‘UNITED STATES DISTRICT COURT DISTRICT OF CONNECTICUT STATE OF CONNECTICUT FILED UNDER SEAL : ss New Haven, Conneticut COUNTY OF NEW HAVEN April 21, 2011 AFFIDAVIT. SUPPORT OF A CRIMINAL COMPLAINT J, Jonathan Carreiro, being duly sworn, depose and stale as follows’ BACKGROUND OF AFFIANT 1. Tam currently employed by the Connecticut State Police and have been since January of 2006, and at all times mentioned hereinafter was acting in my official capacity as a member of the State Police, Tam currently assigned to the Computer Crimes and Blectronie Evidence Laboratory. I have received specialized training relating to the investigation of Internet related crimes, child pornography crimes, and computer date anslysis. The following facts and circumstances are stated from my personal knowledge and observations, as well as information received ftom other police officers acting in their official eapacity and fiom police reports. Specifically, [ have worked on this investigation with members of the Connecticut PBI, including James Wines who supervises FBI and task force agents who investigates cases of the possession and distribution of child pomography, I have served as an affiant ii numerous cases in which a state court has issued search and arrest warrants, ‘This is my first occasion to be an affiant for a federal arrest warrant. 2, Tam currently investigating criminal conduct as it relates (0 David L. Bourque, who As will be shown herein, I believe that fern? resides atthere is probable cause to believe that Bourque has possessed child pornography on a computer and computer components in violation of Title 18 U.S.C. §2252A(aX5)(B). 3, This Affidavit is being submitted in support ofa criminal complaint and atrest warrant for David Bourque for a violation of Title 18 U.S.C, § 2252A(a)(5)(B), which makes it a crime to possess child pornography, 4, The statements contained in this Affidavit are based in pact on information provided by members of the Connecticut State Police, Special Agents of the PBI and other law ‘enforcement personnel, information gathered through first-hand investigation, and my experience and background, Since this Affidavit is being submitted for the limited purpose of securing a criminal complaint, I have not inetuded each and every fact known to me concerning this investigation, Ihave set forth only the facts that I believe are necessary to establish that probable cause to believe that a violation of Title 18 U.S.C. § 2252A(a)(5)(B) has been committed by David L. Bourque. STATUTORY AUTHORITY 5. This investigation concerns possible violations of 18 U.S.C. § 2252A(a)(5)(B), relating to material involving the sexual exploitation of minors, 18 U.S.C. § 2252A(a)(5)(B) prohibits a person fiom knowingly possessing, or knowingly accessing with intent to view, any book, magazine, periodical, film, videotape, computer disk, or any other material that contains an image of child pornography that has been mailed, or shipped or transported using any means or facility of interstate or foreign commerce or in or affecting interstate or foreign commerce by any means, including by computer, or that was produced using materials that have been mailed, or shipped or transported in or affecting ganainterstate or foreign commerce by any means, including by computer. DEFINITIONS 7. The following definitions apply to this Affidavit and Attachment B to this Affidavit: & "Child Broties," as used herein, means materials or items that are sexually atoutsing to persons having a sexual interest in minors but that are not, in and of themselves, obscene or that do not necessarily depict minors in sexually explicit poses or positions. b, "Child Pomography," as used herein, includes the definition in 18 U.S.C. § 2256(8) (any visual depiction ineluding any photograph, film, video, picture, or computer or computer-generated image or picture, whether made or produced by electronic, mechanical, or other means of sexually explicit conduet, where (A) the production of such visual depiction involves the use ofa minor engaging in sexually explicit conduct; (B) such visual depiction is a digital image, computer image, or computer-generated image that is, or is indistinguishable from, that of'a minor engaging in sexually explicit conduct; or (C) such visual depiction has been created, adapted, or modified to appear that an identifiable minor is engaged in sexually explicit conduct), and also includes any visual depiction, the production of which involves the use of a minor engaged in sexually explicit conduct. 18 U.S.C. §§ 2252 and 2256(2), c "Visual depiction” includes undeveloped film and videotape, data stored ‘on computer disk or by eleetronie means which is capable of conversion into a visual image, and data which is capable of conversion into a visual image that has been transmitted by any means, ‘whether or not stored in a permanent format, 18 U.S.C. § 2256(5). mulated (1) sexual "Sexually explicit conduct" means actual or Mimeintereourse, including genital-genital, oral-genital, anal-genital, ot oral-anal, whether between _persons of the same or opposite sex; (i) bestiality; (ii) masturbation; (Iv) sadistic or masochistic abuse; or () lascivious exhibition of the genitals or pubic area of any person. 