UNITED STATES DistrichCOBRt Sep 232000 Westen DISTRICT OF In the Matter ofthe Search of enue im tnertatteipanseon ce erent APPLICATION AND AFFIDAVIT ieee FOR SEARCH WARRANT located in the woods behind Calvary Bapsst Church, ‘20957 Timberlake Road, Lynchburg, Virginia Case Number; 7°70 MFP L Christian Pewyiobn being duly swom depose and say: Tam afn) ‘Special Agent, Federal Bureau of Investigation and have reason to believe that Clon the person of or X on the property or premises known as (name, description and/or location) ‘A tent, red and tan in color, located in the woods behing Calvary Baptist Church, 20057 Timberake Road, Lynchburg, Virgin inthe Western Diswit of Virginia there is now concealed a certain person oF property, namely ie hens pope id) See Attachment B ofthe attached AM, incorporated herein by reference ‘Which is (em one crore ue rset ne to ne Rl Gee Cin Pr) evidence, contraband, and inseumentlities ‘conceming a violation of Tile __18__United States code, Section(s) __2251, 2252, and 2252A, The facts to suppor a finding of Probable Cause are as follows: See attached affidavit, incorporated herein by reference Continued on the atched sheet and madea part hereof: x Yew Zz Signature of Alfant ‘Swom to before me and subscribed in my presence, September 15,2010 a Lynch, Vicgnin rea He eed us DitethTahe ta 2Gesroreg ArrFigm2e) AFFIDAVIT IN SUPPORT OF AN_APPLICATION FOR A SEARCH WARRANT 1, Christian Pettyjohn, a Special Agent (SA) with the Federal Bureau of Investigation (FBI), Richmond Division, Lynchburg, Virginia, Resident Agency, being duly sworn, depose and state as follows: INTRODUCTION 1. Thave been employed as a Special Agent of the FBI for approximately twenty-one years, and am currently assigned to the Richmond Division, Lynchburg, Virginia, Resident Agency. Since joining the FBI, I have been involved in investigations related to computer technology or cyber crime, child exploitation, and child pornography, among other violations of federal criminal law. As a federal agent, I am authorized to investigate violations of the laws of the United States and to execute warrants issued under the authority of the United States. 2. 1am involved in the investigation of the activities of Jimmy Lee Cook, who is currently living, homeless, in Lynchburg, Virginia. As will be shown below, there is probable cause to believe Jimmy Lee Cook has used, persuaded, induced, or enticed an eleven year old female victim to produce child pornography, in violation of 18 U.S.C. §§ 2251, and that he distributed and possessed child pornography in violation of 18 U.S.C. §§ 2252 and 2252A. | submit this application and affidavit in support of search warrants authorizing: 1) a search of the person of Jimmy Lee Cook, all items on his 1416M 289 person, to include any bag, backpack, or satchel, and 2) a tent where he currently resides located in a wooded area beside the Food Lion grocery store located at 21039 Timberlake Road, Lynchburg, Virginia, and behind the Calvary Baptist Church, 20957 Timberlake Road, Lynchburg, Virginia, as further described in Attachment A, incorporated herein by reference, and the ‘computer(s) located on his person, in the tent, and/or in the area surrounding the tent. I request to seize the evidence, contraband, and instrumentalities of the forgoing criminal violations, which relate to the knowing transportation, shipment, receipt, possession, distribution, and production of child pornography. I request authority to search Jimmy Lee Cook and all items in his possession, to include any bags, backpacks, containers, cell phone, PDA, ‘computer cases and any computer and computer media located therein where the items specified in Attachment A may be found, and to seize all items listed in Attachment B, incorporated herein by reference, as instrumentalities, contraband, and evidence of crime. 3. The statements in this affidavit are based on information provided by FBI SA Matthew C. Smith, who is currently assigned to the Indianapolis FBI Cyber Crime Task Force, located in Indianapolis, Indiana; Lieutenant Donald L, Whitehead of the Kokomo Police Department, located in Kokomo, Indiana; and Investigator Robert New of the Campbell County Sheriffs Office, located in. Rustburg, Virginia. Because this affidavit is being submitted for the limitedFGM 299 purpose of securing search warrants, [have not included each and every fact, ‘known to me concerning this investigation. 1 have set forth only the facts that believe are necessary to establish probable cause that evidence, contraband, and instrumentalities of the violations of §§ 2251, 2252, and 2252A are presently in the possession of Jimmy Lee Cook and/or located in or in the area surrounding the tent he is currently using in Lynchburg, Virginia. STATUTORY AUTHORITY 4. This investigation concerns alleged violations of 18 Title U.S.C. §§ 2251, 2252 and 2252A, relating to material involving the sexual exploitation of Title 18 U.S.C. § 2251(a) prohibits any person from employing, using, persuading, inducing, enticing, or coereing any minor to engage in any sexually explicit conduct for the purpose of producing ‘any visual depiction of such conduct or for the purpose of transmitting a live visual depiction of such conduct, if such person knows or has reason to know that such visual depiction will be transported or transmitted ‘using any means