Affidavit in Support of Criminal Complaint — Kendra M. Miller, Special Agent, HSI, Case 1:23-cr-10150-PBS (Dkt. 2-1, D. Mass.)

Summary

An affidavit of Kendra M. Miller, a Special Agent of Homeland Security Investigations in the Child Exploitation and Forensics Group in Boston, in support of a criminal complaint, filed May 3, 2023 as Document 2-1 in Case 1:23-cr-10150-PBS in the U.S. District Court for the District of Massachusetts. The affidavit supports a complaint charging Robert Miller of Beverly, Massachusetts with possession of child pornography in violation of 18 U.S.C. §§ 2252A(a)(5)(B) and (b)(2). The agent describes her training at the Federal Law Enforcement Training Center and her investigations of child exploitation offenses. The affidavit was sworn telephonically on May 3, 2023.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

Text recognized from a scanned document; may contain errors.

Case 1:23-cr-10150-PBS Document 2-1 Filed 05/03/23 Page 1of8
23-mj-8137-PGL

AFFIDAVIT IN SUPPORT OF CRIMINAL COMPLAINT

I, Kendra M. Miller, being duly sworn, depose and state as follows:

I am a Special Agent with the United States Department of Homeland Security,
Immigration and Customs Enforcement, Homeland Security Investigations (“HSI”). I have
been employed by HSI since March 2021 and I am currently assigned to the Office of the
Special Agent in Charge (“SAC”) New England in Boston, Massachusetts. I am assigned
to the Child Exploitation and Forensics Group. I am a graduate of the Federal Law
Enforcement Training Center in Glynco, Georgia where I received training to become a
federal agent; specifically, I received a certification in the Criminal Investigator Training
Program and the HSI Special Agent Training Program. As part of my duties, I am
authorized to investigate violations of the laws of the United States, including criminal
violations relating to child exploitation, child pornography, coercion and enticement, and
transportation of minors, including but not limited to, violations of 18 U.S.C. §§ 2422,
2423, 2251, and 2252A. I have conducted and participated in investigations of violations
of these statutes. I have also previously assisted in the execution of federal search warrants
in connection with these investigations. I have received training in the investigation of
child pornography, child exploitation, and transportation of minors, and have had the
opportunity to observe and review examples of child pornography as defined in 18 U.S.C.
§ 2256.

This affidavit is submitted in support of an application for a criminal complaint charging
Robert Miller (“MILLER”), year of birth 1964, of Beverly, Massachusetts, with a violation

of 18 U.S.C. §§ 2252A(a)(5)(B) and (b)(2) (Possession of Child Pornography).
Case 1:23-cr-10150-PBS Document 2-1 Filed 05/03/23 Page 2 of 8

3. The statements contained in this affidavit are based, in part, on information provided by
other law enforcement officials; written reports about this and other investigations that I
have received, directly or indirectly, from other law enforcement agents; review of records;
analysis by federal agents/analysts and computer forensics professionals; my review of
records; and my experience, training and background as a Special Agent with HSI. Because
this affidavit is being submitted for the limited purpose of establishing probable cause to
secure a criminal complaint, I have not included each and every fact known to me
concerning this investigation. I have set forth only the facts that I believe are necessary to
establish the requisite probable cause.

FEDERAL SEARCH WARRANTS

4. HSI began an investigation into a secure online chat platform, hereinafter referred to as
“Chat Application A.”! In review of Chat Application A’s website? and other law

enforcement resources, I have learned that Chat Application A is a communications-based
platform available on the internet to users worldwide. Service is offered through a web-
based application for Windows, Linux, and iOS operating systems, along with mobile
applications available for Android, and iOS operating systems. Chat Application A’s

services include instant messaging, voice calls, video calls, and file sharing capabilities.

' Law enforcement knows the actual name of Chat Application A. However, the investigation into
users of Chat Application A remains ongoing, and public disclosure of Chat Application A’s
actual name potentially would alert its members to the investigation and cause members to flee or
destroy evidence. Accordingly, to preserve the confidentiality and integrity of the ongoing
investigation, the actual name and other identifying details of Chat Application A remain
undisclosed in this affidavit.

* 1 know that Chat Application A updates its website content and informational blog posts often,
and the information set forth here is derived in part from information obtained from Chat
Application A’s website as of the date that this affidavit was drafted.

2
Case 1:23-cr-10150-PBS Document 2-1 Filed 05/03/23 Page 3 of 8

Chat Application A allows users to have personal, one-on-one chats, or to have larger scale
group chats with other Chat Application A users.

All Chat Application A chats are protected by end-to-end encryption, meaning that only
the sender and receiver(s) of a chat have access to the content, and nothing is stored on any
servers once delivered. Prior to delivery of transmitted content, or if the recipient’s phone
is off, the content is encrypted and stored on Chat Application A’s servers. If the sender of
a message deletes his/her own message, he/she will have an option to delete the message
from every recipient’s device, which would result in the original picture, video, or text
content no longer appearing on all recipients’ devices.