18 U.S.C. § 2256(2\(A). c. "Computer," means an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in ‘conjunction with such device, but such ferm does not include an automated typevwiter or typesetter, a portable hand held calculator, or other similar device, 18 U.S.C. § 1030()(1). £ "Computer hardware," as used hrein, consists of all equipment which ean receive, capture, collect, analyze, create, display, convert, store, conceal, or transmit electronic, magnetic, or similar computer impulses or date, Computer hardware includes any data ited to, contval processing units, intemal and peripheral processing devices (including, but not li storage devices such as fixed disks, external hard drives, floppy disk drives and diskettes, and other memory storage devices); peripheral inpuVoutput devices (including, but not limited to, keyboards, printers, video display monitors, and related communications devices such as cables ‘and connections), as well as any devices, mechanisms, or parts that can be used lo restrict nevess to computer hardware (including, but not limited to, physical keys and locks). & "Computer software,” as used herein, is digital information which can be interpreted by a computer and any of its related components to ditect the way they work, Computer software is stored in electronio, magnetic, or other digital form. It commonly includes programs to run operating systems, applications, and uti LMM?h, "Computer related documentation,” as used herein, consists of written, recorded, printed, or electronically stored material which explains or illustrates how to configure ‘or use computer hardware, computer softwato, or other related items, 1. "Computer passwords and data security devices," as used herein, consist of information or items designed to restrict access to or hide computer software, documentation, or data, Data security devices may consist of hardware, softwate, or other programming code. A password (a string of alpha numerie characters) usually operates a sort of digital key to "unlock" particular data security devices, Data security hardware may include encryption devices, chips, and circuit boards, Data security software of digital code may include progeamming code thet creates "test" keys or *hot" keys, which perform certain pre-set security functions when touched, Data security software or code may also encrypt, compress, hide, or "booby trap" protected data to make it inaccessible or unusable, as well as reverse the progress to restore it, J. "Intemet Protocol address" or "IP address" refers to a unique number vsed by a computer to access the Internet, ‘Traditionally, IP addresses were either dynamic, meaning an Internet service provider (ISP) assigns a different unique number to a computer every time it accesses the Infemet, or static, meaning an ISP assigns a user's computer a particular IP address ‘which is used each time the computer accesses the Internet, Generally, the static IP addresses were assigned by those companies who offered "broadband!" Intemet service, such as through cable or digital subscriber line (DSL), whereas "dial-up" companies would assign their dynamic addresses, Now, however, as a greater number of American Internet users choose broadband Internet service, many of these users are being assigned what may be colloquially referred to as a "sticky dynamic IP address" or a "sticky IP." A sticky IP is a dynamically assigned IP address fenthat does not change often, ‘The address leases are usually set to long periods and simply renewed upon expiration. ‘The practical effect is that one may observe a user being assigned the same IP address for weeks or months and then assigned another IP address for a similar stretch of time, k, The terms "records," "documents," and "materials," as used herein, include all information recorded in any form, visual or aural, and by any means, whether in handmade ings, drawings, paintings), photographic form (inoluding, form (including, but not limited to, » bat not limited to, microfilm, microfiche, prints, slides, negatives, videotapes, motion pictures, photocopies), mechanical form (Ineluding, but not limited to, phonograph records, printing, typing) or clecttical, electronic or magnetic form (ineluding, but not limited to, tape recordings, cassettes, electtonic or magnetic storage devices such as floppy diskettes, hard disks, compact discs (CDs), digital versatile disks (DVDs), Personal Digital Assistants (PDAs), Multi Media Catdls (MMCs), memory sticks, optical disks, printer buffers, smart cards, memory calculators, electronic dialers, or eleottonie notebooks, as well as digital data files and printouts or readouts from any magnetic, electrical or electronic storage device). 