or facility of interstate or foreign commerce or in oF affecting interstate or foreign commerce or mailed, if such visual depiction was produced or transmitted using materials that have been ‘mailed, shipped, or transported in or affecting interstate or foreign4b 297 commerce by any means, including by computer, oF is such visual depiction has actually been transported or transmitted using any means ‘or facility of interstate or commerce or in or affecting interstate or foreign commerce or mailed. b, Title 18 U.S.C. § 2252(a)(1) prohibits knowingly transporting or shipping using any means or facility of interstate or foreign commerce by any means, including by computer or mail, any visual depiction the producing of which involved the use of a minor engaging in sexually explicit conduct and such visual depiction is of such conduct. €. Tile 18 U.S.C. § 2252(a)2) prohibits knowingly receiving or distributing any visual depiction using any means or facility of interstate or foreign commerce or that has been mailed, or has been shipped or transported in or affecting interstate or foreign commerce, or which contains materials which have been mailed or so shipped or transported, by any means including by computer, or knowingly reproduces any visual depiction for distribution using any means or facility of interstate (oF foreign commerce or in or affecting interstate or foreign commerce or through the mails, if producing of such visual depiction involved the use of a minor engaging in sexually explicit conduct and such visual depiction is of such conduct.FKM289 Title 18 U.S.C. § 2252{a)(4) prohibits possessing one or more books, magazines, periodicals, films, or other materials which contain visual depictions of minors engaged in sexually explicit conduct that have been shipped or transported using any means or facility of interstate or foreign commerce or in or affecting interstate or foreign commerce, or that were produced using materials which have been railed or so shipped or transported, where the producing of such visual depiction involved the use ofa minor engaging in sexually explicit conduct and such visual depiction is of such conduct. €. Title 18 U.S.C. § 2252A(a)(1) prohit knowingly mailing, transporting, or shipping child pornography using any means or facility of interstate or foreign commerce or in or affecting interstate or foreign ‘commerce by any means, including by computer. f. Tile 18 U.S.C. § 2252A(a)(2) prohibits knowingly receiving or distributing any child pornography that has been mailed or using any ‘means or facility of interstate of foreign commerce shipped or transported in or affecting interstate or foreign commerce by any means, including by ‘computer. & Tile 18 U.S.C. § 2252A(a)(3)(A) prohibits a person from knowingly reproducing child pornography for distribution through the mail, or using any means or facility of interstate or foreign commerce orALG M289 in or affecting interstate or foreign commerce by any means, including by computer. hh. Title 18 U.S.C. § 2252A(a)(9)(B) prohibits knowingly ‘advertising, promoting, presenting, distributing, or soliciting through the ‘mail, or using any means or facility of interstate or foreign commerce, oF in or affecting interstate or foreign commerce by any means, including by ‘computer, any material or purported material in a manner that reflects the belief or is intended to cause another to believe that the material is or contains a visual depiction of an actual minor engaging in sexually explicit conduct, or an obscene visual depiction of a minor engaging in sexually explicit conduct. i, Title 18 U.S.C, § 2252A(a)(5)(B) prohibits a person from knowingly possessing any book, magazine, periodical, film, videotape, ‘computer disk, or other material that contains an image of child ‘pomography that has been mailed, shipped, or transported using any means or facility of interstate or foreign commerce or in or affecting interstate or foreign commerce by any means, including by computer, oF that was produced using materials that have been mailed, shipped, or transported in interstate or foreign commerce by any means, including by computer, or that was produced using materials that have been,F1gm87 railed, or shipped or transported in or affecting interstate or foreign commerce by any means, including by computer. DEFINITIONS ‘The following definitions apply to this Affidavit and Attachment B: a. ‘Child Erotica” means materials or items that are sexually arousing to persons having a sexual interest in minors but that are not necessarily, in and of themselves, obscene or that do not necessarily depict minors in sexually explicit poses or positions. b. “Child Pornography” includes any visual depiction of ‘sexually explicit conduct where (a) the production of the visual depiction involved the use of a minor engaged in sexually explicit conduct; or (b) the visual depiction has been created, adapted, or modified to appear that an identifiable minor is engaged in sexually explicit conduct. See 18 U.S.C. § 2256(8). ‘Computer’ refers to “an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical or storage functions, and includes any data storage facility or ‘communications facility directly related to or operating in conjunction with such device.” See 18 U.S.C. § 1030(¢(1). 