AFFIDAVIT I, Ricardo J. Rodriguez, being duly sworn, do hereby depose and state: I. 1.

INTRODUCTION

I have been employed as a federal law enforcement Since October of 2008, I

officer for approximately three years.

have been employed as a Special Agent (SA) with the Department of Homeland Security (DHS), United States Immigration and Customs Enforcement (ICE), Homeland Security Investigations (HSI), and am presently assigned to the Office of the Special Agent in Charge, Los Angeles, California (SAC/LA). I am currently assigned to the SAC/LA Child Exploitation Investigations Group (CEIG), where I have investigated and assisted other agents in investigations involving various child exploitation and child pornography offenses. During the

investigation of these cases, I have participated in the execution of several search warrants and seized evidence of such violations. I have successfully completed the 12-week ICE

Special Agent Training Program at the Federal Law Enforcement Training Center. In this program I learned about, and was

evaluated on, a number of investigative techniques and subjects including computer crimes and child pornography. Since then, I

have received additional training related to investigating

crimes involving the sexual exploitation of children. II. 2. PURPOSE OF AFFIDAVIT

This affidavit is made in support of an application

for a warrant to search the premises located at 2030 Liliano Drive, Sierra Madre, CA 91024 (the SUBJECT PREMISES), which is more specifically described below, for evidence of violations of Title 18, United States Code, Sections 2252A(a)(1) (transportation of child pornography), 2252A(a)(2)(A) (receipt of child pornography), and 2252A(a)(5)(B) (possession of child pornography). 3. The statements contained in this affidavit are based

upon my personal observations and training and, where noted, information related to me by other law enforcement officials and witnesses. Because this affidavit is being submitted for the

limited purpose of securing a search warrant, I have not included each and every fact known to me concerning this investigation. I have only set forth facts that I believe are

necessary to establish probable cause to believe that evidence of violations of Title 18, United States Code, Sections 2252A(a)(1), 2252A(a)(2)(A), and 2252A(a)(5)(B), is presently located at the SUBJECT PREMISES. III. PREMISES TO BE SEARCHED 4. The SUBJECT PREMISES is the property located at 2030

Liliano Drive, Sierra Madre, CA 91024 (the SUBJECT PREMIESS). 2

The SUBJECT PREMISES is further described as a two-story single family residence, with brown wood sidings and a brown composition-style roof. The front doors are light brown and

face west with four-inch metal numbers 2030 attached to the wood to the left of the front door. The numbers 2030 are also Parked

painted on the curb adjacent to the driveway entrance.

on the property in front of the front door is a 2003 red Hyundai four-door vehicle with personalized California license plate PIPER2B registered to Robert MATHESON at the SUBJECT PREMISES. The SUBJECT PREMISES includes all structures on the property, including any storage areas and parking spaces specifically assigned to 2030 Liliano Drive, Sierra Madre, CA 91024. IV. 5. SUMMARY

On or about October 19, 2011, HSI Attach Ottawa

received a report from Officer Paul Smith of the Royal Canadian Mounted Police (RCMP), Nova Scotia, Canada. RCMP Officer

Smith reported the arrest of Robert MATHESON (DOB: 12/16/1944), a U.S. citizen and resident of Sierra Madre, CA, on or about October 18, 2011, for suspicion of possession and importation of child pornography to Canada. A forensic analysis of the laptop

computer that MATHESON brought to Canada revealed over 2,000 images and videos of child pornography. During an interview

with Canadian law enforcement, MATHESON admitted knowledge of 3

the images and videos on his computer and stated that he has another MAC desktop computer which he uses as his primary computer at the SUJECT PREMISES. On or about December 14, 2011, MATHESON pleaded guilty in Canada to smuggling, for which he was sentenced to a total of 108 days imprisonment (120 days with credit for 12 days timeserved). According to neighbors of MATHESON, until very

recently, there had been no activity at the SUBJECT PREMISES; however, during the week of December 12, 2011, an article detailing MATHESONs arrest and prosecution in Canada appeared in a Canadian newspaper and since then, there has been a flurry of activity at the SUBJECT PREMISES, including as recently as December 15, 2011. V. A. BACKGROUND

