination of computers, I know that
computer data can be stored on a variety of systems and storage devices, including
external and internal hard drives, flash drives, thumb drives, micro SD cards, macro
SD cards, DVDs, gaming systems, SIM cards, cellular phones capable of storage,
floppy disks, compact disks, magnetic tapes, memory cards, memory chips, and online
or offsite storage servers maintained by corporations, including but not limited to,
e search of the premises it is not always
possible to search computer equipment and storage devices for data for a number of
reasons, including the following:
a. Searching computer systems is a highly technical process that
requires specific expertise and specialized equipment. There are so many types of
computer hardware and software in use today that it is impossible to bring all of the
technical manuals and specialized equipment necessary to conduct a thorough
search. In addition, it may also be necessary to consult with computer personnel who
19
have specific expertise in the type of computer, software, or operating system that is
being searched;
b. Searching computer systems requires the use of precise, scientific
procedures which are designed to maintain the integrity of the evidence and to
recover hidden, erased, compressed, encrypted, or password-protected data.
Computer hardware and storage devices may
alter data if certain procedures are not scrupulously followed. Since computer data
is particularly vulnerable to inadvertent or intentional modification or destruction, a
controlled environment, such as a law enforcement laboratory, is essential to
conducting a complete and accurate analysis of the equipment and storage devices
from which the data will be extracted;
c. The volume of data stored on many computer systems and storage
devices will typically be so large that it will be highly impractical to search for data
during the execution of the physical search of the premises; and
d. Computer users can attempt to conceal data within computer
equipment and storage devices through a number of methods, including the use of
innocuous or misleading filenames and extensions. For example, files with the
r, a user can easily change the extension
pear that the file contains text. Computer
users can also attempt to conceal data by using encryption, which means that a
20
into readable form. In addition, computer users can conceal data within another
seemingly unrelated and innocuous file in
example, by using steganography a computer user can conceal text in an image file
which cannot be viewed when the image file is opened. Therefore, a substantial
amount of time is necessary to extract and sort through data that is concealed or
encrypted to determine whether it is contraband, evidence, fruits, or
instrumentalities of a crime.
21. Additionally, based upon my training and experience and information
relayed to me by agents and others involved in the forensic examination of computers,
I know that routers, modems, and network equipment used to connect computers to
the Internet often provide valuable evidence of, and are instrumentalities of, a crime.
This is equally true of wireless routers, which create localized networks that allow
individuals to connect to the Internet wirelessly. Though wireless networks may be
secured (in that they require an individual to enter an alphanumeric key or password
before gaining access to the network) or unsecured (in that an individual may access
the wireless network without a key or password), wireless routers for both secured
and unsecured wireless networks may yield significant evidence of, or serve as
r example, serving as the instrument
through which the perpetrator of a cybercrime connected to the Internet and,
potentially, containing logging information regarding the time and date of a
identifying information for the specific
21
device(s) the perpetrator used to access the network. Moreover, I know that
individuals who have set up either a secured or unsecured wireless network in their
residence are often among the primary users of that wireless network.
22. Based on the foregoing, and consistent with Rule 41(e)(2)(B), I seek a
warrant authorizing the search of the SUBJECT PREMISES that would also permit
seizing, imaging, or otherwise copying storage media that reasonably appear to
contain some or all of the evidence described in the warrant, and would authorize a
later review of the media or information consistent with the warrant. The later
review may require techniques, including but not limited to computer-assisted scans
of the entire medium, that might expose many parts of a hard drive to human
inspection in order to determine whether it is evidence described by the warrant.
BACKGROUND CONCERNING GOOGLE
23. Google is a United States company that offers to the public through its
Google Accounts a variety of online services, including email, cloud storage, digital
payments, and productivity applications, which can be accessed through a web
browser or mobile applications. Google also offers to anyone, whether or not they have
a Google Account, a free web browser called Google Chrome, a free search engine
called Google Search, a free video streaming site called YouTube, a free mapping
service called Google Maps, and a free traffic tracking service called Waze. Many of
these free services offer additional functionality if the user signs into their Google
Account.
22
24. Signing up for a Google Account automatically generates an email
address at the domain gmail.com. That email address will be the log-in username for
access to the Google Account.
25. ne Account. All of Google working for
services offered to the general public, described in further detail below. In addition,
Google keeps certain records indicating ownership and usage of the Google Account
across services, described further after the description of services below.
26. When individuals register with Google for a Google Account, Google asks
users to provide certain personal identifyin
name, telephone number, birthday, and gender. If a user is paying for services, the
user must also provide a physical address and means and source of payment.
27. Google integrates its various services to make it easier for Google
Accounts to access the full Google suite of services. For example, users accessing their
Google Account through their browser can toggle between Google Services via a