1. The ferms "jpeg," "ips." "gif," "bmp," and “art” are examples of file extensions associated with graphic image files, m, The terms "mpeg," "mpg," "moy," "avi, "im," and "wmv" are examples of file oxtensions associated with video image files. ‘To use these video files, one needs a personal computer with sufficient processor speed, internal memory, and hard disk space to handle and play typically large video files, One also needs a video file viewer or client software that plays video files, One can download shareware or commercial video players from numerous sites onthe Internet, YUND_ON COMPUTERS AND CHILD PORNOGRAPHY 8 Computers and computer technology have revolutionized the way in which BACK‘ individuals interested in child pornography interact with each other, Child pomography formerly ‘vas produced using cameras and film (either stl! photography or movies), ‘The photographs requited darkroom facilities and a significant amount of skill in order to develop and reproduce the images. ‘There were definable costs involved with tho production of pornographie images. ‘To distributo these on any seale requied significant resourees, ‘The photographs themselyes were somewhat bulky and required secure storage to prevent their exposure to the public, The distribution of these wares was accomplished through a combination of personal contacts, railings and telephone calls. Now, computers basically serve four functions in connection with child pornography: production, communication, distribution, and storage. 9, Chile pomographers can now transfer photographs from a camera anto a computer readable format with 2 device known as a scanner, Also, with the advent of digital cameras, images can be transferred directly onto a computer. A device known as a modem allows any computer to connect to another computer through the use of telephone, cable, or \witeless connection, With a computer and modem, electronic contact can be made to literally millions of computers around the world, 10. ‘The computer's ability to store images in digital form makes the computer itself an ideal repository for ehild pornography, ‘The capacity of the electronic storage media (usually a type of hard drive) used in or with home computers has grown tremendously within the last several yeats, ‘These drives can now store in a relatively small deviee thousands of images at ren?very high resolution, Further, these drives ean, at times, be removed and stored separately from the central processing unit, 1]. The Internet and World Wide Web afford collectors of child pornography several different venues for obtaining, viewing and trading child pornography in a relatively secure and anonymous fashion, 12, Collectors and distributors of child pomographyy also use online resources to retviove and store child pornography, including services offered via the Internet such as Yahoo! count with a remote and Hotmail, among others, The online services allow a user to set up an computing service that provides electronic mail (e-mail) services as well as electronic storage of ‘computer files in a voviety of formats, A user can set up an online storage account from any computer with access to the Internet, ‘Thus, child pornography can be stored either on a user's computer or in a user's online account, However, even in cases where online storage is used, evidence of child pornography can be found on the user's computer in most cases. 13, Asis the case with most digital technology, communications by way of computer can be saved or stored on the computer used for these purposes. Storing this information can be . by saving an e-mail as a file on the computer or saving the location of one's intentional, Digital information can also be retained favorite websites in, for example, "bookmarked" files. unintentionally, e.g, traces of the path of an electronic communication may be automatically stored! in many places (e-g,, femporaty files or ISP elient software, among others), Tn addition to electronic communications, a computer user's Internet activities generally leave traces or footprints" in the web cache and history fites of the browser used, 14, A growing phenomenon on the Internet is peer-to-peer (P2P) file sharing. P2P wenofile sharing is a method of communication and data transfer available to computer users through the use of special software and the Internet. A forensic examiner often can recover evidence suggesting whether a computer contains peer to peer softwere, whether the computer has or had 1g ot downloading, and some or all of the files which were available for files available for shat shaving or downloading, Such information is often maintained indefinitely until overwritten by other data, 15, Computers using P2P software are linked together via the Internet and form a network that allows for the shacing of digital files between users on a network, stich as the Gnutella network, First, a user obtains the P2P software, usually by downloading it from the internet, In general, P2P software allows a user to choose which files on their computer, if any, will be made available for sharing with others running compatible P2P software. Also, the user ‘computer to receive downloaded files they select from others who have sets up space on th files available for shating, A user obtains files by opening the P2P software on their computer and using it to conduet a search for files that are cunrently available from others on the network, Files can only be shaved when both the source computer and downloading computer are connected to the Internet. Fuether, P2P software typically informs a user when their files have been selected and are being downloaded by another user. 