Child Exploitation Offenses, Computers, and the Worldwide Internet Computer Communication Network 6. The terms minor, sexually explicit conduct,

visual depiction, producing, and child pornography are defined as set forth in Title 18, United States Code, Section, 2256. 7. Computers and Child Pornography. Based on my training

and experience, and the experience of other law enforcement officers with whom I have communicated, I know that computers and computer technology have revolutionized the way in which

individuals interested in child pornography interact with each other. Child pornography formerly was produced using cameras The photographs

and film (either still photography or movies).

required darkroom facilities and a significant amount of skill in order to develop and reproduce the images. There were

definable costs involved with the production of pornographic images. To distribute these images on any scale required The photographs themselves were somewhat

significant resources.

bulky and required secure storage to prevent their exposure to the public. The distribution of these wares was accomplished through a combination of personal contacts, mailings, and telephone calls. 8. The development of computers has changed this;

computers serve four basic functions in connection with child pornography: production, communication, distribution, and storage. 9. Child pornographers can now transfer photographs from

a camera onto a computer-readable format with a device known as a scanner. With the advent of digital cameras, the images can A device known as

now be transferred directly onto a computer.

a modem allows any computer to connect to another computer through the use of telephone, cable, or wireless connection. Electronic contact can be made to literally millions of computers around the world. 5

10.

The computers ability to store images in digital form

makes the computer itself an ideal repository for child pornography. The size of the electronic storage media (commonly

referred to as the hard drive) used in home computers has grown tremendously within the last several years. These drives can

store hundreds of thousands of images at very high resolution. 11. Internet. The Internet is a collection of computers

and computer networks which are connected to one another via high-speed data links and telephone lines for the purpose of communicating and sharing data and information. Connections

between Internet computers exist across state and international borders; therefore, information sent between two computers connected to the Internet frequently crosses state and international borders even when the two computers are located in the same state. 12. Internet Service Providers. Any individuals and

businesses obtain access to the Internet through businesses known as Internet Service Providers (ISPs). a. ISPs:

Provide their customers with access to the

Internet using telephone or other telecommunications lines; b. Provide Internet e-mail accounts that allow users

to communicate with other Internet users by sending and receiving electronic messages through the ISPs servers; c. Remotely store electronic files on their 6

customers behalf; and

d.

May provide other services unique to each

particular ISP. 13. ISPs maintain records pertaining to the individuals or Those

businesses that have subscriber accounts with them.

records often include identifying and billing information, account access information in the form of log files, e-mail transaction information, posting information, account application information, and other information both in computer data and written record format. 14. IP Addresses. An Internet Protocol address (IP

address) is a unique numeric address used by each computer on the Internet. An IP address is a series of four numbers, each

in the range 0-255, separated by periods (e.g., 121.56.97.178). Every computer attached to the Internet must be assigned an IP address so that Internet traffic sent from and directed to that computer may be properly directed from its source to its destination. 15. Most ISPs control a range of IP addresses.

When a customer logs into the Internet using the

service of an ISP, the computer used by the customer is assigned an IP address by the ISP. The customers computer retains that

IP address for the duration of that session (i.e., until the user disconnects), and the IP address cannot be assigned to 7

another user during that period.

VI. 16.

PROBABLE CAUSE

On or about October 18, 2011, Robert MATHESON (DOB:

12/16/1944), a U.S. citizen and resident of Sierra Madre, CA, was arrested at the Canadian border for suspicion of possession and importation of child pornography to Canada. During a border

search, Canadian law enforcement found several images of suspected child pornography on MATHESONs laptop computer. Based on my review of various Canadian Border Services Agency (CBSA) reports regarding MATHESONs arrest, I have learned the following: a. Following his arrest, MATHESON was interviewed by Prior to the

CBSA Criminal Investigator Jason Cannon.

interview, MATHESON was read a statement of rights by Investigator Cannon and given an opportunity to consult with the U.S. Consulate. i. MATHESON consented to be interviewed. During the initial questioning, MATHESON MATHESON was

stated that he was visiting Canada for 10 days.

travelling with another male (later identified as Matt Greek, 28 years old, who returned to California on or about October 25, 2011), whose ticket was paid for by MATHESON. ii. MATHESON admitted ownership of the laptop

computer, that he had it for seven years, and that he was not 8

aware of anyone else that would have his password.