toolbar displayed on the top of most Google service pages, including Gmail and Drive.
Google Hangout, Meet, and Chat conversations pop up within the same browser
window as Gmail. Attachments in Gmail are displayed with a button that allows the
user to save the attachment directly to Google Drive. If someone shares a document
with a Google Account user in Google Docs, the contact information for that individual
ts. Google Voice voicemail transcripts and
23
missed call notifications can be sent to a user
their Google Account on the Chrome browser, their subsequent Chrome browser and
Google Search activity is associated with that Google Account, depending on user
settings.
28. When individuals register with Google for a Google Account, Google asks
users to provide certain personal identifyin
name, telephone number, birthday, and gender. If a user is paying for services, the
user must also provide a physical address and means and source of payment.
29. Google typically retains and can provide certain transactional
information about the creation and use of each account on its system. Google captures
the date on which the account was created, the length of service, log-in times and
durations, the types of services utilized by the Google Account, the status of the
account (including whether the account is inactive or closed), the methods used to
connect to the account (such as logging into
a mobile application), details about the devices used to access the account, and other
log files that reflect usage of the account. In addition, Google keeps records of the
terms of service, as well as the IP addresses associated with particular logins to the
account. Because every device that connects to the Internet must use an IP address,
IP address information can help to identify which computers or other devices were
used to access the Google Account.
24
30. Google maintains the communications, files, and associated records for
each service used by a Google Account on servers under its control. Even after a user
deletes a communication or file from their Google Account, it may continue to be
for a certain period of time.
31. In my training and experience, evidence of who was using a Google
account and from where, and evidence related to criminal activity of the kind
described above, may be found in the files and records described above. This evidence
under investigation, thus enabling the United States to establish and prove each
element or, alternatively, to exclude the innocent from further suspicion. For
example, in the instant case, Kiesel is believed to have used the chat function in
Google Hangouts to communicate with the UC Account and to send images and
sexually explicit videos of himself to the UC Account using these functions.
32. tivity, logs, stored electronic
communications, and other data retained by Google can indicate who has used or
g a search warrant at a residence. For
example, subscriber information, email and messaging logs, documents, and photos
and videos (and the data associated with the foregoing, such as geo-location, date and
time) may be evidence of who used or controlled the account at a relevant time. As
an example, because every device has unique hardware and software identifiers, and
25
because every device that connects to the Internet must use an IP address, IP address
and device identifier information can help to identify which computers or other
devices were used to access the account. Such information also allows investigators
to understand the geographic and chronological context of access, use, and events
relating to the crime under investigation.
33. Account activity may also provide relevant insight into the account
offenses under investigation. For example,
crime (e.g., information indicating a plan to commit a crime), or consciousness of guilt
(e.g., deleting account information in an effort to conceal evidence from law
enforcement).
34. ely to contain stored electronic
communications and information concerning subscribers and their use of Google
services. In my training and experience, such information may constitute evidence
of the crimes under investigation including information that can be used to identify
26
ATTACHMENT A1
Property to be Searched
The property to be searched is 295 Hill Street, Biddeford, Maine, 04005 (the
ic devices found thereon. The SUBJECT
PREMISES is further described as a two-story single-family home with an attached
two car garage. The residence appears to have white colored vinyl siding with blue
een observed at the SUBJECT PREMISES.
A photograph of the SUBJECT PREMISES appears below:
28
Civic appears below:
29
ATTACHMENT B1
Items to be Seized
The following materials, which constitute evidence of the commission of a
criminal offense, contraband, the fruits of crime, or property designed or intended for
use or which is or has been used as the means of committing criminal offenses, namely
violations of 18 U.S.C. §§ 1470, 2251, 2252, or 2252A:
1. Computers, including cellular phones, or storage media used as a means to
commit the above-listed violation.
2. For any computer or storage medium whose seizure is otherwise authorized by
this warrant, and any computer or storage medium that contains or in which
are stored records or information that is otherwise called for by this warrant
a. evidence of who used, owned, or controlled the COMPUTER at the time
the things described in this warrant were created, edited, or deleted,
such as logs, registry entries, configuration files, saved user names and
passwords, documents, browsing history, user profiles, email, email
correspondence;
b. evidence of software that would allow others to control the COMPUTER,
such as viruses, Trojan horses, and other forms of malicious software, as
30
well as evidence of the presence or absence of security software designed
to detect malicious software;
c. evidence of the lack of such malicious software;
d. evidence indicating how and when the computer was accessed or used to
determine the chronological context of computer access, use, and events
relating to the crimes under investigation and to the computer user;
e. evidence indicating the computer user
relates to the crimes under investigation;
f. evidence of the attachment to the COMPUTER of other storage devices
or similar containers for electronic evidence;
g. evidence of programs (and associated data) that are designed to
eliminate data from the COMPUTER;
h. evidence of the times the COMPUTER was used;