Based on my training and experience, and training and experience of others I have spoken
with, I know that Chat Application A often is used for, among other things, illegal activity,
including access to, and the exchange of, child pornography, because of the high degree of
anonymity that is offered to Chat Application A users.

In January 2023, HSI Springfield, Illinois (hereinafter, “HSI Springfield”) conducted a
search warrant on the residence of a suspect (hereinafter referred to as “Person 1”) who
was a member of a large-scale group chat (hereinafter referred to as “Group Chat A”)
involving numerous individuals trading child pornography. The investigation identified a
verified phone number xxx-xxx-3081 (“SUBJECT ACCOUNT”) as a member in Group
Chat A on Chat Application A, as outlined further in the affidavit in support of search
warrant for MILLER and for MILLER’s residence (attached hereto as SEALED EXHIBIT
A and incorporated by reference). See #23-mj-8115-PGL and 23-mj-8116-PGL. The
investigation confirmed that MILLER is the registered owner of that phone number. A

review of MILLER’s criminal record revealed that in September 2018, MILLER was
10.

11.

12.

Case 1:23-cr-10150-PBS Document 2-1 Filed 05/03/23 Page 4 of 8

convicted of possession of child pornography out of Essex County Superior Court and
received a three year probationary term. I am aware that, because of that conviction,
MILLER is required to register as a sex offender in Massachusetts. According to the
Massachusetts Sex Offender Registry Board, MILLER’s registration includes his Beverly
residence and the phone number associated with the SUBJECT ACCOUNT.

Based on the investigation, on May 2, 2023, HSI obtained search warrants authorizing the
search of MILLER and his residence for evidence, fruits, and instrumentalities of violations
of 18 U.S.C. § 2252A. See # 23-mj-8115-PGL and 23-mj-8116-PGL.

On May 3, 2023, at approximately 6:07 am, HSI agents, with the assistance of local law
enforcement, executed the federal search warrants at the Beverly residence. MILLER was
present for the execution of the search warrant. The layout of the residence consists of one
bedroom, one bathroom and a small closet.

During the search of MILLER’s residence, agents located approximately 15 electronic
devices from the residence. Those devices included the following: one ASUS Laptop
Model X555Q, one Maivo Firstsmart external hard drive, one Samsung Galaxy cellular
device, and one Samsung tablet (collectively, the “SUBJECT DEVICES”). The SUBJECT
DEVICES were seized pursuant to the search warrants.

MILLER was informed by agents that he was not under arrest and could leave but that HSI
had a search warrant for the residence and for his person. Agents provided MILLER with
his Miranda rights verbally, and in writing. MILLER refused to sign the Miranda rights
and declined to speak with law enforcement officials.

HSI Agents conducted a preliminary forensic examination of the ASUS Laptop Model

X555Q, which was powered on but locked when it was discovered (hereinafter,
Case 1:23-cr-10150-PBS Document 2-1 Filed 05/03/23 Page 5 of8

“SUBJECT DEVICE 1”). Per the label located on SUBJECT DEVICE 1, it was
manufactured in China. A review of the installed programs on SUBJECT DEVICE 1
revealed that the Telegram desktop application and Chat Application A were installed, as
well as the MEGA and Veracrypt applications. Also, one file entitled “download.part 1”
was located in the file path \Users\Rob. This file was approximately 600 Gigabytes (GB)
in size, and did not appear to have a common file extension to identify the type of file. This

file was unable to be opened during the initial analysis, and it appears to possibly be an

encrypted volume.?

13. Additionally, on SUBJECT DEVICE 1 within a documents folder at the file path
‘‘\Users\Rob\Documents\”’, agents discovered approximately 15 videos depicting child
pornography. The majority depicted prepubescent females between the approximate ages
of 5-10 years old, and depicted penetration and other sexual acts, as well as masturbation.

14. By way of example, some of the child pornography files recovered from SUBJECT
DEVICE 1 included the following videos:

a. A video that is approximately 17 minutes and 3 seconds in length and depicts a
prepubescent female minor, who appears to be approximately 7 to 9 years old,

based upon the overall size of her body, and lack of pubic hair and breast

> T am aware that Telegram is an end-to-end communications application, Mega is a cloud-based
file sharing application, and Veracrypt is a program that allows users to encrypt files, drives, or
portions thereof. I am aware that all three of these programs have been previously encountered
in child exploitation investigations. Additionally, I am also aware that an encrypted volume is a
section of the hard drive that is separated from the rest of the volume and would not be
accessible to users without a password, passcode, or other decryption key. A user may utilize an
encrypted volume to protect data and make it private so that others cannot view or have access to
the data.
Case 1:23-cr-10150-PBS Document 2-1 Filed 05/03/23 Page 6 of 8