iii. MATHESON stated that he also owns a MAC desktop computer which he uses as his primary computer when at the SUJECT PREMISES. iv. MATHESON stated that he knew material on his

laptop was prohibited, but he had just not got around to deleting it. MATHESON also claimed that the last time he

searched for child pornography was two to three years ago. MATHESON further stated that at one time, he found the types of images on his computer to be a novelty and that as long as the boys were not under duress, images of boys engaged in sex is acceptable. v. MATHESON also advised that photography is

one of his hobbies and he saves copies of the photographs he takes on his computer as well as on CDs. b. On or about October 18, 2011, Investigator Cannon

began a forensic examination of MATHESONs laptop computer and found approximately 2,820 images, approximately 90% of which consisted of what appeared to be teenage males engaged in sexually explicit activity. Investigator Cannon also found

approximately 285 videos of what appeared to be teenage males engaged in sexually explicit activity (approximately 20% of the video titles reference young or twink or boy). 9 According

to the forensic examination report, the file creation dates for these images and videos range from April 2009 through May 2011. i. Investigator Cannon also found five text

stories regarding the sexual abuse of a ten-year-old boy by adult males, including a member of the boys family. These

stories came from the website www.nifty.org with access to this website taking place as recently as June 2011. ii. Between October 18, 2011 and October 20,

2011, Investigator Cannon continued the forensic examination of MATHESONs laptop computer and found additional stories involving child sexual exploitation. All of these stories,

including the five found during the initial forensic examination, appeared to be downloaded from the internet and were saved in a file labeled nifty. Some of the stories bear

titles such as my-bro-fucks-my-son and describe in graphic detail the sexual assault of boys as young as 10 years old being sexually assaulted by fathers. Moreover, forensic analysis of

MATHESONS laptop showed that he actively sought out these files by navigating to the www.nifty.org website and sorting through various headings to identify files he wanted, including stories which involved the molestation a ten-year-old boy by his father, uncle, and grandfather.1

During his interview with Canadian law enforcement, MATHESON advised that he has a nephew of his own whom he looks after on
1

10

iii. Investigator Cannon also found several instant messaging chats on MATHESONs laptop computer which, in summary, indicate MATHESONs wish to find a young man who could pass as his son or grandson and his belief that it would be an honor and privilege to guide and teach young boys through puberty. 17. On or about December 5, 2011, I examined the following

files which were found on MATHESONs laptop computer in Canada: a. A video file titled BonerTube Hot Teen Twinks

Better than YouPorn and RedTube[166052].flv which is approximately 1 minute and 23 seconds long and depicts a nude male between the ages of 13 and 16 and a young adult male in a room containing a bed with yellow bedding. The video begins

with the young adult male performing oral sex on the teenage boy, then transitions to the adult male repeatedly thrusting his penis into the mouth of the teenage boy. b. An image file titled AMF1905.jpg which depicts

two nude males between the ages of 13 and 16 in a wooded area. The only clothing worn by both boys are shoes; one boy is wearing dress shoes and the other boy is wearing sandals. younger of the two boys is on his hands and knees appearing distressed as he is being anally penetrated by the older boy. c. occasion. 11 An image file titled AMV1905 which depicts two The

nude males near a wooden chair with a gold and blue patterned seat covering. One male (indeterminate age because this males

upper body and face is cropped out of the image) is seated on the chair with his genitals in the center of the image. The

second male between the ages of 13 and 16 is performing oral sex on the first male seated on the chair. 18. On or about October 25, 2011, Matthew Greek returned As noted above, Greek was MATHESONs travel

to California.

companion when MATHESON was arrested by Canadian law enforcement. At the time of MATHESONs arrest, Greek was

interviewed by the CBSA during which CBSA advised Greek of the charges against MATHESON. During the interview, Greek advised

that he has been friends with MATHESON for approximately 10 years and that they met over the internet when Greek was approximately 18 years old. Greek also advised that he has

visited the SUBJECT PREMISES on several occasions prior to October 18, 2011, and knew of the MAC desktop computer located at the SUBJECT PREMISES. I do not have any information as to

whether Greek has access to the SUBJECT PREMISES now or whether he has been to the SUBJECT PREMISES since his return to California on or about October 25, 2011. 19. On or about December 2, 2011, ICE Criminal Research

Specialist Nancy Bravo conducted the following checks: a. on the publicly available database CLEAR, which 12

is an investigative platform operated by Thomson Reuters with access to public and proprietary records, for information

13

pertaining to Robert William MATHESON with his date of birth. The address returned was the SUBJECT PREMISES; and b. with the California Department of Motor Vehicles.