i. passwords, encryption keys, and other access devices that may be
necessary to access the COMPUTER;
j. documentation and manuals that may be necessary to access the
COMPUTER or to conduct a forensic examination of the COMPUTER;
k. records of or information about Internet Protocol addresses used by the
COMPUTER;
l.
including firewall logs, caches, browser history and cookies,
31
entered into any Internet search engine, and records of user-typed web
addresses;
m. obscene matter sent or intended to be sent to minors;
n. records or information pertaining to a sexual interest in minors;
o. records or information pertaining to online chats or other conversations
with minors;
p. records or information pertaining to the transfer or attempted transfer
of obscene matter to minors; and
q. contextual information necessary to understand the evidence described
in this attachment.
3. Routers, modems, and network equipment used to connect computers to the
Internet.
4. Child pornography, as defined in 18 U.S.C. § 2256(8), visual depictions of
minors engaging in sexually explicit conduct, as defined in 18 U.S.C. § 2256(2),
and child erotica.
5. Records, information, and items relating to violations of the above-listed
statutes, including:
a. Records, information, and items relating to the occupancy or ownership
of the SUBJECT PREMISES, including utility and telephone bills, mail,
envelopes, or other addressed correspondence;
32
b. Records, information, and items relating to the ownership or use of any
computer or storage medium found at the SUBJECT PREMISES,
including sales receipts, bills for Internet access, and handwritten notes;
c. Records and information relating to the identity or location of the
persons suspected of violating the above-listed statutes;
d. Records and information relating to sexual exploitation of children,
including correspondence and communications between users of child
pornography, child sexual abuse, and child exploitation websites;
e. obscene matter sent or intended to be sent to minors;
f. records or information pertaining to a sexual interest in minors;
g. records or information pertaining to online chats or other conversations
with minors;
h. records or information pertaining to the transfer or attempted transfer
of obscene matter to minors;
creation or storage, including any form of computer or electronic storage (such as hard
disks or other media that can store data); any handmade form (such as writing); any
mechanical form (such as printing or typing); and any photographic form (such as
microfilm, microfiche, prints, slides, negatives, videotapes, motion pictures, or
photocopies).
33
electrochemical, or other high-speed data processing devices performing logical,
arithmetic, or storage functions, including desktop computers, notebook computers,
mobile phones, tablets, server computers, and network hardware.
data can be recorded, including external and internal hard drives, flash drives, thumb
drives, micro SD cards, macro SD cards, DVDs, gaming systems, SIM cards, cellular
phones capable of storage, floppy disks, compact discs, magnetic tapes, memory cards,
memory chips, and other magnetic or optical media.
This warrant authorizes the review of electronic storage media and
electronically stored information seized or copied pursuant to this warrant in order
to locate evidence, fruits, and instrumentalities described in this warrant. The review
of this electronic data may be conducted by any government personnel assisting in
the investigation, who may include, in addition to law enforcement officers and
agents, attorneys for the government, attorney support staff, and technical experts.
Pursuant to this warrant, the HSI may deliver a complete copy of the seized or copied
electronic data to the custody and control of attorneys for the government and their
support staff for their independent review.
34
ATTACHMENT A2
Property to be Searched
This warrant applies to information associated with Google Account No.
ormation associated with the
SUBJECT ACCOUNT has previously been provided by Google, pursuant to a
search warrant issued by a state court, to the Newberry
(Massachusetts) Police Department. The contents of the SUBJECT ACCOUNT
have been provided by the Newberry Police Department to HSI on computer storage
media, and are currently in possession of HSI in Portland, Maine.
35
ATTACHMENT B2
Items to be Seized
The following materials, which constitute evidence of the commission of a
criminal offense, contraband, the fruits of crime, or property designed or intended for
use or which is or has been used as the means of committing criminal offenses, namely
violations of 18 U.S.C. §§ 1470, 2251, 2252, or 2252A:
a. evidence of who used, owned, or controlled the SUBJECT ACCOUNT at
the time the things described in this warrant were created, edited, or
deleted, such as logs, registry entries, configuration files, saved user
names and passwords, documents, browsing history, user profiles,
t messaging logs, photographs, and
correspondence;
b. evidence indicating how and when the SUBJECT ACCOUNT was
accessed or used to determine the chronological context of the access,
use, and events relating to the crimes under investigation and to the
SUBJECT ACCOUNT user;
c. evidence indicating the knowledge and/or intent of the user of the
SUBJECT ACCOUNT as it relates to the crimes under investigation;
d. evidence of the times the SUBJECT ACCOUNT was used;
e. passwords, encryption keys, and other access devices that may be
necessary to access the SUBJECT ACCOUNT;
36
f. records of or information about Internet Protocol addresses used to
access the SUBJECT ACCOUNT;
g. child pornography, as defined in 18 U.S.C. § 2256(8), visual depictions
of minors engaging in sexually explicit conduct, as defined in 18 U.S.C.
§ 2256(2), and child erotica;
h. records and information relating to sexual exploitation of children,
including correspondence and communications between users of child
pornography, child sexual abuse, and child exploitation websites;
i. obscene matter sent or intended to be sent to minors;
j. records or information pertaining to a sexual interest in minors;
k. records or information pertaining to online chats or other conversations
with minors;
l. records or information pertaining to the transfer or attempted transfer
of obscene matter to minors;
m. contextual information necessary to understand the evidence described
in this attachment.
37