16, One ofthe advantages of P2P file sharing is that multiple files may be downloaded in parallel, meaning that a user ean download more than one file at a time, In addition, a user may download parts of a single file from more than one source computer at a time, Por example, a user downloading an image file may actually receive parts ofthe image from multiple computers. ‘The advantage of this is that it reduces the time it takes to download Perethe file. 17, AP2P fite transfer is assisted by reference to an IP address. As was explained previously, this address, expressed as a series of four numbers each between 0 and 255, separated by decimal points, is unique to a particular computer during an online session, In the case of 2 unique location for the source computer and one for the P2P, the IP address identi downloading computer and makes it possible for complete files to be transferred between the two computers. 18, Third party software is available to identify the IP addvess of the P2P computer sonding the file, Such software monitors and logs Internet and local network traffic, VORENSIC ANALYSIS OF COMPUTERS AND ELECTRONIC DATA 19. The analysis of electronically stored deta, whether performed on-site or in a laboratory or other controlled environment, may entail any or all of several different techniques, Such techniques may inelude, but shall not be limited to, surveying the file directories ancl any individual files they contain (analogous to looking at the outside of file cabinet for the markings it contains and opening a drawer capable of containing pertinent files, in order to locate the evidence authorized for seizure by the warrant); conducting a file by file review of the data; examining all the structured, unstructured, deleted, and fice space data on a patticular piece of media; opening or reading the first few pages of each file in order to determine their precise contents; scanning storage areas to discover and possibly recover deleted data; scanning storage areas for deliberately hidden files; and performing electronic key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage aceas exist that are related to the subject matter of the investigation, 10 fw20, Computer files or remnants of such files can be recovered months or even years after they have been downloaded onto « had drive, deleted, or simply viewed via the Internet Blecttonic files downloaded to a hard drive or other media can be stored for years at little to no cost. Even when such files have been deleted, they can be recovered months or yeats later using readily-available forensic tools, When a person "deletes" a file on a home computer, the data contained in the file does not actually disappear; rather, that data remains on the hard drive until itis overwritten by new data, ‘Therefore, deleted files, or remnants of deleted files, may reside in ‘tee space or slack space - that is, in space on the hard drive that is not allocated to an active file or that is unused after a file has been allocated to @ set block of storage space for long petiods of time before they are overwiitten, 21, In eddition, « computer's operating system may also keep a record of deleted data ina "swap" or "recovery" file, Similarly, files that have been viewed via the Intemet are automatically downloaded into a temporary Intemet directory or eache. The browser typically maintains a fixed amount of hard drive space devoted to these files, and the files are only overwritten as they are replaced with more recently viewed Internet pages. Thus, the ability to retrieve residue of an electronic file from a hard drive depends Jess on when the file was downloaded or viewed than on a particular user's operating system, storage capacity, and computer habits, As noted, it is not at all uncommon to recover files deleted months or years before, CHILD PORNOGRAPHY COLLECTOR CHARACTERISTICS ig and experience, es well as from information provided to 22, Based upon my trai me by other Agents involved in the investigation of cases involving the sexual exploitation of u Peeve,children, I believe the following traits and characteristics are generally found to exist and be true in cases involving individuals who collect child pomograp! a, ‘The majority of individuals who collect child pornography are persons who have a sexual attraction to children, They receive sexual gratification and satisfaction from sexual fantasies fucled by depictions of children that are sexual in nature, b, ‘The majority of individuals who collect child pornography collect sexually explicit matetials, which may consist of photographs, magazines, motion pictures, video tapes, books, slides, computer graphics or digital or other images for their own sexual gratification, “The majority of these individuals also collect child erotica, which may consist of images or text that do not tise to the level of child pornography but which nonetheless fuel their deviant sexual fantasies involving children, c. The majority of individuals who collect child pornography often seek out like minded individuals, either in person or over the Internet, to share information and trade depictions of child pornography and child erotica as a means of gaining status, trust, acceptance