The address associated with MATHESONs drivers license is the SUBJECT PREMISES.2 20. On or about December 12, 2011, Verizon provided me

with records indicating that MATHESON has been receiving internet service at the SUBJECT PREMISES since February 3, 2010. 21. I believe that there is probable cause to believe that First, MATHESONs laptop

MATHESON collects child pornography.

computer has been confirmed to contain numerous images and videos that depict child pornography, some of which contain file creation dates as recently as May 2011. Second, MATHESONs

laptop computer also contained several stories expounding on the sexual exploitation of minors via incest and other means. Child pornography is clearly illegal, yet MATHESON so desired access to this material and stories related to child exploitation that he engaged in the high-risk behavior of traveling internationally with said contraband. a. Based on my previous investigative experience

related to child pornography investigations, as well as the extensive investigative experience of other special agents with

MATHESON also gave the SUBJECT PREMISES to Delta Airlines as his home address.
2

14

whom I have consulted, I have learned that individuals who visit websites offering access to child pornography and related stories of exploitation are often individuals who have a sexual interest in children and in images of children, and who download images and videos of child pornography. Based upon my

knowledge, experience, and training in child pornography investigations, and the training and experience of other law enforcement officers with whom I have had discussions, there are certain characteristics common to individuals involved in the receipt and collection of child pornography: (1) Individuals who have a sexual interest in

children or images of children may receive sexual gratification, stimulation, and satisfaction from contact with children; or from fantasies they may have viewing children engaged in sexual activity or in sexually suggestive poses, such as in person, in photographs, or other visual media; or from literature describing such activity. (2) Individuals who have a sexual interest in

children or images of children may collect sexually explicit or suggestive materials in a variety of media, including photographs, magazines, motion pictures, videotapes, books, slides and/or drawings or other visual media. Individuals who

have a sexual interest in children or images of children oftentimes use these materials for their own sexual arousal and 15

gratification.

Further, they may use these materials to lower

the inhibitions of children they are attempting to seduce, to arouse the selected child partner, or to demonstrate the desired sexual acts. (3) Individuals who have a sexual interest in

children or images of children often possess and maintain their collections that are in a digital or electronic format in a safe, secure and private environment, such as a computer and surrounding area. These collections are often maintained for

several years and are kept close by to enable the individual to view the collection, which is valued highly. (4) Individuals who have a sexual interest in

children or images of children also may correspond with and/or meet others to share information and materials; rarely destroy correspondence from other child pornography distributors/ collectors; conceal such correspondence as they do their sexually explicit material; and often maintain lists of names, addresses, and telephone numbers of individuals with whom they have been in contact and who share the same interests in child pornography. (5) Individuals who have a sexual interest in

children or images of children prefer not to be without their child pornography for any prolonged time period. This behavior

has been documented by law enforcement officers involved in the 16

investigation of child pornography throughout the world. b. Even if MATHESON used a computer located

elsewhere to access illegal child pornography, it is very likely that evidence of this access will be found at his home, particularly since by his own admission, MATHESON uses the MAC desktop computer located at the SUBJECT PREMISES as his primary computer when at home. is extremely mobile. Child pornography received via computer Through computer technology, digital files For example, with the

are easily reproduced and transported.

click of a button, images and videos containing child pornography can be put onto thumb drives so small they fit onto a keychain. Just as easily, these files can be copied onto

floppy disks or compact disks, stored on I-Pods, Blackberries, and cellular telephones. Because MATHESON likely collects and

values child pornography, which is easily-stored and duplicated, there is probable cause to believe that evidence of MATHESONs access, storage, and transmission of suspected child pornography will be found in the SUBJECT PREMISES. 22. Given the fact that MATHESONs laptop computer

contained image and video files depicting child pornography and that MATHESON transported it from Los Angeles, CA, to Canada, and that MATHESON stated he uses the MAC desktop computer located at the SUBJECT PREMISES as his primary computer when at home, there is probable cause to believe that at least one 17

computer at the SUBJECT PREMISES will contain child pornography.