4. ‘Computer hardware” consists of all equipment that can receive, capture, collect, analyze, create, display, convert, store, conceal,Fira 289 or transmit electronic, magnetic, or similar computer impulses or data, ‘Computer hardware includes any data-processing devices (including, but not limited to, central processing units, internal and peripheral storage devices such as fixed disks, external hard drives, loppy disk drives and diskettes, and other memory storage devices); peripheral input/output devices (inciuding, but not limited to, keyboards, printers, video display ‘monitors, and related communications devices such as cables and connections); as well as any devices, mechanisms, or parts that can be used to restrict access to computer hardware (including, but not limited to, physical keys and locks) ©. ‘Computer passwords and data security devices” consist of information or items designed to restrict access to or hide computer software, documentation, or data. Data security devices may consist of hardware, software, or other programming code. A password (a string of alpha-numeric characters) usually operates what might be termed a digital key to “unlock” particular data security devices. Data security hardware may include encryption devices, chips, and circuit boards. Data security software of digital code may include programming code that creates “test” keys or “hot” keys, which perform certain pre-set security functions when touched. Data security software or code mayFld m297 also encrypt, compress, hide, or “booby-trap” protected data to make it inaccessible or unusable, as well as reverse the progress to restore it. “Computer-related documentation” consists of written, recorded, printed, or electronically stored material that explains or illustrates how to configure or use computer hardware, computer software, or other related items, & ‘Computer software” is digital information that can be interpreted by a computer and any ofits related components to direct the way it works. Computer software is stored in electronic, magnetic, or other digital form. It commonly includes programs to run operating systems, applications, and utilities. hh, “Internet Protocol address" or “IP address" refers to @ unique smumber used by a computer to access the Internet. IP addresses can be dynamic, meaning that the Internet Service Provider (ISP) assigns a different unique number to a computer every time it accesses the Internet. IP addresses might also be static, ifan ISP assigns a user's computer @ particular IP address that is used each time the computer accesses the Internet. i. *Minor* means any person under the age of 18 years. See 18 usc. § 2256()F028 J “Peer-to-peer file-sharing” (P2P) is a method of ‘communication available to Internet users through the use of special software. Computers linked together through the Internet using this software form a network that allows for the sharing of digital files, between users on the network. A user first obtains the P2P software, which can be downloaded from the Internet. In general, P2P software allows the user to set up files on a computer to be shared with others running compatible P2P software. A user obtains files by opening the 2P software on the user's computer, and conducting searches for files, that are currently being shared on another user's computer. k. ‘Sexually explicit conduct” applies to visual depictions that involve the use of a minor, see 18 U.S.C. § 2256(8)(A), or that have been created, adapted, or modified to appear to depict an identifiable minor, ‘see 18 U.S.C. § 2256(8)(C). In those contexts, the term refers to actual or simulated (a) sexual intercourse (including genital-genital, oral-genital, or oral-anal), whether between persons of the same or opposite sex; (0) bestiality; (c) masturbation; (4) sadistic or masochistic abuse; or (¢) lascivious exhibition ofthe genitals or pubic areas of any person. See 18 U.S.C. § 2256(2)A).Fi$m299 1, *Visual depictions” include undeveloped film and videotape, and data stored on computer disk or by electronic means, which are capable of conversion into a visual image, See 18 U.S.C. § 2256(5). m. The terms “records,” “documents,” and “materials” include all information recorded in any form, visual or aural, and by any means, whether in handmade form (including, but not limited to, writings, drawings, painting), photographic form (including, but not limited to, microfilm, microfiche, prints, negatives, videotapes, motion pictures, photocopies); mechanical form (including, but not limited to, phonograph records, printing, typing); or electrical, electronic or ‘magnetic form (including, but not limited to, tape recordings, cassettes, compact discs, electronic or magnetic storage devices such as floppy diskettes, hard disks, CD-ROMs, digital video disks (DVDs), Personal Digital Assistants (PDAs), Multi Media Cards (MMCs), memory sticks, optical disks, printer buffers, smart cards, memory calculators, clectronic dialers, or electronic notebooks, as well as digital data files and. printouts or readouts from any magnetic, electrical or electronic storage device), ‘BACKGROUND ON COMPUTERS AND CHILD PORNOGRAPHY. Based on my knowledge, training, and experience in child ‘exploitation and child pornography investigations, and the experience andFMM 289 training of other law enforcement officers with whom I have had discussions, computers, computer technology, and the Internet have revolutionized the ‘manner in which child pornography is produced and distributed, 7. Computers basically serve five functions in connection with child pornography: production, communication, distribution, storage, and social networking. 