and support, ‘The different Internet based vehicles used by such individuals to communicate with ‘each other inelude, but are not limited to; P2P, e-mail, e-mail groups, bulletin boards, Intemet Relay Chat (IRC), newsgroups, instant messaging, and other similar vehicles, 4, The majority of individuals who collect child pornography rarely, ifever, dispose of their sexually explicit materials and may go to great lengths to conceal and protect materials, They almost always from discovery, theft, and damage their collections of ill private and secure locations such as their homes, maintain their colle 12 PODBACKGROUND OF THE INVESTIGATION 23, ‘That on March 1, 2011, at epproximately 1350 hous, I was conducting an undercover investigation into the sharing of child pomography over the Internet, I used a publicly available version of a p2p file sharing program and had previously fiiended a user ‘identified by the screenname] had established several main folders, one of which was named ‘This folder was not password protected and contained approximately ten image files of male children who appeared to be under the age of sixteen years old, ‘The children were naked from above the waist, had several other folders labeled as containing pictures and videos that ‘wore password protected, provided me with the pessword thus granting me access to the password protected folders, I viewed the contents ofthe password protected folders and observed images of suspected child pornography and videos with file names similar to the names of files that I have seen in past investigations and that have portrayed child pornography. ‘The image files were saved into sub folders, many of which were labeled with terms used to describe child pornography, 24, On Match 11, 2011, ftom approximately 1410 hours BST and 1415 hours EST, | downloaded five (5) image files of suspected child pornography from the p2p account associated with the user name 25. — Lused a publicly available network protocol analyzer program and determined that the files were being downloaded from a computer assigned the IP address Listed below are the file names and descriptions of some of the downloaded files 26, ‘The following are descriptions of a selection of those files: 13 fet?‘This image file depicts a male child who a ile Name: 11111 jpg, Deseripto appears to be between the ages of 1 and 3 years old, The penis of what appears to be an adult male is inserted into the male child's anus. his image file depicts « male child b, File Name: 0010n-013_2.jpg. Deseripti ‘who appears to be between the ages of 3 and 6 years old, ‘The child is naked from below the waist, and the penis of what appears fo be an adult mnale is pressed against the child's anus, «, File Name: “* Description: This imago flo depicts « naked male child who appears to be between the ages of 11 and 14 years old. ‘The child is kneeling on @ bed, and his legs are spread, exposing his penis in @Inscivious manner. shots of the images described above are made available for the Copies of Coutt’s review and were labeled as Attachment A to this Affidavit, ‘The images will remain in a sealed envelope readily identified as Attachment A and with the Court’s permission, will be retained in the custody of the affiant until further order of the Court, 27, Additionally on or about March 21, 2011, I downloaded additional images I believe to be child pornography from at the same IP address, I subsequently submitted an ex- parte order to determine the subscriber associated with this IP address on this date and time, but hhave not yet received a response, At this time, I was also able to view several sub-folders in “pics folder.” I noted that there were approximately 317 sub-folders available for ? viewing in _pic folders, These sub folders were named, inter aia, “6-10yo boys pies,” “LLyr old holefull”, “12y0 big dick,” “13 yo Boy Fitin Body,” “12yr old American boy circumcised,” and “little pubes full.” Although I did not download files from these sub folders, they appeared to contain pictures. 428, I believe that these files demonstrate that the individual utilizing the username was actively involved in the possession and distribution of child pornogcaphy during March, 2011 29, On March 11, 2011, Iconducted a query that revealed that IP address is registered to Cox Communeations and is located in Suffield Connecticut, 30. On March 14, 2011, 1 submitted an Ex Parte order to GA 7 Meriden Superior Court requesting that Cox Communications provide the busic subscriber information associated with the user of IP address on March 11, 2011, from 1410 hours EST to 1415 hours EST, The order was signed by Judge McNamara and was then faxed to Cox Communications, On March 30, 2011, I received a response to the Ex Parte order from Cox Communications, Cox ‘Communications reported that the subscriber assigned IP address ‘on March LI, 2011, from 1410 hours EST to 1415 hours EST was of in West Suffield, CT. On March 31, 2011, { accessed the Vision Appraisal real estate database utilized by the town of Suffield assessor's department and conducted a search by address. ‘The owner of record for | wes listed as 31, On Mareh 31, 2011, I condueted a COLLECT query for and was