VII. 23.

TRAINING AND EXPERIENCE ON DIGITAL DEVICES

As used below, the term digital device includes any

electronic system or device capable of storing and/or processing data in digital form, including: central processing units; laptop or notebook computers; personal digital assistants; wireless communication devices such as telephone paging devices, beepers, and mobile telephones; peripheral input/output devices such as keyboards, printers, scanners, plotters, monitors, and drives intended for removable media; related communications devices such as modems, cables, and connections; storage media such as hard disk drives, floppy disks, compact disks, magnetic tapes used to store digital data (excluding analog tapes such as VHS), and memory chips; and security devices. Based on my

knowledge, training, and experience, as well as information related to me by agents and others involved in the forensic examination of digital devices, I know that data in digital form can be stored on a variety of digital devices and that during the search of the premises it is not always possible to search digital devices for digital data for a number of reasons, including the following: a. Searching digital devices can be a highly

technical process that requires specific expertise and 18

specialized equipment.

There are so many types of digital

devices and software in use today that it is impossible to bring to the search site all of the necessary technical manuals and specialized equipment necessary to conduct a thorough search. In addition, it may also be necessary to consult with specially trained personnel who have specific expertise in the type of digital device, software application or operating system that is being searched. b. Digital data is particularly vulnerable to

inadvertent or intentional modification or destruction. Searching digital devices can require the use of precise, scientific procedures that are designed to maintain the integrity of digital data and to recover hidden, erased, compressed, encrypted or password-protected data. As a result,

a controlled environment, such as a law enforcement laboratory or similar facility, is essential to conducting a complete and accurate analysis of data stored on digital devices. c. The volume of data stored on many digital devices

will typically be so large that it will be highly impractical to search for data during the execution of the physical search of the premises. A single megabyte of storage space is the A single

equivalent of 500 double-spaced pages of text.

gigabyte of storage space, or 1,000 megabytes, is the equivalent of 500,000 double-spaced pages of text. 19 Storage devices capable

of storing 500 gigabytes (GB) of data are now commonplace in desktop computers. Consequently, each non-networked, desktop

computer found during a search can easily contain the equivalent of 240 million pages of data, that, if printed out, would completely fill three 35' x 35' x 10' rooms to the ceiling. Further, a 500 GB drive could contain as many as approximately 450 full run movies or 450,000 songs. d. Electronic files or remnants of such files can be

recovered months or even years after they have been downloaded onto a hard drive, deleted or viewed via the Internet. Electronic files saved to a hard drive can be stored for years with little or no cost. Even when such files have been deleted,

they can be recovered months or years later using readilyavailable forensics tools. Normally, when a person deletes a

file on a computer, the data contained in the file does not actually disappear; rather, that data remains on the hard drive until it is overwritten by new data. Therefore, deleted files,

or remnants of deleted files, may reside in free space or slack space, i.e., space on the hard drive that is not allocated to an active file or that is unused after a file has been allocated to a set block of storage space for long periods of time before they are overwritten. In addition, a computer's operating

system may also keep a record of deleted data in a swap or recovery file. Similarly, files that have been viewed via the 20

Internet are automatically downloaded into a temporary Internet directory or cache. The browser typically maintains a fixed

amount of hard drive space devoted to these files, and the files are only overwritten as they are replaced with more recently viewed Internet pages. Thus, the ability to retrieve residue of

an electronic file from a hard drive depends less on when the file was downloaded or viewed than on a particular user's operating system, storage capacity, and computer habits. Recovery of residue of electronic files from a hard drive requires specialized tools and a controlled laboratory environment. e. Although some of the records called for by this

warrant might be found in the form of user-generated documents (such as word processor, picture, and movie files), digital devices can contain other forms of electronic evidence as well. In particular, records of how a digital device has been used, what it has been used for, who has used it, and who has been responsible for creating or maintaining records, documents, programs, applications and materials contained on the digital devices are, as described further in the attachments, called for by this warrant. Those records will not always be found in

digital data that is neatly segregable from the hard drive image as a whole. Digital data on the hard drive not currently

associated with any file can provide evidence of a file that was 21

once on the hard drive but has since been deleted or edited, or of a deleted portion of a file (such as a paragraph that has been deleted from a word processing file). Virtual memory paging systems can leave digital data on the hard drive that show what tasks and processes on the computer were recently used. Web