8, With digital cameras, images of child pornography can be ‘transferred directly onto a computer. A modem allows any computer to connect to another computer through the use of a telephone, cable, or wireless connection. Through the Internet, electronic contact can be made to literally millions of computers around the world 9. The computer's ability to store images in digital form makes the computer itself an ideal repository for child pornography. The size ofthe electronic storage media (commonly referred to as the hard drive) used in home computers has grown tremendously within the last several years, These drives can store hundreds of thousands of high resolution images. 10. The Internet affords individuals several diferent venues for meeting each other, obtaining, viewing and trading child pornography in a relatively secure and anonymous fashion, 11, Individuals also use online resources to retrieve and store child pornography, including services offered by Internet Portals such as Yahoo! andFG M299 Hotmail, among others. The online services allow a user to set up an account with a remote computing service that provides e-mail services as well as electronic storage of computer files in any variety of formats. A user can set up ‘an online storage account from any computer with access to the Internet. [Bvidence of such online storage of child pornography is often found on the ‘user's computer. Even in eases where online storage is used, however, evidence of child pornography can be found on the user's computer in most 12, As with most digital technology, communications made from a computer are often saved or stored on that computer. Storing this information can be intentional, for example, by saving an e-mail as a file on the computer or saving the location of one’s favorite websites in “bookmarked” files. Digital information can also be retained unintentionally. Traces ofthe path of an electronic communication may be automatically stored in many places, such as temporary files or ISP client software, among others, In addition to electronic communications, a computer user's Internet activities generally leave traces in computer's web cache and Intemet history files. A forensic examiner often can recover evidence that shows whether a computer contains peer-to-peer software, when the computer was sharing files, and some of the files that were uploaded or downloaded. Computer files or remnants of such files can be recovered months or even years after they have been downloaded onto a hardF:1om 289 drive, deleted, or viewed via the Internet. Blectronic files downloaded to a hard drive can be stored for years at litle or no cost. Even when such files have been deleted, they can be recovered months or years later using readily available forensic tools. When a person “deletes” a file on a home computer, the data contained in the file does not actually disappear; rather, that data remains on the hard drive until it is overwritten by new data. Therefore, deleted files, or remnants of deleted files, may reside in free space or slack space ~ that is, in space on the hard drive that is not allocated to an active file or that js unused after a file has been allocated to set block of storage space ~ for Jong periods of time before they are overwritten. In addition, a computer's cperating system may also keep a record of deleted data in a “swap or “recovery” file. Similarly, files that have been viewed via the Internet are automatically downloaded into a temporary Internet directory or “cache.” The browser typically maintains a fixed amount of hard drive space devoted to these files, and the files are only overwritten as they are replaced with more recently viewed Internet pages. Thus, the ability to retrieve residue of an electronic file from a hard drive depends less on when the file was downloaded. or viewed than on a particular user's operating system, storage capacity, and computer habits. 18. YouTube is a video-sharing website on which users can upload share, and view videos. Unregistered users can watch the videos, while 4- :10m299 registered users are permitted to upload videos, as well as amateur content ‘such as short original videos. The uploading of videos containing child pornography is prohibited by YouTube's terms of service agreement with users. 