Kiesel

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Kiesel

Uploaded by

Copyright:

Available Formats

Case 2:21-mj-00118-JHR Document 1 Filed 05/06/21 Page 1 of 1 PageID #: 5

Case 2:21-mj-00118-JHR Document 1-1 Filed 05/06/21 Page 1 of 27 PageID #: 6

IN THE UNITED STATES DISTRICT COURT

IN THE MATTER OF THE SEARCH

AFFIDAVIT IN SUPPORT OF AN APPLICATION

I, Ronald Phillips, being duly sworn, depose and state as follows:

INTRODUCTION AND AGENT BACKGROUND

2010. I am a graduate of the North Carolina Basic Law Enforcement Training

the University of North Carolina Wilmington. I have received specialized training in

from my personal observations, my training and experience, and information

obtained from other agents and witnesses.

2. This Affidavit is submitted in support of an application under Rule 41 of

known as 295 Hill Street, Biddeford

electronic devices located therein, and (2)

contents of Google Account No.

ACCOUNT are more particularly described in Attachments A1 and A2 respectively.

The items to be seized are described in Attachments B1 and B2.

Code, Sections 1470 (transfer of obscene material to a minor), 2251 (sexual

exploitation of children), 2252 (sexual exploitation of minors), and 2252A (child

4. The statements in this Affidavit are based on information provided by

the service of subpoenas; the results of physical and electronic surveillance;

independent investigation and analysis performed both by me and by other law

enforcement officers, analysts, and computer forensic professionals; and my training

5. I know from my participation in this investigation that on March 15,

on with an undercover agent posing as

6. The Lead further advised that communications began on a social media

cating via Chat Ave Kiesel advised he

was a 48-year-old man and described himself

itched to SnapChat, Kiesel confirmed

advised he worked as a special education teacher at a Middle School in the United

7. I have reviewed records provided by SnapChat, which indicate that the

IP was listed as 108.183.170.123, and the

SnapChat provided IP history which in

108.183.170.123 both dated Februarys 25, 2021.

8. I have reviewed records provided by Google relating to Google Account

on September 28, 2010. The recovery

telephone number is 717-793-1384. Google provided IP history which included

9. I am informed by officers of the Biddeford Police Department that Jesse

10. On about May 4, 2021, I learned that the Newburyport Police

Department in Massachusetts had conducted an undercover investigation into online

am informed by Newburyport police officers that the communications occurred

sent, among other things, a video depicting his genitals.

Newburyport Police Department, who informed me that he is an affiliate member of

the Massachusetts Internet Crimes Against Children Taskforce (ICAC) as well as a

and discussed an incident report prepared by Det. Sgt. Wotjkowski. As a result of

a. On about April 16, 2021, Det. Sgt. Worjkowski began

communicating on a social media chat platform Chat Avenue posing as a 13-year-old

later identify as Jesse Kiesel. Communication eventually transitioned from Chat

Account was sexual in nature.

b. While communicating on Chat Avenue, the target user asked the

er wrote that he was from Maine and that he was 48 years

the user of the UC Account wished to engage in sexual contact.

c. Once the communication transitioned to Google Hangouts, the

target user, using the Google email addres

d. During the communications, the target user sent photographs to

the UC Account persona.

penis to the UC Account.

f. On about April 29, 2021, Det. Sgt. Worjkowski executed a search

warrant on Google for the SUBJECT A

email: [email protected]. It was at that point that Det. Sgt. Wojtkowski

recovery email address associated with the SUBJECT ACCOUNT was

[email protected], which Det. Sgt. Wotjkowski knew to be associated with

the Biddeford public schools.