browsers, e-mail programs, and chat programs store configuration data on the hard drive that can reveal information such as online nicknames and passwords. Operating systems can record

additional data, such as the attachment of peripherals, the attachment of USB flash storage devices, and the times the computer was in use. Computer file systems can record data about the dates files were created and the sequence in which they were created. This data can be evidence of a crime, indicate the

identity of the user of the digital device, or point toward the existence of evidence in other locations. Recovery of this data

requires specialized tools and a controlled laboratory environment. f. Further, evidence of how a digital device has

been used, what it has been used for, and who has used it, may be the absence of particular data on a digital device. For

example, to rebut a claim that the owner of a digital device was not responsible for a particular use because the device was being controlled remotely by malicious software, it may be necessary to show that malicious software that allows someone 22

else to control the digital device remotely is not present on the digital device. Evidence of the absence of particular data

on a digital device is not segregable from the digital device. Analysis of the digital device as a whole to demonstrate the absence of particular data requires specialized tools and a controlled laboratory environment. g. A review of the information on the digital

devices sought by this warrant will require an off-site review. This is because I expect the electronic evidence to be comingled with other data, and because it may be concealed in some way requiring extensive forensic review. In addition, in my

training and experience, and based on conversations with other law enforcement agents with extensive experience in child exploitation investigations, collectors of child pornography can store contraband on computers, external hard drives, compact discs, DVDs, and other digital storage media each one of which can contain a large amount of data, and with contraband being concealed by an innocuous filing system. There is simply no way

to search for child pornography without manually looking for image files and reviewing them. Finally, based on my training

and experience and given the nature of the offense, I can expect that the user would take some efforts to conceal his/her conduct particularly if he/she shares the computer with another user. It will take time to search the electronic data for the images 23

in question, as well as other circumstantial evidence of the criminal activity, such as computer logs, date and time information, registration information, e-mails, etc. If the

user has attempted to conceal his/her illegal activity by attempting to destroy or encrypt files, a forensic review for such files will need to be undertaken. h. The United States has not attempted to obtain

this data by other means. VIII. 24. ITEMS TO BE SEIZED

Based on the foregoing, I respectfully submit that

there is probable cause to believe that the following items, which constitute evidence of violations of Title 18, United States Code, Sections 2252A(a)(1), 2252A(a)(2)(A), and 2252A(a)(5)(B), will be found at the SUBJECT PREMISES: a. Child pornography, as defined in Title 18, United

States Code, Section 2256(8). b. Any records, documents, programs, applications,

or materials, including electronic mail and electronic messages, that refer to the possession, receipt, distribution, and/or reproduction of child pornography, as defined in Title 18, United States Code, Section 2256(8). c. Any records, documents, programs, applications,

or materials, including electronic mail and electronic messages, that relate to the viewing, sharing, purchasing, or downloading 24

25

of child pornography, as defined in Title 18, United States Code, Section 2256(8). d. Any records, documents, programs, applications,

or materials, including electronic mail and electronic messages, that refer or relate to any production, receipt, shipment, order, request, trade, purchase, or transaction of any kind involving the transmission through interstate or foreign commerce by any means, including by computer, of any visual depiction of a minor engaged in sexually explicit conduct, as defined in Title 18, United States Code, Section 2256. e. Any records, documents, programs, applications,

or materials, including electronic mail and electronic messages, identifying persons transmitting, in interstate commerce, including by computer, any visual depiction of a minor engaged in sexually explicit conduct, as defined in Title 18, United States Code, Section 2256. f. Any records, documents, programs, applications,

or materials, including electronic mail and electronic messages, that identify any minor visually depicted while engaging in sexually explicit conduct, as defined in Title 18, United States Code, Section 2256. g. Any and all records, documents, programs,

applications, materials, or items which are sexually arousing to individuals who are interested in minors, but which are not in 26

and of themselves obscene or which do not necessarily depict minors involved in sexually explicit conduct. Such material is

commonly known as child erotica and includes written materials dealing with child development, sex education, child pornography, sexual abuse of children, incest, child prostitution, missing children, investigative techniques of child exploitation, sexual disorders, pedophilia, nudist publications, diaries, and fantasy writings. h. Any records, documents, programs, applications,

or materials, including electronic mail and electronic messages, that pertain to accounts with any Internet Service Provider. i. Any records, documents, programs, applications,