14, If YouTube personnel find that someone has uploaded child pornography to its servers, YouTube will make a referral to the Cybertip line maintained by the National Center for Missing Exploited Children (NCMEC) for further investigation and action. ‘SPECIFICS OF SEARCH AND SEIZURE OF COMPUTER SYSTEMS 15, Searches and seizures of evidence from computers commonly require agents to download or copy information from the computers and their components, or seize most or all computer items (computer hardware, ‘computer software, and computer related documentation) to be processed later by a qualified computer expert in a laboratory or other controlled environment, ‘This is almost always true because of the following two reasons: 16. Computer storage devices (like hard disks, diskettes, tapes, laser disks, magneto opticals, and others) can store the equivalent of millions of pages of information. Especially when the user wants to conceal criminal ‘evidence, he or she often stores the data in random order with deceptive file ‘names. Recovering and searching this data requires an investigator to examine all the stored data that is available in order to determine whether it is included within the scope of the warrant authorizing the search. This sorting processF19 m28? can take days or weeks, depending on the volume of data stored, and is ‘generally difficult to fully accomplish on-site. If this search warrant is issued, the law enforcement agents executing it will attempt to triage or preview some of the computer data described in Attachment B to further the investigation, ‘but a complete analysis of this data will not be completed on scene. 17, Searching computer systems for criminal evidence is a highly technical process requiring expert skill and a properly controlled environment. ‘The vast array of computer hardware and software available requires even computer experts to specialize in some systems and applications, so it is difficult to know before a search which expert should analyze the system and its data. The search of a computer system is a scientific procedure designed to protect the integrity of the evidence and to recover even hidden, erased, compressed, password-protected, or encrypted files. Since computer evidence is vulnerable to tampering or destruction (which may be caused by malicious code or normal activities of an operating system), the controlled environment of a laboratory is essential to complete a full and accurate analysis, including forensic techniques wh ‘cannot practically be fully accomplished on-scene 18. In order to fully retrieve data from a computer system, the analyst needs all magnetic storage devices as well a the central processing unit (CPU), In cases involving child pornography where the evidence consists partly of graphics files, monitors may be essential for a thorough and efficient searchFPN 89 due to software and hardware configuration issues. In addition, the analyst needs all the system software (operating systems or interfaces, and hardware drivers) and any applications software which may have been used to create the data (whether stored on hard drives or on external media). 19. Furthermore, because there is probable cause to believe that the computer and its storage devices are all instrumentalities of erimes, within the meaning of 18 U.S.C. §§ 2251 through 2256, they should all be seized as such, BACKGROUND OF THE INVESTIGATION 20. On August 18, 2010, Lieutenant (Lt) Donald Whitehead, Kokomo Police Department, received NCMBC CyberTip report number 934732. This report stated that an individual by the name of Jimmy Cook, using the YouTube.com user names "naughtyboyplays’,"justaguyk’, and “nwojcl", amongst others, had enticed a young female (Jane Doe 1) to produce sexually explicit videos of herself and then to upload those videos to YouTube.com. CyberTip 984732 stated "nwojel" stood for “new world order jimmy cook 1°. ‘This report also listed the YouTube.com user name of "justaguyk” as having an associated electronic mail (email) address of “romeos®11@hotmail.com’ 21. Additionally, the NCMEC report provided the name of Jane Doe 1 and her address, which is located in Kokomo, Indiana. On August 23, 2010, Lt. Whitehead interviewed Jane Doe 1 with parental consent, and learned that ‘she was born August XX, 1998, The day of her birth has been redacted for theFiIpmo89 purposes of this affidavit. Jane Doe 1 stated that an individual using the YouTube user names "naughtyboyplays' and "justaguyk’, amongst others, requested for her to record “dirty” videos and upload them to her YouTube.com account. Jane Doe 1 made between five and fifteen videos. She stated she ‘would "strip" and masturbate while recording via her laptop's webcam. She did this from a location in Kokomo, Indiana. 22. Jane Doe 1 stated the individual using the YouTube.com accounts posed as an underage male, but that she knew he was an ‘older’ man using several different nicknames. She approximated the individual's age to be around thirty-five. She believed the individual lives in either North Carolina or Virginia. 23. ‘Through further investigation, Lt. Whitehead located other NCMEC CyberTips associated with this victim. CyberTip 793258 contains three videos that were uploaded from a YouTube.com account used by Jane Doe 1. These videos were flagged as child pornography by YouTube.com and forwarded to NCMEC for review. Jane Doe 1 used the same YouTube.com account that she used to upload the videos requested by ‘justaguyk” and "naughtyboyplays". 