unable to locate any results associated with in with an address of in However, I was able to locate @ ‘On April 1, 2011, I received a faxed report from the Central Criminal Intelligence Unit (CCIU), ‘The report listed several last names for , including Bourque. Her address was confirmed as in ‘The CCIU report also 15 erelisted David Bourque, and another individual as residing at the residence, On April 1, 2011, 1 received a fax from the United States Postal Inspection Service, which confirmed that David Bourque receives mail at in 32. On April 8, 2011, Judge Mulcahy issued a state search and seizure warrant for the Bourque residence, 33, On April 10, 2011, at epproximately 2040 hours, {received a phono call from SA. Wines of the FBI. SA Wines advised thatthe suspect in this investigation, was online at the time of he call using the p2p software. He advised that he downloaded several files of child crotica from this user, and the IP address that was captured was «which was the same IP address captured during the download sessions conducted previously, SA Wines also advised that there wore thousands of videos and image files labeled as suspected child pomography in folders. 34, On April 11, 2011, the state search warrant was executed at the residence located at in ‘That during tlie search of the residenee, a box for a Dell laptop computer was located, ‘The laptop was shipped to David Bourque in February of 2010. SA Wines of the PBI informed me that the service tag for the laptop computer was 35, On April 11, 2011, members of the Connecticut State Police met with Chief David Watkins of the Granby Police Department. They advised Chief Watkins of the details of this xd consent to search the computers owned by the town of Granby that case, Chief Watkins pro’ were located inside of Bourque's office, Once inside of Bourque's office, I noticed several 16additional computers and an external hard drive located in Bourque's office, T also noticed a brown satchel type brief ease located next to a commer in the office, ‘The cover was open, and it ‘was unzipped, I noticed whet appeared to be a laptop computer located inside of the satchel, I removed the laptop fiom the satchel to determine if the Dell laptop computer belonged to the town of Granby, Tnoted that the service tag on the Dell laptop computer was Which , Bourque identified this Dell laptop is the same as the box located in Bourque's residen computer and several other items, ineluding an external hard drive, as his personal property, Bourque refused fo give consent to preview the Dell laptop computer. | interviewed Bourque in ‘a conference room at the police station and advised Bourque of his constitutional rights, which he waived. Bourque advised that he and his wife are the only ones who permanently reside at in Bourque informed the Connecticut State Police that the ted data storage devices were encrypted. ‘computers and its asso« 36, A state search warrant was issued for the computers discovered in Bourque’s office. During the search of Bourque’s office, officers discovered two documents unrelated to the written by hand on the document, distvibution of child pornography that contained Subsequent analysis revealed that some of the computers and data storage devices were encrypted, On one of the unencrypted storage devices, [found an omuil received by Bourque related to the p2p network discussed above. [also discovered a compressed file that contained several images that I believe based on my training and experience are child pornography. On the computer that was seized from Bourque’s desk, Located approximately five (5) image files of ld pornography. These image files were deleted temporary internet files, what I believe to be cl Shortly after the searches were conducted, Bourque was taken to the hospital and admitted into 7 fernthe ICU unit, 37, On Apsil 20, 2011, Bourque agreed to meet with the Connecticut State Police and the FBI. Bourque was cooperative with the law enforcement agents and provided them with the passwords required to aceess his accounts. 38, In the last twenty-four hours, T and other officers have been able to conduct a very brief examination of Bourque’s hard drive and discovered that it appears to contain thousands and thousends-- pethaps as many as 100,000 — images and videos of child pomography, mostly depicting young boys. For exemple, f viewed a file labeled img.2003011602195717268826l,jpeg that depicts a child that appeats to be less than a year old performing oral sex on an adult male, ‘This image was stored in a folder labeled “photos - babies = men,” 18 meowCONCLUSION 39, Based upon al of the information set forth in this application, your affiant respectfully submits that there is probable cause to believe, and I do believe, that David L, Bourque has violated 18 U.S.C. § 2252A(@)(5)(B) relating to the possession of child pomography. I therefore request that this Court authorize a criminal complaint and arrest warrant which alleges the foregoing criminal violation Ee Cc Z ee *FY7 ‘frooper Jonathan Carreiro Connecticut State Police : 7 is? a i Subseribed and Sworn to before me this @1” day of April, 2011 fascia eet Holerablle Joan Margolis United States Magistrate Judge