or materials, including electronic mail and electronic messages, regarding ownership and/or possession of 2030 Liliano Drive, Sierra Madre, CA 91024 (the SUBJECT PREMISES). j. Any records, documents, programs, applications,

or materials, including electronic mail and electronic messages, regarding ownership and/or possession and/or use of any digital devices found in the SUBJECT PREMISES. k. Any computer, laptop, and/or digital device(s)

used to facilitate the above-listed violations and forensic copies thereof. l. With respect to any digital devices falling

within the scope of the foregoing search categories, or any 27

digital devices containing evidence falling within the scope of the foregoing search categories, records, documents, programs, applications or materials, or the absence of same, sufficient to show the actual user(s) of the digital device during the time period between April 2009 to the present. 25. As used above in paragraphs 24(a)-(l), the terms

records, documents, programs, applications or materials include records, documents, programs, applications or materials created, modified or stored in any form, including in digital form on any digital device and any forensic copies thereof. As used both

above and below, the term digital device includes any electronic system or device capable of storing and/or processing data in digital form, including: central processing units; laptop or notebook computers; personal digital assistants; wireless communication devices such as telephone paging devices, beepers, and mobile telephones; peripheral input/output devices such as keyboards, printers, scanners, plotters, monitors, and drives intended for removable media; related communications devices such as modems, cables, and connections; storage media such as hard disk drives, floppy disks, compact disks, magnetic tapes used to store digital data (excluding analog tapes such as VHS), and memory chips; and security devices. 26. In searching for digital devices and in searching

digital data stored on digital devices, law enforcement 28

personnel executing this search warrant will employ the following procedure: a. Law enforcement personnel or other individuals

assisting law enforcement personnel will, in their discretion, either search the digital device(s) on-site or seize and transport the device(s) to an appropriate law enforcement laboratory or similar facility to be searched at that location. The team of law enforcement personnel, which may include the investigating agent(s), and/or individuals assisting law enforcement personnel searching the digital device(s) shall complete the search as soon as is practicable but not to exceed 60 days from the date of execution of this warrant. If

additional time is needed, the government may seek an extension of this time period from the Court within the original 60 day period from the date of execution of the warrant. b. The team searching the digital devices will do so

only by using search protocols specifically chosen to identify only the specific items to be seized under this warrant. i. The team may subject all of the data

contained in the digital device capable of containing items to be seized as specified in this warrant to the protocols to determine whether the digital device and any data falls within the items to be seized as set forth herein. The team searching

the digital device may also search for and attempt to recover 29

deleted, hidden or encrypted data to determine, pursuant to the protocols, whether the data falls within the list of items to be seized as set forth herein. ii. The team searching the digital device also

may use tools to exclude normal operating system files and standard third-party software that do not need to be searched. For example, forensic hashing is the process of using a mathematical function, often called an algorithm, to generate a numerical identifier for data (such as a particular file). If

the data is changed, even very slightly (such as the addition or deletion of a comma or a period), the identifier should change. A hash value can be thought of as a digital fingerprint for data. The team searching digital devices in this case will also

use a hash set which contains the hash values of image and video files associated with identified victims of child pornography to determine whether these files are stored within the digital devices. Because this hash set is constantly

being updated as investigations result in the rescue of children depicted in child pornography images/videos, it will not contain the hash values of all currently identified images and video files. c. When searching a digital device pursuant to the

specific protocols selected, the team searching the digital

30

device shall make and retain notes regarding how the search was conducted pursuant to the selected protocols. d. If the team searching a digital device pursuant

to the selected protocols encounters immediately apparent contraband or other evidence of a crime outside the scope of the items to be seized, the team shall immediately discontinue its search of that digital device pending further order of Court and shall make and retain notes detailing how the contraband or other evidence of a crime was encountered , including how it was immediately apparent contraband or evidence of a crime. e. At the conclusion of the search of the digital

devices as set forth in subparagraph (a) above, any digital device determined to be itself an instrumentality of the offense(s) and all the data thereon shall be retained by the government until further order of court or one year after the conclusion of the criminal case/investigation. f. Notwithstanding the above, after the completion

of the search of the digital devices as set forth in subparagraph (a) above, the government shall not access digital data falling outside the scope of the items to be seized in this warrant on any retained digital devices or digital data absent further order of court. g. If the search team determines that a digital