24. FBISA Matthew C. Smith reviewed the files from CyberTip 793258 and determined that all three of the video files depict child pornography. According to SA Smith, all three of the uploaded files depict Jane Doe 1 and are described as follows:41D M289 a 330278409_402238004.flv: This video file, which is ‘approximately twenty-two seconds in length, depicts an eleven year old female, with no pubic hair and very little breast development, wearing a yellow and green bra located in a bathroom. The video camera appears to be placed on, oF close to, floor level. At the beginning ofthe video Jane Doe 1's face is visible. The female stands up, tums around, and then ‘bends in front of the camera exposing her anus and vaginal region. The {female stands back up, turns around, places her hands on the floor and ‘exposes her genitals tothe camera, b. 380275409_561035827.flv: This video file, which is approximately two minutes and thirteen seconds in length, depicts Jane Doe 1, naked from the waist down, with no pubic hair, wearing a gold necklace and, what appears to be a black Michael Jackson shirt, with a Jong sleeve blue shirt underneath. The video appears to have been recorded in a bathroom while the recording device was on the floor. The female uses a foreign objec, possibly a permanent marker, to ‘masturbate in front of the camera. Occasionally, the female holds the object very close to the camera. ©. $90275409_561112478.flv: This video file, which is approximately four minutes and forty-five seconds in length, depicts an leven year old female (Jane Doe 1) fully dressed wearing black pants, aFAGM287 ‘brown blouse with metallic trim, and a gold necklace. The video appears to have been recorded in a bedroom. A closet with a curtain can be seen behind and tothe lft ofthe female and a dresser can be seen behind ‘and tothe right ofthe female, The female begins to undress, Once her blouse and pants are removed, the female can be seen wearing a yellow and green bra, with very litle breast development, and pink panties with green trim, The female then turns to show off a brown monkey printed on the back of her panties. ‘The young female then removes her bra and panties, exposing her genital area, with no pubic hair visible. Once female is undressed she turns the recording device around and she sits coma bed with her legs spread apart further exposing her genitals. She inserts an object, what appears to be a marker or pen, into her vagina ‘and proceeds to masturbate. 25, On August 26, 2010, SA Smith performed an online query, using ‘Google.com, for the term “nwojet". Google.com returned a Creative Services advertisement for the Lynchburg, Virginia Craiglistorg. The advertisement offered video and photo slide show production and video and photo editing services. The advertisement listed a reply email address “nwojel@juno.com,” and made reference that sample videos/slide shows could be seen at “nttp/ [www.youtube.com /user/Mrdimmyty1". SA Smith compared a Virginia Department of Motor Vehicle Driver License photo of Jimmy Lee Cook to the10289 background image found at "hitp/ /www.youtube.com/user/MrJimmytv Based on this comparison, SA Smith conchided Cook was the person in the beckgroind age. ————— (WEES When the video described above is played, it shows a girl specifically identified with the full name of Jane Doe 2. 26. Additionally, a video automatically plays in which a child, who is identified in the video with full name as Jane Doe 2, is playing on a playset while music plays in the background. 27, An administrative subpoena was served on Microsoft Corporation on August 25, 2010 for basic subscriber and registration information regarding ‘email address "romeos91 1@hotmal.com’. On August 26, 2010, Microsoft Corporation provided documentation identifying information the original ‘creator of the account listed, Microsoft Corporatation listed the account name as "Romeo Johnson’ with the state listed as Virginia with the United States Postal Service (USPS) Zipcode of 24588. An open database search for the USPS Zipcode of 24588 lists the city of Rustburg, Virginia. 28. An administrative subpoena was served on Google Inc. on August 2, 2010 for basic subscriber and registration information regarding YouTube user names "justaguyk” and "naughtyboyplays". On August 27th, 2010, Google Ine provided documentation identifying subscriber and registration 1F:lom287 {information for both accounts. Google In. listed the signup Intemet Protocol (UP) address for "justaguyk’ as 24.56.116.96. According to MaxMind.com, a service which provides an approximated geographical location for IP addresses, this IP address geolocates to Appomattox, Virginia, which is located approximately twenty-two miles west of Lynchburg, Virginia, Google Inc. listed the signup Internet Protocol (IP) address for “naughtyboyplays" as 24.149.124.215. According to MaxMind.com, this IP address geolocates to iynchburg, Virginia. 29, An administrative subpoena was served on Juno.com on August, 25, 2010 for basic subscriber and registration information regarding email address "nwoje]@juno.com’. On August 26th, 2010, Juno.com provided documentation identifying subscriber and registration information. Juno.com listed the member's name as Jimmy L. Cook, birth date August XX, 1969, address of 402 6 Charlotte Street, Brookneal, Virginia 24528, The day of birth has been redacted for the purposes of this affidavit. Juno.com also provided several pages listing dates, times, and Internet Protocol (IP) addresses from which the email address had been accessed. The most recent and common IP ‘address was 71.173.103.185. According to MaxMind.com this IP geolocates to Lynchburg, Virginia 30, A public records report accessed through Accurint, a public records database that can be accessed and searched over the Internet, forHOM 289 Jimmy Cook, provided the full name of Jimmy Lee Cook, a previous home address of 402 Charlotte Street, Apartment G, Brookneal, Virginia, 24528, date of birth August