development. The video begins with the prepubescent female standing on a bed,
as she begins to remove her clothes. The video continues to display the now fully
nude prepubescent female inserting her own fingers into her anus with the camera
focuses in closely and the pans back out. At one instance, an adult hand is seen
rubbing the prepubescent female’s buttocks. At approximately 2 minutes and 58
seconds into the video a nude adult seen entering the scene, and begins to insert his
penis to the prepubescent female’s mouth. The act continues on further into the
video, and the prepubescent female is seen in different positions that further expose
her vagina to the camera. Later in the video, the adult male is seen inserting his
erect penis into the prepubescent female’s anus. The video continues, and the adult
erect penis is seen being inserted into the prepubescent female’s mouth again until
the conclusion of the video;

b. A video that is approximately 1 minute and 52 seconds in length, and depicts a
nude prepubescent female minor, who appears to be approximately 6 to 8 years old,
based upon overall size of her body, and lack of pubic hair and breast development.
The camera is primarily focused in on the prepubescent female’s genital area.
Throughout the duration of the video, an adult erect penis is seen being repeatedly
inserted into the prepubescent female’s anus;

c. A video that is approximately 1 hour 30 minutes and 50 seconds in length, and
depicts two nude prepubescent females, who appear to be approximately 6 to 8
years old, based upon the overall size of their bodies, and the lack of pubic hair and
breast development. The prepubescent females are depicted in the video along with

an adult male primarily in bedroom setting, but also in a bathroom at one point.
Case 1:23-cr-10150-PBS Document 2-1 Filed 05/03/23 Page 7 of 8

During the video, the adult male is seen inserting his erect penis to the mouths of
both the prepubescent females, as well as touching their vaginas with his hands,
objects, and his erect penis. The video also depicts the adult male’s hand spreading
apart the prepubescent females’ vaginas while focusing the camera in closely to
that area. The prepubescent females are also seen during the video running around
and jumping on a bed in various states of nudity. The video concludes with the

camera focused in closely on the adult male’s penis and one of the prepubescent

female’s vagina, and it appears that there is a white substance on the vagina.*

15. Forensic examination of the devices seized pursuant to the search warrants is ongoing.
CONCLUSION

16. Based on the foregoing information, I respectfully submit that there is probable cause to believe

4 T am aware that the “preferred practice” in the First Circuit is that.a magistrate judge view
images that agents believe constitute child pornography by virtue of their lascivious exhibition of

a child’s genitals. United States v. Brunette, 256 F.3d 14, 18-19 (1st Cir. 2001) (affiant’s “legal
conclusion parroting the statutory definition [...] absent any descriptive support and without an
independent review of the images” insufficient basis for determination of probable cause.).
Here, however, the descriptions offered in paragraph 14 herein “convey to the magistrate

more than [my] mere opinion that the imag[e] constitute[s] child pornography.” United States v.
Burdulis, 753 F. 3d 255, 261 (1st Cir. 2014) (distinguishing Brunette). Per HSI, the children in
this paragraph appear to be approximately 7-9 years old (paragraph 14(a)), and approximately
6-8 years old (paragraphs 14(b) and 14(c)), — all clearly younger than 18 — and each depicts a
child engaged in sexual activity rather than “merely” the lascivious display of her genitals.
Furthermore, the descriptions of the files herein are sufficiently specific as to the ages and
appearances of the alleged children as well as the nature of the sexual conduct pictured in each
file, such that the Court need not view the files to find that they depict child pornography. See
United States v. Syphers, 426 F.3d 461, 467 (1st Cir. 2005) (“The best practice is for an applicant
seeking a warrant based on images of alleged child pornography is for an applicant to append the
images or provide a sufficiently specific description of the images to enable the magistrate judge
to determine independently whether they probably depict real children.”) (emphasis added); see
also United States v. LaFortune, 520 F.3d 50, 56 (1st Cir. 2008)(similarly emphasizing Syphers
court’s use of “or” in describing the Brunettte “best practice”). Where I have included such
nonconclusory, sufficiently specific descriptions, this Court need not view the imagery to find
that they depict child pornography. Nonetheless, the described imagery is available for review at
the Court’s request.
Case 1:23-cr-10150-PBS Document 2-1 Filed 05/03/23 Page 8 of 8

that that on or about May 3, 2023, MILLER knowingly possessed material that contained one
or more images of child pornography, as defined in 18 U.S.C. § 2256(8), that involved a
prepubescent minor and a minor who had not attained 12 years of age, and that had been
mailed, and shipped and transported using any means and facility of interstate and foreign
commerce and in and affecting interstate and foreign commerce by any means, including by
computer, and that was produced using materials that had been mailed, and shipped and
transported in and affecting interstate and foreign commerce by any means, including by
computer, in violation of 18 U.S.C. §§ 2252A(a)(5)(B) and (b)(2).

Kendra M. Miller /by Paul C. Levengon

KENDRA M. MILLER

Special Agent
Homeland Security Investigations

Sworn telephonically before me in accordance.with Fed. Rule Crim. P. 4.1 this 3"! day of May,
2023. cen


File and source

File

2-att1.pdf

Size

289,542 bytes

SHA-256

7c0ea8100e4d36906c622ec7d0e301a02c06fd45ed510d9eb13beed9faf9bfd5

Our copy

2-att1.pdf

Original

No public link identified.