device is not an instrumentality of any offense under 31

investigation and does not contain any data falling within the list of items to be seized pursuant to this warrant, the government will as soon as practicable return the digital device and delete or destroy all the forensic copies thereof. h. If the search determines that the digital device

or the forensic copy is not an instrumentality of the offense but does contain data falling within the list of the items to be seized pursuant to this warrant, the government either (i) within the time period authorized by the Court for completing the search, return to the Court for an order authorizing retention of the digital device and forensic copy; or (ii) retain only a copy of the data found to fall within the list of the items to be seized pursuant to this warrant and return the digital device and delete or destroy all the forensic copies thereof. 27. In order to search for data that is capable of being

read or interpreted by a digital device, law enforcement personnel are authorized to seize the following items, subject to the procedures set forth above: a. Any digital device capable of being used to

commit, further or store evidence of the offense listed above; b. Any equipment used to facilitate the

transmission, creation, display, encoding or storage of digital data, including word processing equipment, modems, docking 32

stations, monitors, printers, plotters, encryption devices and optical scanners; c. Any magnetic, electronic or optical storage

device capable of storing data, such as floppy disks, hard disks, tapes, CD-ROMs, CD-R, CD-RWs, DVDs, optical disks, printer or memory buffers, smart cards, PC cards, memory calculators, electronic dialers, electronic notebooks, cellular telephones and personal digital assistants; d. Any documentation, operating logs and reference

manuals regarding the operation of the digital device or software used in the digital device; e. Any applications, utility programs, compilers,

interpreters and other software used to facilitate direct or indirect communication with the digital device; f. Any physical keys, encryption devices, dongles

and similar physical items that are necessary to gain access to the digital device or data stored on the digital device; and g. Any passwords, password files, test keys,

encryption codes or other information necessary to access the digital device or data stored on the digital device. 28. The special procedures relating to digital media found

in this warrant govern only the search of digital media pursuant to the authority conferred by this warrant and do not apply to any search of digital media pursuant to any other court order. 33

IX. 29.

REQUEST FOR SERVICE AT ANY TIME OF THE DAY OR NIGHT Federal Rule of Criminal Procedure 41(e)(2)(a)(ii),

Title 21, United States Code, Section 879, and Gooding v. United States, 416 U.S. 430 (1974), allow a magistrate to authorize nighttime service for good cause. I believe good cause for

nighttime service exists for the following reasons: a. As discussed above, on or about December 14,

2011, an article detailing MATHESONs arrest and prosecution in Canada appeared in a Canadian newspaper. According to the Chief

of Police of the Sierra Madre Police Department, Marilyn Diaz, some of MATHESONs neighbors have reported that there has been increased activity at the SUBJECT PREMISES since the publication of the article. More specifically, on December 17, 2011, Chief

Diaz encountered two of MATHESONs neighbors who reported that there had been a flurry of activity at the SUBJECT PREMISES ever since the article about MATHESON appeared, including as recently as December 15, 2011, and there had been several people, some of whom were familiar at the SUBJECT PREMISES. Further, according to these neighbors, prior to the publication of the newspaper article, there had been no activity at the SUBJECT PREMISES for a long time. b. Concerned that potential evidence may be

destroyed and/or removed from the SUBJECT PREMISES, this afternoon, officers with the Sierra Madre Police Department 34

secured the SUBJECT PREMISES pending the issuance of a search warrant. c. Assuming that this search warrant is approved,

the search team will not be able to execute the warrant before 6:00PM and it is unlikely that the search will be completed before 10:00PM. Accordingly, authorization to execute this

warrant during the night time hours is sought in order to allow the search to be completed tonight. X. 30. CONCLUSION

Based on the foregoing, I believe there is probable

cause to believe that the items listed above and in Attachment B, which are evidence, fruits, and instrumentalities of violations of Title 18, United States Code, Sections 2252A(a)(1) (transportation of child pornography), 2252A(a)(2)(A) (receipt of child pornography), and 2252A(a)(5)(B) (possession of child pornography), will be found at the SUBJECT PREMISES described above and in Attachment A. __________________________________ Ricardo J. Rodriguez Special Agent Homeland Security Investigations Subscribed and sworn to before me this day of December, 2011. ______________________________ HON. PATRICK J. WALSH United States Magistrate Judge 35