XX, 1969, and Social Security Number XXK-XX-1164, The first five digits ofthe Social Security Number have been redacted for the purposes of this affidavit. Your affiant is aware, however, through his training and experience that Accurint data may not always be correct. On September 13, 2010, a Virginia Department of Motor Vehicles transcript of driver history was obtained whic! \dicated that Jimmy Lee Cook's Driver's License was in a suspended status. His current address was listed as 9750 Village Highway, Concord, Virginia. His date of birth was August XX, 1969, Social Security Number was XXX-XX-6827, and the transcript described him as being 69 inches tall, weighing 155 pounds, with blue eyes and mixed colored hair. 31. On September 2, 2010, Investigator Robert New, Campbell County Sheriff's Office located in Rustburg, Virginia, reported having Jimmy Lee Cook ‘under surveillance on several separate occasions based on an investigation in New Jersey, discussed further in the next paragraph. Investigator New reported that Cook frequently used the open wireless connection provided by the Timbrook Public Library, located in the Southwood Village shopping plaza, 21039 Timberlake Road, Lynchburg, Virginia. Investigator New reported that IP address 71.173.103.185 is used by the Timbrook Public Library. On. September 2, 2010, Investigator New reported observing Jimmy Lee Cook using aHb ne97 a dark grey in color Acer Laptop computer inside the Timbrook Public Library. Investigator New reported that he has also observed Jimmy Lee Cook using the open wireless connection provided by the McDonald's Restaurant located at 21047 Timberlake Road, Lynchburg, Virginia. 32. Investigator New reported that on June 2, 2010, he was contacted by Detective Dave Kohler with the Burlington County Prosecutor's Office, Sexual Assault Child Abuse Unit, Internet Crimes Against Children Task Force, in New Jersey. Detective Kohler requested assistance locating a subject who had been communicating with, and soliciting sexual images from, a minor girl Detective Kohler identified the subject as Jimmy Lee Cook, On July 7, 2010, Investigator New received a telephone call from Detective Kohler who stated that an email had just been received from a subject believed to be Jimmy Lee Cook, utilizing an IP address identifiable with AT&T. Investigator New recognized the IP address as being associated with the open wireless connection provided by the McDonald's Restaurant located at 21047 Timberlake Road, Lynchburg, Virginia. Investigator New responded to this, McDonald's Restaurant and observed Jimmy Lee Cook sitting inside the restaurant with a dark in color Acer laptop computer, Investigator New observed Jimmy Lee Cook wping on the computer keyboard. Investigator New hhad observed Jimmy Lee Cook with a similar laptop computer at this MeDonald's Restaurant on June 29, 2010.# Ip m3? 83, Investigator New reported that on June 20, 2010, he was notified ‘that Jimmy Lee Cook had been evicted from his Campbell County, Virginia residence. Investigator New subsequently determined that Jimmy Lee Cook resides in a tent. On August 31, 2010, Investigator New observed Jimmy Lee Cook inside the Timbrook Public Library using a laptop computer. Investigator New subsequently observed him leave the area of the library, walk into the ‘woods beside the Food Lion grocery store, and carry a laptop computer and a ‘bag into a red and tan in color tent. The tent was located in the woods beside the Food Lion grocery store located in the Southwood Village shopping plaza, 21039 Timberlake Road, Lynchburg, Virginia. The GPS coordinates for the tent location were identified by Investigator New as North 37° 20.151’ West 79° 14,662 Elevation 917 feet. On September 14, 2010, Investigator New observed the tent and reported that the tent has been at this location since he first observed it there on July 7, 2010, and that he could hear music coming from the vicinity of the tent. The owner of the property where Jimmy Lee Cook's tent is located is Calvary Baptist Church, 20957 Timberlake Road, Lynchburg, Virginia 24502, and the tent is situated in the woods behind the church and beside the Food Lion grocery store. Investigator New reported that the church hhas not granted permission for Jimmy Lee Cook to camp or otherwise reside on its property and considers him to be trespassing.416 M299 34, Investigator New reported that on September 14, 2010, he interviewed the manager of the Burger King restaurant, 21006 Timberlake Road, Lynchburg, Virginia 24502. The manager identified a photograph of Jimmy Lee Cook as someone she observed inside the restaurant on several ‘occasions. The restaurant has an open wireless computer connection, She told Investigator New that on September 10, 2010, she observed Jimmy Lee Cook using a dark in color laptop computer while he wat iting inside the restaurant. She observed on the computer screen what she believed was the fully nude video image of @ young female approximately 12 years old. The child was pictured leaning against a bed with a patch-type blanket and white in color pillows on the bed. There was also a table and a lamp visible. She described the child as a white female with reddish blonde hair. The manager told Investigator New that she believed the child appeared younger than the ‘manager's 18 year old sister. She stated that the child appeared to have very litle breast tissue and a young looking face. ‘The manager told Investigator Now that when Jimmy Lee Cook noticed the manager he quickly closed out the ‘computer image. 2%FAP m3) 35. As set forth above, probable cause exists to believe that Jimmy Lee Cook has possessed, and /orent |a minor to produce child pornography, or has attempted to commit these crimes. Based upon my knowledge, experience, and training in child pomography investigations, and the training and experience of other law enforcement officers with whom I have had discussions, I know that there are certain characteristics common to individuals involved in such crimes: Those who distribute, transport, receive, or possess child pomography, or who attempt to commit these crimes, may receive sexual gratification, stimulation, and satisfaction from contact with children; or from fantasies they may have viewing children engaged in sexual activity or in sexually suggestive poses, such as in person, in photographs, or other ‘visual media; or from literature describing such activity. b. Those who distribute, transport, receive, or possess child pomography, or who attempt to commit these crimes may collect sexually explicit or suggestive materials, in a variety of media, including photographs, magazines, motion pictures, videotapes, books, slides and/or drawings or other visual media. Such individuals oftentimes use these ‘materials for their own sexual arousal and gratification. Further, they may ‘use these materials to lower the inhibitions of children they are attempting to seduce, to arouse the selected child partner, or to demonstrate the desired sexual acts. n#10299 ‘Those who distribute, transport, receive, or possess child pornography, or who attempt to commit these crimes often possess and ‘maintain copies of child-pornography material, thatis, their pictures, lms, Video tapes, magazines, negatives, photographs, correspondenes, mailing ats, books, tape recordings, etc. inthe privacy and security of their home or some other secure location. These individuals typically retain pictures, films, photographs, negatives, magazines, correspondence, books, tape recordings, mailing lst, child erotica, and videotapes for many years. 4. Likewise, those who distribute, transport, receive, oF possess child pornography, or who attempt to commit these crimes often maintain their collections that are in a digital or electronic format in a safe, secure and private environment, such asa computer and surroundingarea. These collections are often maintained for several years and are kept close by, ‘usually at the individual's residence, to enable the collector to view the collection, which is valued highly. ©. Those who distribute, transport, receive, or possess child pornography, or who attempt to commit these rimes also may correspond ‘with and/or meet others to share information and materials; rarely destroy correspondence from other child pornography distributors/collectors; ‘conceal such correspondence as they do their sexually explicit material; and often maintain lists of names, addresses, and telephone numbers of ”$10 M289 individuals with whom they have been in contact and who share the same interests in child pornography. £. Those who distribute, transport, receive, or possess child pornography, or who attempt to commit these crimes prefer not to be without their child pornography for any prolonged time period. This behavior has been documented by law enforcement officers involved in the investigation of child pornography throughout the world 86, The person using a computer as described above exhibits the common characteristics described above of someone involved in the distribution, transportation, receipt, and possession of child pornography, or the attempt to Gistribute, transport, receive, or possess child pornography. I base this conclusion on the facts that are set forth in this affidavit, including the number and content of the images and videos described above that were associated with this person’s account. CONCLUSION 37. Based on the aforementioned factual information, your affiant respectfully submits that there is probable cause to believe that Jimmy Lee Cook is involved in the receipt, possession, distribution, and production of child pornography. Your affiant respectfully submits that there is probable ‘cause to believe that Jimmy Lee Cook has violated 18 U.S.C. 8§ 2251, 2252 and 2252A. Additionally, there is probable cause to believe that evidence of 9#10289 criminal offenses, namely, violations of 18 U.S.C. §§ 2251, 2252 and 2252A, is, Jocated on the person of Jimmy Lee Cook, in his tent, and/or in the area surrounding his tent, and this evidence, listed in Attachment B to this affidavit {s contraband, or things otherwise criminally possessed, or property which is or ‘has been used as the means of committing the foregoing offenses. 38. Your affiant, therefore, respectfully requests that the attached warrant be issued authorizing the search and seizure of the items listed in Attachment B. 39. Because the investigation is ongoing, I would request the Court to seal the Application for Search Warrant and the Search Warrant in this matter. Special Agent Federal Bureau of Investigation ‘Sworn and subscribed before me this 'T day of September, 2010. Nema Lirra United States District Court Judge